Default package-archives to HTTPS

Default package-archives to HTTPS

[Ben Sturmfels]

[-- Attachment #1.1: Type: text/plain, Size: 464 bytes --]

Hi Folks,

I've attached a small patch to switch the `package-archives' default,
http://elpa.gnu.org/packages/, to HTTPS. This helps to avoid
surveillance or tampering with downloaded packages.

Thanks to François Marier for the suggestion:
https://identi.ca/fmarier/note/XBKVu8OLT9KiUmqIj-a4Rg

This is my first patch to Emacs, so let me know if it needs any changes.

Regards,
Ben

-- 
Ben Sturmfels

Sturm
www.sturm.com.au
(03) 9024 2467


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1.2: package-archive-default-https.patch --]
[-- Type: text/x-diff, Size: 1420 bytes --]

From 46ee3020703c951eeb975ff95fad3b1689c20b49 Mon Sep 17 00:00:00 2001
From: Ben Sturmfels <ben@sturm.com.au>
Date: Mon, 7 Sep 2015 14:27:35 +1000
Subject: [PATCH] Switch default package archive to HTTPS

* lisp/emacs-lisp/package.el (package-archives): Use HTTPS to access the
  default archive, elpa.gnu.org/packages/.

Copyright-paperwork-exempt: yes
---
 lisp/emacs-lisp/package.el | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lisp/emacs-lisp/package.el b/lisp/emacs-lisp/package.el
index 4d3678a..5579db6 100644
--- a/lisp/emacs-lisp/package.el
+++ b/lisp/emacs-lisp/package.el
@@ -204,14 +204,14 @@ If VERSION is nil, the package is not loaded (it is \"disabled\")."
   :risky t
   :version "24.1")
 
-(defcustom package-archives '(("gnu" . "http://elpa.gnu.org/packages/"))
+(defcustom package-archives '(("gnu" . "https://elpa.gnu.org/packages/"))
   "An alist of archives from which to fetch.
 The default value points to the GNU Emacs package repository.
 
 Each element has the form (ID . LOCATION).
  ID is an archive name, as a string.
  LOCATION specifies the base location for the archive.
-  If it starts with \"http:\", it is treated as a HTTP URL;
+  If it starts with \"http:\" or \"https:\", it is treated as a URL;
   otherwise it should be an absolute directory name.
   (Other types of URL are currently not supported.)
 
-- 
1.9.1


[-- Attachment #2: Type: application/pgp-signature, Size: 818 bytes --]

Re: Default package-archives to HTTPS

[Xue Fuqiao]

On Mon, Sep 7, 2015 at 12:43 PM, Ben Sturmfels <ben@sturm.com.au> wrote:
> Hi Folks,

Hi Ben,

> I've attached a small patch to switch the `package-archives' default,
> http://elpa.gnu.org/packages/, to HTTPS. This helps to avoid
> surveillance or tampering with downloaded packages.

Thanks for wanting to contribute!  There was some related discussion
before, but (unfortunately) no substantial progress has been made yet.

See:

* https://debbugs.gnu.org/cgi/bugreport.cgi?bug=21382
* https://lists.gnu.org/archive/html/emacs-devel/2015-05/msg00110.html

Re: Default package-archives to HTTPS

[Ben Sturmfels]

[-- Attachment #1: Type: text/plain, Size: 741 bytes --]

On 08/09/15 09:00, Xue Fuqiao wrote:
> On Mon, Sep 7, 2015 at 12:43 PM, Ben Sturmfels <ben@sturm.com.au> wrote:
>> Hi Folks,
> 
> Hi Ben,
> 
>> I've attached a small patch to switch the `package-archives' default,
>> http://elpa.gnu.org/packages/, to HTTPS. This helps to avoid
>> surveillance or tampering with downloaded packages.
> 
> Thanks for wanting to contribute!  There was some related discussion
> before, but (unfortunately) no substantial progress has been made yet.
> 
> See:
> 
> * https://debbugs.gnu.org/cgi/bugreport.cgi?bug=21382
> * https://lists.gnu.org/archive/html/emacs-devel/2015-05/msg00110.html

Fantastic, thanks Xue. Please disregard my message - I'm glad Francois
is already onto this. :)


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]