From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.devel Subject: Re: [PATCH] package.el: check tarball signature Date: Mon, 30 Sep 2013 22:58:13 +0300 Message-ID: <83d2nqdqui.fsf@gnu.org> References: Reply-To: Eli Zaretskii NNTP-Posting-Host: plane.gmane.org X-Trace: ger.gmane.org 1380571133 21448 80.91.229.3 (30 Sep 2013 19:58:53 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Mon, 30 Sep 2013 19:58:53 +0000 (UTC) Cc: emacs-devel@gnu.org To: Daiki Ueno Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Mon Sep 30 21:58:55 2013 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1VQjcK-0002E8-Am for ged-emacs-devel@m.gmane.org; Mon, 30 Sep 2013 21:58:52 +0200 Original-Received: from localhost ([::1]:51415 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VQjcK-0007ts-1g for ged-emacs-devel@m.gmane.org; Mon, 30 Sep 2013 15:58:52 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:43151) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VQjcB-0007tm-Hk for emacs-devel@gnu.org; Mon, 30 Sep 2013 15:58:49 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VQjc5-0006wV-NZ for emacs-devel@gnu.org; Mon, 30 Sep 2013 15:58:43 -0400 Original-Received: from mtaout20.012.net.il ([80.179.55.166]:36924) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VQjc5-0006wO-Fd; Mon, 30 Sep 2013 15:58:37 -0400 Original-Received: from conversion-daemon.a-mtaout20.012.net.il by a-mtaout20.012.net.il (HyperSendmail v2007.08) id <0MTY00600FAQUE00@a-mtaout20.012.net.il>; Mon, 30 Sep 2013 22:58:14 +0300 (IDT) Original-Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout20.012.net.il (HyperSendmail v2007.08) with ESMTPA id <0MTY0068RFH1COA0@a-mtaout20.012.net.il>; Mon, 30 Sep 2013 22:58:14 +0300 (IDT) In-reply-to: X-012-Sender: halo1@inter.net.il X-detected-operating-system: by eggs.gnu.org: Solaris 10 X-Received-From: 80.179.55.166 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:163745 Archived-At: > From: Daiki Ueno > Date: Mon, 30 Sep 2013 15:48:16 -0400 > > Well, I still don't understand why this is advertised as such a > difficult problem, particularly why package.el would need sign operation > with Emacs. Am I missing something? > > Perhaps it might make sense to discuss with some code. Here it is. > > The code verifies a detached signature NAME-VERSION.tar.sig with a > trusted keyring located under ~/.emacs.d/elpa/gnupg/. That's it. > > For uploading packages, we could simply use the same mechanism as > gnupload in Gnulib. > > It's actually a 10-minute work at an airport lobby and tested only with > the local package archive. Thanks, but please add a defcustom to disable this check (e.g., because gnupg isn't installed, and isn't going to be). In general, I think .sig files are there for those who want to verify the packages, but users should not be forced to do that as a prerequisite for downloading. (And no, the y-or-n-p question doesn't cut it: it's a nuisance to have to answer that question every time.)