From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Bastien Newsgroups: gmane.emacs.devel Subject: Re: ELPA security Date: Sat, 22 Dec 2012 06:07:19 +0100 Message-ID: <87obhmzl2f.fsf@bzg.ath.cx> References: <8738zf70ep.fsf@riseup.net> <871uejlbm1.fsf@lifelogs.com> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1356155808 7240 80.91.229.3 (22 Dec 2012 05:56:48 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sat, 22 Dec 2012 05:56:48 +0000 (UTC) To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Sat Dec 22 06:57:03 2012 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1TmI50-00061A-4G for ged-emacs-devel@m.gmane.org; Sat, 22 Dec 2012 06:57:02 +0100 Original-Received: from localhost ([::1]:55263 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TmI4m-00013N-Ee for ged-emacs-devel@m.gmane.org; Sat, 22 Dec 2012 00:56:48 -0500 Original-Received: from eggs.gnu.org ([208.118.235.92]:34237) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TmI4j-00013H-EO for emacs-devel@gnu.org; Sat, 22 Dec 2012 00:56:47 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TmI4h-0006A7-LP for emacs-devel@gnu.org; Sat, 22 Dec 2012 00:56:45 -0500 Original-Received: from mail-we0-f182.google.com ([74.125.82.182]:38659) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TmI4h-0006A1-ES for emacs-devel@gnu.org; Sat, 22 Dec 2012 00:56:43 -0500 Original-Received: by mail-we0-f182.google.com with SMTP id u54so2497819wey.41 for ; Fri, 21 Dec 2012 21:56:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:sender:from:to:subject:in-reply-to:date:references :user-agent:message-id:mime-version:content-type; bh=NbjAFoop4Q35tfQOv0H1vS89ORvm69zvUPCxlOBacPI=; b=tInFfyfQkDB4NxQ3blTWXHEgnZTG4+/n9YqLVCl3e5g+J+uPLkONXFZREoyb8pgzKb uNhfbg7F9QLc9hmDOG6ZARWPb04gDm01tcuKCUyTZze3yhQ1lBnouMV2xLKqTYZ8jXSt 9c9A1CNP2xA+S6rkbBBm0n/N7HwC5OIGsEdiEIgJa4NZdfAWZuFCJlR4oGlVRWJ0IovZ 593V72j2kJUTt17rCXqptMG3uWc9cQsgjoyUdeOoCjRATTN00oFJiswRmHuiet83uMm4 jYdVqf8Ga/fuRq3F1w47KpI4PxaXu4H1SpVVnHLdXoUoOBKWWQ7QUpZwRgA+79n6UZZA pq7A== X-Received: by 10.180.19.136 with SMTP id f8mr26384769wie.0.1356155801126; Fri, 21 Dec 2012 21:56:41 -0800 (PST) Original-Received: from bzg.localdomain (mar75-2-81-56-68-112.fbx.proxad.net. [81.56.68.112]) by mx.google.com with ESMTPS id s10sm21651865wiw.4.2012.12.21.21.56.40 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 21 Dec 2012 21:56:40 -0800 (PST) Original-Received: by bzg.localdomain (Postfix, from userid 1000) id 7C49A1C20D56; Sat, 22 Dec 2012 06:56:40 +0100 (CET) In-Reply-To: <871uejlbm1.fsf@lifelogs.com> (Ted Zlatanov's message of "Fri, 21 Dec 2012 09:32:22 -0500") User-Agent: Gnus/5.130006 (Ma Gnus v0.6) Emacs/24.3.50 (gnu/linux) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 74.125.82.182 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:155750 Archived-At: What about simply distributing, within GNU Emacs the list of md5 hashes of valid(ated) packages? We could do this for GNU ELPA at least, it seems quite straightforward to me -- but I'm not expert. -- Bastien