Default package-archives to HTTPS

[Ben Sturmfels <ben@sturm.com.au>]

[-- Attachment #1.1: Type: text/plain, Size: 464 bytes --]

Hi Folks,

I've attached a small patch to switch the `package-archives' default,
http://elpa.gnu.org/packages/, to HTTPS. This helps to avoid
surveillance or tampering with downloaded packages.

Thanks to François Marier for the suggestion:
https://identi.ca/fmarier/note/XBKVu8OLT9KiUmqIj-a4Rg

This is my first patch to Emacs, so let me know if it needs any changes.

Regards,
Ben

-- 
Ben Sturmfels

Sturm
www.sturm.com.au
(03) 9024 2467


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1.2: package-archive-default-https.patch --]
[-- Type: text/x-diff, Size: 1420 bytes --]

From 46ee3020703c951eeb975ff95fad3b1689c20b49 Mon Sep 17 00:00:00 2001
From: Ben Sturmfels <ben@sturm.com.au>
Date: Mon, 7 Sep 2015 14:27:35 +1000
Subject: [PATCH] Switch default package archive to HTTPS

* lisp/emacs-lisp/package.el (package-archives): Use HTTPS to access the
  default archive, elpa.gnu.org/packages/.

Copyright-paperwork-exempt: yes
---
 lisp/emacs-lisp/package.el | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lisp/emacs-lisp/package.el b/lisp/emacs-lisp/package.el
index 4d3678a..5579db6 100644
--- a/lisp/emacs-lisp/package.el
+++ b/lisp/emacs-lisp/package.el
@@ -204,14 +204,14 @@ If VERSION is nil, the package is not loaded (it is \"disabled\")."
   :risky t
   :version "24.1")
 
-(defcustom package-archives '(("gnu" . "http://elpa.gnu.org/packages/"))
+(defcustom package-archives '(("gnu" . "https://elpa.gnu.org/packages/"))
   "An alist of archives from which to fetch.
 The default value points to the GNU Emacs package repository.
 
 Each element has the form (ID . LOCATION).
  ID is an archive name, as a string.
  LOCATION specifies the base location for the archive.
-  If it starts with \"http:\", it is treated as a HTTP URL;
+  If it starts with \"http:\" or \"https:\", it is treated as a URL;
   otherwise it should be an absolute directory name.
   (Other types of URL are currently not supported.)
 
-- 
1.9.1


[-- Attachment #2: Type: application/pgp-signature, Size: 818 bytes --]