From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Stefan Monnier Newsgroups: gmane.emacs.devel Subject: Re: [PATCH] package.el: check tarball signature Date: Wed, 02 Oct 2013 23:51:30 -0400 Message-ID: References: <874n92x9em.fsf@flea.lifelogs.com> <87fvsk9m8b.fsf-ueno@gnu.org> <87txh0uf8n.fsf@flea.lifelogs.com> <877gdvamle.fsf-ueno@gnu.org> <87d2nnvkwd.fsf@flea.lifelogs.com> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1380772306 25100 80.91.229.3 (3 Oct 2013 03:51:46 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Thu, 3 Oct 2013 03:51:46 +0000 (UTC) To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Thu Oct 03 05:51:49 2013 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1VRZx7-0004H8-MN for ged-emacs-devel@m.gmane.org; Thu, 03 Oct 2013 05:51:49 +0200 Original-Received: from localhost ([::1]:39701 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VRZx7-0004bU-5m for ged-emacs-devel@m.gmane.org; Wed, 02 Oct 2013 23:51:49 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:51490) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VRZwx-0004bB-Ki for emacs-devel@gnu.org; Wed, 02 Oct 2013 23:51:46 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VRZwq-000788-Aa for emacs-devel@gnu.org; Wed, 02 Oct 2013 23:51:39 -0400 Original-Received: from ironport2-out.teksavvy.com ([206.248.154.182]:30564) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VRZwq-000784-6J for emacs-devel@gnu.org; Wed, 02 Oct 2013 23:51:32 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Av4EABK/CFFsoXM//2dsb2JhbABEvw4Xc4IeAQEEAVYoCws0EhQYDYhCBsEtjWGDKQOSWwOSHIFegxM X-IPAS-Result: Av4EABK/CFFsoXM//2dsb2JhbABEvw4Xc4IeAQEEAVYoCws0EhQYDYhCBsEtjWGDKQOSWwOSHIFegxM X-IronPort-AV: E=Sophos;i="4.84,565,1355115600"; d="scan'208";a="34645749" Original-Received: from 108-161-115-63.dsl.teksavvy.com (HELO pastel.home) ([108.161.115.63]) by ironport2-out.teksavvy.com with ESMTP/TLS/ADH-AES256-SHA; 02 Oct 2013 23:48:09 -0400 Original-Received: by pastel.home (Postfix, from userid 20848) id B6A2466374; Wed, 2 Oct 2013 23:51:30 -0400 (EDT) In-Reply-To: <87d2nnvkwd.fsf@flea.lifelogs.com> (Ted Zlatanov's message of "Wed, 02 Oct 2013 09:53:54 -0400") User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3.50 (gnu/linux) X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 206.248.154.182 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:163824 Archived-At: DU> I'm fine with signing with dput for Debian and gnupload for GNU, who DU> else of you really wants that feature. Reference? I don't want that feature in package.el where it does not belong. If someone wants it in package-x.el, that's fine, of course. > If we move to a branch-pull request-merge model, this will be much less > important since the signing will happen at the time of the merge on the > server; the reviewer never needs to manually sign anything. But at > least for now we need interactive tools to automate that process and > gnupload would certainly fill that need. So please don't dwell on this. Much too hypothetical for me. If/when we start supporting signatures provided by the author, we'll try and figure out how that can work (which is not obvious at all, since the signature should be applied to the tarball, but the tarball is generated later on by a batch process). Stefan