From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Stefan Monnier Newsgroups: gmane.emacs.devel Subject: Re: package.el + DVCS for security and convenience Date: Tue, 08 Jan 2013 16:20:50 -0500 Message-ID: References: <8738zf70ep.fsf@riseup.net> <20121222141742.7494b429fe36e5ccef50cf6f@gmail.com> <87d2y2w9j5.fsf@uwakimon.sk.tsukuba.ac.jp> <87wqwas0gr.fsf@bzg.ath.cx> <87d2y2p6d7.fsf@bzg.ath.cx> <87sj6xg9p2.fsf_-_@lifelogs.com> <87k3s78hsc.fsf@lifelogs.com> <87ehi65uv4.fsf@lifelogs.com> <87hamxndc7.fsf@lifelogs.com> <87y5g8n4y1.fsf@lifelogs.com> <87lic8b9ai.fsf@uwakimon.sk.tsukuba.ac.jp> <87zk0mktir.fsf@lifelogs.com> <87bod1bvhg.fsf@uwakimon.sk.tsukuba.ac.jp> <877gnpkq1u.fsf@lifelogs.com> <87y5g4a1ob.fsf@uwakimon.sk.tsukuba.ac.jp> <87sj6bg0zj.fsf@lifelogs.com> <87obgza7d7.fsf@uwakimon.sk.tsukuba.ac.jp> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1357680063 30641 80.91.229.3 (8 Jan 2013 21:21:03 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Tue, 8 Jan 2013 21:21:03 +0000 (UTC) Cc: emacs-devel@gnu.org To: "Stephen J. Turnbull" Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Tue Jan 08 22:21:19 2013 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1Tsgbj-0004QI-HC for ged-emacs-devel@m.gmane.org; Tue, 08 Jan 2013 22:21:15 +0100 Original-Received: from localhost ([::1]:52490 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TsgbT-0003r4-S7 for ged-emacs-devel@m.gmane.org; Tue, 08 Jan 2013 16:20:59 -0500 Original-Received: from eggs.gnu.org ([208.118.235.92]:35664) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TsgbP-0003q4-SA for emacs-devel@gnu.org; Tue, 08 Jan 2013 16:20:57 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TsgbO-0003h9-O6 for emacs-devel@gnu.org; Tue, 08 Jan 2013 16:20:55 -0500 Original-Received: from pruche.dit.umontreal.ca ([132.204.246.22]:51787) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TsgbO-0003h0-Ii for emacs-devel@gnu.org; Tue, 08 Jan 2013 16:20:54 -0500 Original-Received: from pastel.home (lechon.iro.umontreal.ca [132.204.27.242]) by pruche.dit.umontreal.ca (8.14.1/8.14.1) with ESMTP id r08LKlVE032612; Tue, 8 Jan 2013 16:20:48 -0500 Original-Received: by pastel.home (Postfix, from userid 20848) id 98ABE59230; Tue, 8 Jan 2013 16:20:51 -0500 (EST) In-Reply-To: <87obgza7d7.fsf@uwakimon.sk.tsukuba.ac.jp> (Stephen J. Turnbull's message of "Wed, 09 Jan 2013 02:53:56 +0900") User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3.50 (gnu/linux) X-NAI-Spam-Flag: NO X-NAI-Spam-Threshold: 5 X-NAI-Spam-Score: 0 X-NAI-Spam-Rules: 1 Rules triggered RV4455=0 X-NAI-Spam-Version: 2.2.0.9309 : core <4455> : streams <887664> : uri <1314188> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 132.204.246.22 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:156163 Archived-At: >> Stefan has confirmed (I believe) the GNU ELPA maintainers will use a >> single "GNU ELPA" key to sign package releases. > Have you given up on having every commit signed? I haven't even tried to sign a single Bzr commit. Hell, I use GPG rarely enough, that I typically end up having to create a new key because I can't remember the password I used for the last one. And I worry about what happens if/when we restructure the repository (currently we have a single Bzr branch with all packages in it (except for Org), but we'll probably want to move to a setup where more packages have their own branches, also we may move from Bzr to something else). And I'm not sure what would be the gain with such signatures: I'm shocked to hear people would trust me, since I don't trust myself (and some (former?) friends of mine know I'm not trustworthy). [ For the record, I work in the context of certified programming, where you don't want to trust people at all, and instead expect them to give you a formal proof that their code is safe. ] > You are highly skilled at missing the point. Let's try to stay clear of such ad-hominem, please. Stefan