From mboxrd@z Thu Jan  1 00:00:00 1970
Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail
From: Michael Heerdegen <michael_heerdegen@web.de>
Newsgroups: gmane.emacs.help
Subject: Re: is melpa just unsigned?
Date: Fri, 19 May 2023 02:02:59 +0200
Message-ID: <87sfbtkx1o.fsf@web.de>
References: <CAJcAo8u5LWaLsgMNM-gPuhmRGTD+GYs3-=N-J0WypO5kbjqYiA@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain
Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214";
	logging-data="23590"; mail-complaints-to="usenet@ciao.gmane.io"
User-Agent: Gnus/5.13 (Gnus v5.13)
Cc: Samuel Wales <samologist@gmail.com>
To: help-gnu-emacs@gnu.org
Cancel-Lock: sha1:mClnQmZKmsVBRSHX5OChCOcPXB4=
Original-X-From: help-gnu-emacs-bounces+geh-help-gnu-emacs=m.gmane-mx.org@gnu.org Fri May 19 02:04:00 2023
Return-path: <help-gnu-emacs-bounces+geh-help-gnu-emacs=m.gmane-mx.org@gnu.org>
Envelope-to: geh-help-gnu-emacs@m.gmane-mx.org
Original-Received: from lists.gnu.org ([209.51.188.17])
	by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <help-gnu-emacs-bounces+geh-help-gnu-emacs=m.gmane-mx.org@gnu.org>)
	id 1pznbD-0005yH-7k
	for geh-help-gnu-emacs@m.gmane-mx.org; Fri, 19 May 2023 02:03:59 +0200
Original-Received: from localhost ([::1] helo=lists1p.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.90_1)
	(envelope-from <help-gnu-emacs-bounces@gnu.org>)
	id 1pznaT-0003L0-Jm; Thu, 18 May 2023 20:03:13 -0400
Original-Received: from eggs.gnu.org ([2001:470:142:3::10])
 by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <geh-help-gnu-emacs@m.gmane-mx.org>)
 id 1pznaR-0003CC-JL
 for help-gnu-emacs@gnu.org; Thu, 18 May 2023 20:03:11 -0400
Original-Received: from ciao.gmane.io ([116.202.254.214])
 by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
 (Exim 4.90_1) (envelope-from <geh-help-gnu-emacs@m.gmane-mx.org>)
 id 1pznaP-0007XR-Vd
 for help-gnu-emacs@gnu.org; Thu, 18 May 2023 20:03:11 -0400
Original-Received: from list by ciao.gmane.io with local (Exim 4.92)
 (envelope-from <geh-help-gnu-emacs@m.gmane-mx.org>)
 id 1pznaL-0004eR-4C
 for help-gnu-emacs@gnu.org; Fri, 19 May 2023 02:03:05 +0200
X-Injected-Via-Gmane: http://gmane.org/
Received-SPF: pass client-ip=116.202.254.214;
 envelope-from=geh-help-gnu-emacs@m.gmane-mx.org; helo=ciao.gmane.io
X-Spam_score_int: -13
X-Spam_score: -1.4
X-Spam_bar: -
X-Spam_report: (-1.4 / 5.0 requ) BAYES_00=-1.9,
 FREEMAIL_FORGED_FROMDOMAIN=0.249, FREEMAIL_FROM=0.001,
 HEADER_FROM_DIFFERENT_DOMAINS=0.25, SPF_HELO_NONE=0.001, SPF_PASS=-0.001,
 T_SCC_BODY_TEXT_LINE=-0.01 autolearn=no autolearn_force=no
X-Spam_action: no action
X-BeenThere: help-gnu-emacs@gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Users list for the GNU Emacs text editor <help-gnu-emacs.gnu.org>
List-Unsubscribe: <https://lists.gnu.org/mailman/options/help-gnu-emacs>,
 <mailto:help-gnu-emacs-request@gnu.org?subject=unsubscribe>
List-Archive: <https://lists.gnu.org/archive/html/help-gnu-emacs>
List-Post: <mailto:help-gnu-emacs@gnu.org>
List-Help: <mailto:help-gnu-emacs-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/help-gnu-emacs>,
 <mailto:help-gnu-emacs-request@gnu.org?subject=subscribe>
Errors-To: help-gnu-emacs-bounces+geh-help-gnu-emacs=m.gmane-mx.org@gnu.org
Original-Sender: help-gnu-emacs-bounces+geh-help-gnu-emacs=m.gmane-mx.org@gnu.org
Xref: news.gmane.io gmane.emacs.help:143647
Archived-At: <http://permalink.gmane.org/gmane.emacs.help/143647>

Samuel Wales <samologist@gmail.com> writes:

> as a debian user, i am used to all packages AND the package list being
> signed [i think].  i do not know all the security implications of not
> signing an archive list, but it sounds dodgy.  in any case, the error
> should definitely not be there?
>
> if the archive contents file is not signed, what does htis mean in
> practice?  what are the attack vectors?

If you get no answers here... since Melpa is not part of Emacs, maybe you
have more luck if you ask the Melpa people?

Michael.