From: Ted Zlatanov <tzz@lifelogs.com>
To: emacs-devel@gnu.org
Subject: Re: In Support of ELPA
Date: Thu, 13 Jul 2017 11:05:49 -0400 [thread overview]
Message-ID: <87d194idgy.fsf@lifelogs.com> (raw)
In-Reply-To: E1dVd9T-000502-Fw@fencepost.gnu.org
On Thu, 13 Jul 2017 08:23:27 -0400 Richard Stallman <rms@gnu.org> wrote:
RS> [[[ To any NSA and FBI agents reading my email: please consider ]]]
RS> [[[ whether defending the US Constitution against all enemies, ]]]
RS> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]
SM> I find it is important for GNU ELPA not to *pull* from outside hosts
SM> that are not under our control. Instead code should be pushed to it by
SM> people who have write access (hence take on the responsibility of paying
SM> attention to copyright and such).
>> Can GnuPG signatures satisfy that requirement so the code can be pulled?
RS> The question is so vague that I can't relate it to the issue at hand.
RS> GPG signatures delivered by whom, when, signing what, to achieve what
RS> purpose?
Sorry for the vagueness.
I mean that maintainers of packages can use GnuPG signatures in Git to
sign a particular tag. So maybe that's enough to let the GNU ELPA pull
instead of requiring maintainers to push, because the signature will
guarantee that the code has been reviewed for copyright and other
requirements. The verification can be automated.
I think a pull-based system like that would reduce friction and increase
contributions, because maintainers won't have to get access to elpa.git
or push anything. They would just do a release tag as part of their
normal workflow.
Ted
next prev parent reply other threads:[~2017-07-13 15:05 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-11 21:46 In Support of ELPA Phillip Lord
2017-07-11 22:37 ` Stefan Monnier
2017-07-12 13:30 ` Ted Zlatanov
2017-07-13 12:23 ` Richard Stallman
2017-07-13 15:05 ` Ted Zlatanov [this message]
2017-07-13 22:02 ` Phillip Lord
2017-07-13 16:15 ` Phillip Lord
2017-07-14 1:20 ` Richard Stallman
2017-07-14 10:02 ` Phillip Lord
2017-07-16 1:50 ` Richard Stallman
2017-07-17 14:05 ` Phillip Lord
2017-07-14 2:12 ` Stefan Monnier
2017-07-14 6:48 ` Thien-Thi Nguyen
2017-07-15 1:35 ` Richard Stallman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87d194idgy.fsf@lifelogs.com \
--to=tzz@lifelogs.com \
--cc=emacs-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.