Re: Fwd: Should package.el support notifying on package security updates?

[Stefan Monnier <monnier@iro.umontreal.ca>]

> So the advocates of having this kind of flagging should be
> the ones responsible for digging up new resources, IMO.

In the context of ELPA, I could suggest the following path:

- Step 1: improve the protocol so that `package.el` can display the
  "recent news" that (Non)GNU ELPA archives show in the HTML page (and
  the release announcements emails).

- Step 2: highlight keywords like "security fix" in the "recent news".

- Step 3: improve the "recent news" system so that `package.el` could
  distinguish the part of the news corresponding to the potential update
  (currently the recent news is not parsed so we don't know which news
  applies to which version).

- Step 4: highlight the updates that include "security fix" in their news.

I'm not sure "step 4" would be useful in the current context, but maybe
by the time we have made the previous steps (which are useful regardless
of step 4) the situation will be different.


        Stefan