Ihor Radchenko <[email protected]> writes: > Daniel Mendler <[email protected]> writes: > >>> It is about forcing people to download code from online resources they >>> do not expect. >> >> This seems a bit artificial as argument. You also have to clone the >> repository once in the beginning. The next step would then be to >> download dependencies, and if desired this could require a manual >> confirmation or a manual invocation of "make download-deps". I am wary >> myself of code which pulls in additional code automatically. > > Yes, and I like that Morgan's patch does exactly this. > Even more robust is having a module, so that people cloning Org know > that Org maintainers verified the code they vendor.
If the code is downloaded as tarball, I strongly recommend to check it against a sha256 hash. See for instance: https://github.com/minad/doom-on-emacs/blob/9d5929335c4080699a2daa153ace2996c905008a/Makefile#L17 This way you would get similar guarantees. Daniel
