On Fri 2018-02-09 06:28:04 +0000, Adam Plaice wrote: > Thanks very much for the reply. I fully agree that the verifying of > git tags by MELPA would be valuable (and rather important from a > security perspective), and will bring it up.
Thanks for doing that! If you need any backup in the discussion, or if you think that your suggestion is not being taken as seriously as is warranted, i'd be happy to try to help explain the issues to the MELPA folks -- contact me directly offlist if you want to coordinate on this. > BTW, is the GitHub mirror https://github.com/notmuch/notmuch/ > mentioned in README.rst, semi-official in the sense of being likely to > be up to date? If, yes, it could be used as a stopgap intermediary > "source" for MELPA, until https transport is possible with the main > notmuch repository or MELPA supports verifying signed git tags. I think if you use the github mirror, you might just be pushing off cleartext fetching to someone else, since that mirror appears to be synced over http itself :/ I don't actually know who maintains that mirror, and i don't know how to update where it syncs from... However, Carl Worth (in Cc) just mentioned on IRC that he set up https for the official notmuch repo! So please use this URL: https://git.notmuchmail.org/git/notmuch Thanks Carl! :) All the best, --dkg
Description: PGP signature
_______________________________________________ notmuch mailing list email@example.com https://notmuchmail.org/mailman/listinfo/notmuch