[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
bug#21382: [PATCH] Use HTTPS for package repo URLs
|
From: |
Glenn Morris |
|
Subject: |
bug#21382: [PATCH] Use HTTPS for package repo URLs |
|
Date: |
Mon, 31 Aug 2015 12:02:09 -0400 |
|
User-agent: |
Gnus (www.gnus.org), GNU Emacs (www.gnu.org/software/emacs/) |
Hi,
Francois Marier wrote:
> In order to avoid having users pull emacs packages over HTTP (where they can
> be intercepted and modified by network attackers),
elpa.gnu.org packages are gpg signed, which should prevent such modification.
> I have changed the default URLs for the package repositories to use HTTPS.
Thanks for the patch, but more is needed than just unconditionally
changing http to https. See discussion in
http://lists.gnu.org/archive/html/emacs-devel/2015-05/msg00110.html