Re: expand tls to elpa.gnu.org

[Chong Yidong]

Ted Zlatanov <address@hidden> writes:

> aj> so far there is no tls/ssl support for elpa.gnu.org . In my opinion
> aj> this is a real problem as there is no way to check the authenticity
> aj> and integrity of downloaded packages. Is it possible to expand the
> aj> certificate of gnu.org to elpa.gnu.org?
> aj> Of course this makes the package-manager not checking integrity -
> aj> but I think anyone interested in doing so can modify it without
> aj> problems.
>
> I can install a certificate but it has to be requested by the domain
> owner so I'm not sure who to bug about it.

Why not simply distribute the certificate file with Emacs?

Also, the Emacs package manager uses the url library for downloading via
http.  How well does that library support https?  If I give
`url-retrieve-synchronously' a https url, does it currently DTRT?