RE: ELPA security

[Drew Adams]

> Ted> add DVCS support to package.el, supporting Git and 
> Ted> Bazaar, with the notion of "pull packages from repo X
> Ted> at tag/commit Y" in addition to the current "pull packages
> Ted> from URLs".  The VC package has to be involved
> Ted> here, instead of writing custom code.
> 
> What is the reason for this?
> 
> FWIW, I considered and rejected this approach when writing package.el.
> My reason was that I wanted packaging not to require any 
> external tools, so it would be available to all Emacs users.
> Also, KISS.
> 
> Mixing in VC seems to add a lot of potential failure modes.

+1

If Emacs Dev really wants to do this, why not separate it from package.el and
make its use optional?