Re: ELPA security

[Stefan Monnier]

> OK, so the package vector will have a new element.  Releasing a package
> will require releasing a new `archive-contents' with an updated
> signature for that package and re-signing it with the "GNU ELPA"
> maintainer key.

The `archive-contents' file is re-created afresh every day via a cron-job.

> Last question: do you want to provide for files that may show up during
> compilation?

Compilation takes place during installation and runs part of the
downloaded code, so by the time we're compiling it's too late to check
for security problems.


        Stefan