Re: security of the emacs package system, elpa, melpa and marmalade

[Stephen J. Turnbull]

Ted Zlatanov writes:

 > Hmm, looks like libnettle (brought in with GnuTLS) already provides most
 > of the infrastructure needed.  The question for me is, should I bother
 > with a full OpenPGP signature emulation,

No, don't just "emulate" it, implement the protocol accurately.

 > or is it sufficient to implement RSA/DSA/EC-based signatures for
 > Emacs internal use only?

No.  In security, multiple implementations are a very good thing as
long as they're used to cross-check correct implementation of a
protocol and don't define their own protocols.