Re: package.el + DVCS for security and convenience

[Stefan Monnier]

>>> The problem then is how to verify GPG signatures,
SM> Easy: pass them to GPG.
>>> especially if GnuPG is not installed.
SM> Then don't check.
SM> If the user wants to check his packages, she'll have to install GPG,
SM> which AFAIK is not harder than installing Emacs.
> GPG is not always available

The important thing is that GPG can always be installed, so if the user
cares about checking integrity, she can install GPG.

> and I'd rather not call an external tool in the long term.  But it's
> an acceptable compromise for now, yes.

When we get a proper FFI, we'll probably get other options.  But rewriting
the code in Elisp doesn't sound like a an attractive option to me.


        Stefan