Re: ELPA security

[Stefan Monnier]

> OK, so the package vector will have a new element.  Releasing a package
> will require releasing a new `archive-contents' with an updated
> signature for that package and re-signing it with the "GNU ELPA"
> maintainer key.

Actually, I see a problem with this scheme, now that we also keep around
older versions of the packages.  So maybe it's better to keep the
signatures in a separate file, next to the signed file (e.g. have foo.tar
and foo.tar.gpgsig).


        Stefan