bug#32544: [ELPA] core packages need generated files

[Stefan Monnier]

>> I think the reasons why I'm more worried about elpa.gnu.org than the
>> end-user's machines include:
>>
>> - very little time between the moment we receive the commit-diffs by
>>   email and the moment the code is run.  So even if we notice the
>>   offending code on the spot, there's not much time to react.
>> - elpa.gnu.org is part of infrastructure that Emacs users trust when
>>   downloading GNU ELPA packages (e.g. it holds the PGP signing key), so
>>   a breach could affect all GNU ELPA users (especially if not
>>   noticed).

One more reason:

- elpa.gnu.org *can* run that code in a sandbox, whereas the end-user
  really wants to run the package's code in his "real" system (or
  otherwise would need to run his whole Emacs session in a sandbox).

> Sounds very sensible, best of luck! :)

Hmm... looks like you forgot to attach the patch to your message.
Could you send it again, please?


        Stefan