Re: GNU ELPA security and Org-mode

[Bastien]

Thanks for the feedback.

Stefan Monnier <address@hidden> writes:

>> - I create the "elpa/packages/org" directory in this branch.
>
> No.  It should contain the same files with the same names as the
> tarball would.

Not sure here.

Do you mean elpa.git should contain

elpa/packages/org-20180430/org.el
elpa/packages/org-20180430/org-table.el

etc.?

>> - I copy the content of an Org ELPA archive (eg org-20180430.tar)
>>   into this directory, with org-{version|pkg|loaddefs}.el files.
>
> Yes, except for org-pkg.el (the corresponding info should be in org.el
> instead).

Because org-pkg.el is generated by elpa/GNUmakefile, right?

If so, why adding org-loaddefs.el since org-autoloads.el would also be
autogenerated?

And would org-version.el still be required?

Or the package version would just be extracted from the org.el
"Version: 9.1.12" keyword?

If possible, I'd like to not add org-loaddefs.el and org-version.el
and have org-autoloads.el and the package version autogenerated like
for any other package.

-- 
 Bastien