Re: Proposal to include obligatory PGP verification of packages from any repository

[Jean Louis]

* Stefan Kangas <stefankangas@gmail.com> [2020-10-19 18:55]:
> We have signing of packages on the package archive side that is verified
> by default when it exists.  See `package-check-signature'.  (If I'm not
> mistaken, GNU ELPA signs packages but MELPA doesn't.  Please correct me
> if I'm wrong.)

Now I know about that. It was allow-unsigned as default, correct me if
mistaken. The more packages there are around, the more this becomes
potential problem, it is security hole, as warnings about potential
problems are too few.

Now when I turned it on, I cannot see or feel that some package was
verified, I tried installing from ELPA, but did not see any
difference, and cannot find any .sig files.

It would be good for user to get those verifications, as verification
should be doable personally.

Package signing is not ultimate security, it is just one level making
packages more secure.

> Note that package signatures still leaves us open to replay attacks.
> See Bug#19479 and the branch scratch/package-security for an attempt to
> improve the situation.

> I think it would be useful if package archives could implement a
> requirement for signed commits before building a new package.  This
> could be optional or mandatory, and would buy us an additional layer of
> protection against compromised developer credentials.

I have seen there apparently good recommendation for improvement of
package security.

But we do not have it.