Re: Security in the emacs package ecosystem

[Stefan Kangas]

Ihor Radchenko <yantar92@posteo.net> writes:

> WRT MELPA we can do the following:
> 1. Open an issue

I had a look, and turns out that there is one already:

    https://github.com/melpa/melpa/issues/1749

> 2. Allow users to demand package.el to verify signatures when
>    downloading packages. Interested users can then increase their
>    security by rejecting packages without .sig file.

Maybe I'm missing something, but isn't that `package-check-signature'?

Its current default is `allow-unsigned', however, which is about as
useful for security purposes as if it was nil.  I think we should
consider changing it to t in Emacs 30.