GNU bug report logs - #21238
ELPA not available over TLS

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 21238 in the body.
You can then email your comments to 21238 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Glyph <glyph <at> twistedmatrix.com>
To: bug-gnu-emacs <at> gnu.org
Subject: ELPA not available over TLS
Date: Tue, 11 Aug 2015 16:38:50 -0700

[Message part 1 (text/plain, inline)]

Even if packages were signed and I could verify all of them, I still don't think it's the NSA's business which packages I've requested from ELPA.  It would be nice if ELPA were available over TLS to provide both an additional level of security, and to provide an interim solution while we are waiting for package signing.

[Message part 2 (text/html, inline)]

Message #8 received at 21238 <at> debbugs.gnu.org (full text, mbox):

From: Stefan Monnier <monnier <at> IRO.UMontreal.CA>
To: Glyph <glyph <at> twistedmatrix.com>
Cc: 21238 <at> debbugs.gnu.org
Subject: Re: bug#21238: ELPA not available over TLS
Date: Tue, 11 Aug 2015 22:25:07 -0400

> Even if packages were signed and I could verify all of them, I still don't
> think it's the NSA's business which packages I've requested from ELPA.
> It would be nice if ELPA were available over TLS to provide both an
> additional level of security,

AFAIK you can already use "https://..." addresses.  This should work for
the GNU ELPA server, at least.

> and to provide an interim solution while we are waiting for
> package signing.

All GNU ELPA packages are signed and Emacs-24.5 does check them if you
have GPG installed.


        Stefan

Message #11 received at 21238 <at> debbugs.gnu.org (full text, mbox):

From: Glyph <glyph <at> twistedmatrix.com>
To: Stefan Monnier <monnier <at> iro.umontreal.ca>
Cc: 21238 <at> debbugs.gnu.org
Subject: Re: bug#21238: ELPA not available over TLS
Date: Wed, 12 Aug 2015 10:22:58 -0700

[Message part 1 (text/plain, inline)]

> On Aug 11, 2015, at 7:25 PM, Stefan Monnier <monnier <at> iro.umontreal.ca> wrote:
> 
>> Even if packages were signed and I could verify all of them, I still don't
>> think it's the NSA's business which packages I've requested from ELPA.
>> It would be nice if ELPA were available over TLS to provide both an
>> additional level of security,
> 
> AFAIK you can already use "https://..." addresses.  This should work for
> the GNU ELPA server, at least.

Okay, I was sure I'd hit https://elpa.gnu.org and it was a connection error before I posted this bug.  I just did again and it worked, so... I must have been in error.

>> and to provide an interim solution while we are waiting for
>> package signing.
> 
> All GNU ELPA packages are signed and Emacs-24.5 does check them if you
> have GPG installed.

Thanks also for this bit of information.  It should probably require that GPG be installed if package.el is to be used then, but that is a separate issue.

Sorry for the bogus report!

[Message part 2 (text/html, inline)]

Message #16 received at 21238-done <at> debbugs.gnu.org (full text, mbox):

From: Xue Fuqiao <xfq.free <at> gmail.com>
To: 21238-done <at> debbugs.gnu.org
Cc: Glyph <glyph <at> twistedmatrix.com>, Stefan Monnier <monnier <at> iro.umontreal.ca>
Subject: Re: bug#21238: ELPA not available over TLS
Date: Thu, 13 Aug 2015 08:39:15 +0800

On Thu, Aug 13, 2015 at 1:22 AM, Glyph <glyph <at> twistedmatrix.com> wrote:

> Okay, I was sure I'd hit https://elpa.gnu.org and it was a connection error
> before I posted this bug.  I just did again and it worked, so... I must have
> been in error.

You're not alone: https://github.com/syl20bnr/spacemacs/issues/2596

Closing.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.