Subject: bug#21382: [PATCH] Use HTTPS for package repo URLs

From: Ted Zlatanov <[email-masked]>
Date: Thu, 05 Nov 2015 14:36:42 -0500

On Mon, 31 Aug 2015 12:02:09 -0400 Glenn Morris <[email-masked]> wrote: 

GM> Francois Marier wrote:

>> In order to avoid having users pull emacs packages over HTTP (where they can
>> be intercepted and modified by network attackers),
...
>> I have changed the default URLs for the package repositories to use HTTPS.

GM> Thanks for the patch, but more is needed than just unconditionally
GM> changing http to https. See discussion in

GM> http://lists.gnu.org/archive/html/emacs-devel/2015-05/msg00110.html

Francois, would you be interested in leading the work on those items?
I'll assist any way I can but I am unable to do it myself.

Ted