Subject: Re: bug#33825: 25.2; , Failing to verify signature for ELPA debbugs package

From: Stefan Kangas <[email-masked]>
Date: Mon, 16 Sep 2019 21:13:13 +0200

Eli Zaretskii <[email-masked]> writes:

> > How about also adding a recommendation to use https, as far as
> > possible, for package archives?  I guess that could be added to both
> > the doc string of package-archives and possibly also the manual.  That
> > would help security and avoid issues such as these.
>
> I'd leave this out of the manual.  Doc string should be enough.

Thanks.  How about the attached patch?

Best regards,
Stefan Kangas
From afc49ccd4e3e593f1f2dfffbdd6e457132efa9cd Mon Sep 17 00:00:00 2001
From: Stefan Kangas <[email-masked]>
Date: Mon, 16 Sep 2019 21:09:32 +0200
Subject: [PATCH] Recommend https for package-archives

* lisp/emacs-lisp/package.el (package-archives): Doc fix to recommend
using https sources instead of http where possible.  (Bug#33825)
---
 lisp/emacs-lisp/package.el | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lisp/emacs-lisp/package.el b/lisp/emacs-lisp/package.el
index ef0c5171de..69c4427e0a 100644
--- a/lisp/emacs-lisp/package.el
+++ b/lisp/emacs-lisp/package.el
@@ -214,7 +214,10 @@ package-archives
   (Other types of URL are currently not supported.)
 
 Only add locations that you trust, since fetching and installing
-a package can run arbitrary code."
+a package can run arbitrary code.
+
+It is advisable to prefer HTTPS URLs over HTTP URLs where
+possible, for improved security and stability."
   :type '(alist :key-type (string :tag "Archive name")
                 :value-type (string :tag "URL or directory name"))
   :risky t
-- 
2.20.1