Subject: Re: bug#61277: FR: ELPA security - Restrict package builds to signed git commits

From: Stefan Monnier <[email-masked]>
Date: Wed, 15 Feb 2023 11:40:20 -0500

> If an attacker can introduce a commit containing malicious code, and
> create a new git tag pointing to that commit, the GNU ELPA scripts will
> fetch it, and release a new version of the package (now including the
> malicious code).  By requiring tags to be cryptographically signed, we
> can have a greater confidence that any new tag has at the very least
> been signed off by the developer him/herself.

Technical nitpick: currently, the elpa.gnu.org scripts do not pay
attention to any Git tags (signed or not) to do their work.  We only use
the commits and their contents/history.

        Stefan