Re: is melpa just unsigned?

[Michael Heerdegen]

Samuel Wales <samologist@gmail.com> writes:

> as a debian user, i am used to all packages AND the package list being
> signed [i think].  i do not know all the security implications of not
> signing an archive list, but it sounds dodgy.  in any case, the error
> should definitely not be there?
>
> if the archive contents file is not signed, what does htis mean in
> practice?  what are the attack vectors?

If you get no answers here... since Melpa is not part of Emacs, maybe you
have more luck if you ask the Melpa people?

Michael.