Re: is melpa just unsigned?

[Emanuel Berg]

>> as a debian user, i am used to all packages AND the package
>> list being signed [i think].

Here are some 733 lines to read how they do it for Debian:

  
https://www.debian.org/doc/manuals/securing-debian-manual/deb-pack-sign.en.html

>> what are the attack vectors?

Malicious code inserted into the software supply chain *ka-boom*

> If you get no answers here... since Melpa is not part of
> Emacs, maybe you have more luck if you ask the Melpa people?

You mean they don't read here? :(

-- 
underground experts united
https://dataswamp.org/~incal