* How can I obtain Org via HTTPS?
@ 2017-12-04 6:46 Radon Rosborough
2017-12-06 11:55 ` Akater
2018-03-10 21:48 ` Bastien
0 siblings, 2 replies; 5+ messages in thread
From: Radon Rosborough @ 2017-12-04 6:46 UTC (permalink / raw)
To: Emacs-orgmode
Hello all,
It does not appear to be possible to obtain the Git repository for Org
via HTTPS or SSH, only via HTTP. I have checked the manual and
searched the Internet to see if there is a way, but no luck. I only
found an unanswered inquiry from earlier this year [1].
—Why is HTTPS/SSH necessary when Org releases are signed with GPG?
Well, only releases are signed. If you want to clone the development
version of Org, there appears to be no way to verify that it has not
been tampered with, since the clone was using an insecure protocol.
—Why do I care about this?
I maintain the package manager straight.el [2], which installs
packages by cloning their Git repositories. By default, the
development version of a package is installed. It would be
irresponsible to install packages via HTTP, so straight.el is forced
to install Org from the EmacsMirror [3] instead. This makes me
uncomfortable, since I would prefer to install packages from their
authoritative upstream sources—this makes contributing back to those
packages easier.
Have I missed something? Is it already possible to obtain Org
securely? If not, is making that possible a current goal of the
project? If not, what is the difficulty and can I help?
Best regards,
Radon Rosborough
[1]: http://lists.gnu.org/archive/html/emacs-orgmode/2017-03/msg00335.html
[2]: https://github.com/raxod502/straight.el
[3]: https://github.com/emacsmirror/org
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: How can I obtain Org via HTTPS?
2017-12-04 6:46 How can I obtain Org via HTTPS? Radon Rosborough
@ 2017-12-06 11:55 ` Akater
2018-03-10 21:48 ` Bastien
1 sibling, 0 replies; 5+ messages in thread
From: Akater @ 2017-12-06 11:55 UTC (permalink / raw)
To: Emacs-orgmode
[-- Attachment #1: Type: text/plain, Size: 462 bytes --]
On a related note, I'd love to use org-plus-contrib packages but there's
no https update, and I still don't understand how to check whether
packages are signed, w/ which keys, where the keys are published.
Maybe I didn't do everything I could but all the other updates on my
system have been far more transparent in that regard---even if unsigned,
I'm at least aware of this, and if signed, I know which key they are
signed with, and the key is in the keyring.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 800 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: How can I obtain Org via HTTPS?
2017-12-04 6:46 How can I obtain Org via HTTPS? Radon Rosborough
2017-12-06 11:55 ` Akater
@ 2018-03-10 21:48 ` Bastien
2018-03-10 23:15 ` Radon Rosborough
1 sibling, 1 reply; 5+ messages in thread
From: Bastien @ 2018-03-10 21:48 UTC (permalink / raw)
To: Radon Rosborough; +Cc: Emacs-orgmode
Hi Radon,
Radon Rosborough <radon.neon@gmail.com> writes:
> It does not appear to be possible to obtain the Git repository for Org
> via HTTPS
FWIW it is now and since a few weeks: see https://orgmode.org
--
Bastien
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2018-03-11 0:12 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-12-04 6:46 How can I obtain Org via HTTPS? Radon Rosborough
2017-12-06 11:55 ` Akater
2018-03-10 21:48 ` Bastien
2018-03-10 23:15 ` Radon Rosborough
2018-03-11 0:12 ` Bastien Guerry
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).