How can I obtain Org via HTTPS?

How can I obtain Org via HTTPS?

[Radon Rosborough]

Hello all,

It does not appear to be possible to obtain the Git repository for Org
via HTTPS or SSH, only via HTTP. I have checked the manual and
searched the Internet to see if there is a way, but no luck. I only
found an unanswered inquiry from earlier this year [1].

—Why is HTTPS/SSH necessary when Org releases are signed with GPG?
Well, only releases are signed. If you want to clone the development
version of Org, there appears to be no way to verify that it has not
been tampered with, since the clone was using an insecure protocol.

—Why do I care about this?
I maintain the package manager straight.el [2], which installs
packages by cloning their Git repositories. By default, the
development version of a package is installed. It would be
irresponsible to install packages via HTTP, so straight.el is forced
to install Org from the EmacsMirror [3] instead. This makes me
uncomfortable, since I would prefer to install packages from their
authoritative upstream sources—this makes contributing back to those
packages easier.

Have I missed something? Is it already possible to obtain Org
securely? If not, is making that possible a current goal of the
project? If not, what is the difficulty and can I help?

Best regards,
Radon Rosborough

[1]: http://lists.gnu.org/archive/html/emacs-orgmode/2017-03/msg00335.html
[2]: https://github.com/raxod502/straight.el
[3]: https://github.com/emacsmirror/org

Re: How can I obtain Org via HTTPS?

[Akater]

[-- Attachment #1: Type: text/plain, Size: 462 bytes --]


On a related note, I'd love to use org-plus-contrib packages but there's
no https update, and I still don't understand how to check whether
packages are signed, w/ which keys, where the keys are published.
Maybe I didn't do everything I could but all the other updates on my
system have been far more transparent in that regard---even if unsigned,
I'm at least aware of this, and if signed, I know which key they are
signed with, and the key is in the keyring.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 800 bytes --]

Re: How can I obtain Org via HTTPS?

[Bastien]

Hi Radon,

Radon Rosborough <radon.neon@gmail.com> writes:

> It does not appear to be possible to obtain the Git repository for Org
> via HTTPS

FWIW it is now and since a few weeks: see https://orgmode.org

-- 
 Bastien

Re: How can I obtain Org via HTTPS?

[Radon Rosborough]

> > It does not appear to be possible to obtain the Git repository for Org
> > via HTTPS
>
> FWIW it is now and since a few weeks: see https://orgmode.org

Yep, I noticed and added support for it in straight.el, see
https://github.com/raxod502/straight.el/commit/25a978830a78ecd73a89c355da47d3dc482aab64

Thanks!

Re: How can I obtain Org via HTTPS?

[Bastien Guerry]

Hi Radon,

Radon Rosborough <radon.neon@gmail.com> writes:

>> > It does not appear to be possible to obtain the Git repository for Org
>> > via HTTPS
>>
>> FWIW it is now and since a few weeks: see https://orgmode.org
>
> Yep, I noticed and added support for it in straight.el, see
> https://github.com/raxod502/straight.el/commit/25a978830a78ecd73a89c355da47d3dc482aab64

Great, thanks!

-- 
 Bastien