GNU ELPA security and Org-mode

[Stefan Monnier]

I just realized that the GPG-signing we're doing in GNU ELPA is
weaker for the org-mode packages than for all other:

All GNU ELPA packages, except for org-mode, are generated by
elpa.gnu.org from an elpa.git checkout (via https, not sure if Git
checks the key), whereas the org-mode package is downloaded from
http://orgmode.org/elpa.

So the org-mode package has weaker points:
- uses http rather than https.
- downloaded from a machine that's further (well, not absolutely sure,
but I assume that elpa.gnu.org and git.sv.gnu.org are near each other).

Maybe we should consider some way to take the org packages from
http://orgmode.org/elpa, and push them to elpa.git. This way even if
this transfer from orgmode.org to elpa.git suffers from the same risks,
the resulting patch would be sent to elpa-diffs, so it would be exposed
for review (how much review it would really get is clearly debatable,
tho).


Stefan

[Bastien]

Hi Stefan,

Post by Stefan Monnier
- uses http rather than https.

Just to mention that org is now available through https too:

~$ git clone https://code.orgmode.org/bzg/org-mode.git

Not sure if something remains to be done in this thread, but
if I can help let me know.

Best,

[Stefan Monnier]

Post by Bastien

Post by Stefan Monnier
- uses http rather than https.

~$ git clone https://code.orgmode.org/bzg/org-mode.git

We don't use the Git (currently), but yes, thanks for making an https
version available.

Post by Bastien
Not sure if something remains to be done in this thread, but
if I can help let me know.

Well, if the "list of tarballs" (at https://orgmode.org/elpa) could be
kept in a Git branch instead, that would be great.


Stefan

[Bastien]

Hi Stefan,

Post by Stefan Monnier
Well, if the "list of tarballs" (at https://orgmode.org/elpa) could be
kept in a Git branch instead, that would be great.

Not sure what you mean exactly by keeping the list of tarballs in a
Git branch. In which Git repository?

[Stefan Monnier]

Post by Bastien

Post by Stefan Monnier
Well, if the "list of tarballs" (at https://orgmode.org/elpa) could be
kept in a Git branch instead, that would be great.

Not sure what you mean exactly by keeping the list of tarballs in a
Git branch.

Just that instead of having a bunch of tarballs in a directory (where
each tarball corresponds to a particular tree of files), I'd much rather
have a Git branch (where each revision holds a corresponding tree of
files).

Post by Bastien
In which Git repository?

Doesn't matter which (tho, ideally, it should be elpa.git, and the
branch should be named "externals/org").


Stefan

[Bastien]

Hi Stefan,

Post by Stefan Monnier
Doesn't matter which (tho, ideally, it should be elpa.git, and the
branch should be named "externals/org").

To summarise:

- I create a branch on elpa.git called "externals/org".

- I create the "elpa/packages/org" directory in this branch.

- I copy the content of an Org ELPA archive (eg org-20180430.tar)
into this directory, with org-{version|pkg|loaddefs}.el files.

- I commit and publish this "externals/org" branch on the public
elpa.git repository.

Is that so?

[Stefan Monnier]

Post by Bastien
- I create a branch on elpa.git called "externals/org".

Right.

Post by Bastien
- I create the "elpa/packages/org" directory in this branch.

No. It should contain the same files with the same names as the
tarball would.

Post by Bastien
- I copy the content of an Org ELPA archive (eg org-20180430.tar)
into this directory, with org-{version|pkg|loaddefs}.el files.

Yes, except for org-pkg.el (the corresponding info should be in org.el
instead).

Post by Bastien
- I commit and publish this "externals/org" branch on the public
elpa.git repository.
Is that so?

Yup,


Stefan

[Stefan Monnier]

Post by Stefan Monnier

Post by Bastien
- I create a branch on elpa.git called "externals/org".

Right.

To clarify, this is not a branch of the `master` branch of elpa.git.
It's rather a brand new empty branch (or maybe a branch taken from
org.git/master).


Stefan

[Bastien]

Thanks for the feedback.

Post by Stefan Monnier

Post by Bastien
- I create the "elpa/packages/org" directory in this branch.

No. It should contain the same files with the same names as the
tarball would.

Not sure here.

Do you mean elpa.git should contain

elpa/packages/org-20180430/org.el
elpa/packages/org-20180430/org-table.el

etc.?

Post by Stefan Monnier

Post by Bastien
- I copy the content of an Org ELPA archive (eg org-20180430.tar)
into this directory, with org-{version|pkg|loaddefs}.el files.

Yes, except for org-pkg.el (the corresponding info should be in org.el
instead).

Because org-pkg.el is generated by elpa/GNUmakefile, right?

If so, why adding org-loaddefs.el since org-autoloads.el would also be
autogenerated?

And would org-version.el still be required?

Or the package version would just be extracted from the org.el
"Version: 9.1.12" keyword?

If possible, I'd like to not add org-loaddefs.el and org-version.el
and have org-autoloads.el and the package version autogenerated like
for any other package.

[Stefan Monnier]

Post by Bastien

Post by Stefan Monnier

Post by Bastien
- I create the "elpa/packages/org" directory in this branch.

No. It should contain the same files with the same names as the
tarball would.

Not sure here.
Do you mean elpa.git should contain
elpa/packages/org-20180430/org.el
elpa/packages/org-20180430/org-table.el

No:

% cd .../elpa; git checkout externals/org; ls

should show something like

org.el
org-agenda.el
...


-- Stefan

[Bastien]

Post by Stefan Monnier

Post by Bastien

Post by Stefan Monnier

Post by Bastien
- I create the "elpa/packages/org" directory in this branch.

No. It should contain the same files with the same names as the
tarball would.

Not sure here.
Do you mean elpa.git should contain
elpa/packages/org-20180430/org.el
elpa/packages/org-20180430/org-table.el

% cd .../elpa; git checkout externals/org; ls
should show something like
org.el
org-agenda.el
...

Okay, thanks, will do this.

BTW, https://elpa.gnu.org seems down ATM.

[Stefan Monnier]

Post by Bastien
BTW, https://elpa.gnu.org seems down ATM.

You got unlucky: I was just performing a minor "aptitude upgrade" on it.


Stefan

[Bastien]

Post by Stefan Monnier

Post by Bastien
BTW, https://elpa.gnu.org seems down ATM.

You got unlucky: I was just performing a minor "aptitude upgrade" on it.

No problem, it's working fine now, thanks.

[Bastien]

Post by Bastien
If so, why adding org-loaddefs.el since org-autoloads.el would also be
autogenerated?
And would org-version.el still be required?

Just for this: shall I add org-version.el and org-loaddefs.el?

[Stefan Monnier]

Post by Bastien
If so, why adding org-loaddefs.el since org-autoloads.el would also be
autogenerated?
And would org-version.el still be required?

I don't really know precisely what those files are about, but to the
extent that they're specific to Org, I don't see any reason to treat
them differently from any other org*.el file here.

AFAIK org-loaddefs.el is supposed to only be loaded when org-mode is
activated, whereas org-autoloads.el is loaded at Emacs start up (so it
should mostly contain an autoload for `org-mode` itself).

The elpa.gnu.org scripts will not look for the package's version in
org-version.el but in org.el's "Version:" header, but presumably
org-version.el is used by Org, so it's probably still useful (tho Org
could be changed to look for the corresponding info in org.el's
"Version:" header as well).


Stefan

[Bastien]

Post by Stefan Monnier

Post by Bastien
If so, why adding org-loaddefs.el since org-autoloads.el would also be
autogenerated?
And would org-version.el still be required?

I don't really know precisely what those files are about, but to the
extent that they're specific to Org, I don't see any reason to treat
them differently from any other org*.el file here.

Okay.

Post by Stefan Monnier
AFAIK org-loaddefs.el is supposed to only be loaded when org-mode is
activated, whereas org-autoloads.el is loaded at Emacs start up (so it
should mostly contain an autoload for `org-mode` itself).

Got it, thanks.

Post by Stefan Monnier
The elpa.gnu.org scripts will not look for the package's version in
org-version.el but in org.el's "Version:" header, but presumably
org-version.el is used by Org, so it's probably still useful (tho Org
could be changed to look for the corresponding info in org.el's
"Version:" header as well).

Yes, that's another topic.

Do you have an example of a package where M-x [package]-version RET
looks for the version in the Version: header?

[Stefan Monnier]

Post by Bastien
Do you have an example of a package where M-x [package]-version RET
looks for the version in the Version: header?

I did that in bbdb, yes (in elpa.git).


Stefan

[Bastien]

Post by Stefan Monnier

Post by Bastien
Do you have an example of a package where M-x [package]-version RET
looks for the version in the Version: header?

I did that in bbdb, yes (in elpa.git).

Thanks,