On Fri 2018-02-09 06:28:04 +0000, Adam Plaice wrote:
> Thanks very much for the reply.  I fully agree that the verifying of
> git tags by MELPA would be valuable (and rather important from a
> security perspective), and will bring it up.

Thanks for doing that!  If you need any backup in the discussion, or if
you think that your suggestion is not being taken as seriously as is
warranted, i'd be happy to try to help explain the issues to the MELPA
folks -- contact me directly offlist if you want to coordinate on this.

> BTW, is the GitHub mirror https://github.com/notmuch/notmuch/
> mentioned in README.rst, semi-official in the sense of being likely to
> be up to date?  If, yes, it could be used as a stopgap intermediary
> "source" for MELPA, until https transport is possible with the main
> notmuch repository or MELPA supports verifying signed git tags.

I think if you use the github mirror, you might just be pushing off
cleartext fetching to someone else, since that mirror appears to be
synced over http itself :/  I don't actually know who maintains that
mirror, and i don't know how to update where it syncs from...

However, Carl Worth (in Cc) just mentioned on IRC that he set up https
for the official notmuch repo!  So please use this URL:

   https://git.notmuchmail.org/git/notmuch

Thanks Carl! :)

All the best,

    --dkg