Ihor Radchenko <[email protected]> writes: >>>> If the code is downloaded as tarball, I strongly recommend to check it >>>> against a sha256 hash. See for instance: >>>> >>>> https://github.com/minad/doom-on-emacs/blob/9d5929335c4080699a2daa153ace2996c905008a/Makefile#L17 >>>> >>>> This way you would get similar guarantees. >>> >>> That would correspond to setting `package-check-signature' to t in the >>> patch. >> >> Do we trust git fetch? If I go ahead with a submodule approach do I have to >> worry about this? > > git should verify https certificates. > We may additionally verify commit signatures. Daniel signs his commits.
Actually git submodules should behave similarly to the above explicit checking of the hash. Submodules are pinned to a specific commit. Only difference is that sha1 is weaker than sha256. Daniel
