Some documentation for signing of packages

* doc/emacs/package.texi (Package Menu, Package Installation):
Mention signed packages.

* doc/lispref/package.texi (Package Archives): Mention signing packages.

* lisp/emacs-lisp/package.el (package-check-signature)
(package-unsigned-archives): Doc fixes.

* etc/NEWS: Related edits.

2 files changed, 39 insertions, 0 deletions

diff --git a/doc/lispref/ChangeLog b/doc/lispref/ChangeLog
index e4f5c60c2d1..51f74f2eb12 100644
--- a/doc/lispref/ChangeLog
+++ b/doc/lispref/ChangeLog
@@ -1,3 +1,7 @@
+2014-06-05  Glenn Morris  <rgm@gnu.org>
+
+        * package.texi (Package Archives): Mention signing packages.
+
 2014-05-27  Glenn Morris  <rgm@gnu.org>
 
         * text.texi (Buffer Contents):
diff --git a/doc/lispref/package.texi b/doc/lispref/package.texi
index 4bc50b2358f..cac7519671a 100644
--- a/doc/lispref/package.texi
+++ b/doc/lispref/package.texi
@@ -342,3 +342,38 @@ otherwise, an error is raised.
 @noindent
 After you create an archive, remember that it is not accessible in the
 Package Menu interface unless it is in @code{package-archives}.
+
+@cindex package archive security
+@cindex package signing
+Maintaining a public package archive entails a degree of responsibility.
+When Emacs users install packages from your archive, those packages
+can cause Emacs to run arbitrary code with the permissions of the
+installing user.  (This is true for Emacs code in general, not just
+for packages.)  So you should ensure that your archive is
+well-maintained and keep the hosting system secure.
+
+  One way to increase the security of your packages is to @dfn{sign}
+them using a crytopgraphic key.  If you have generated a
+private/public gpg key pair, you can use gpg to sign the package like
+this:
+
+@c FIXME EasyPG / package-x way to do this.
+@example
+gpg -ba -o @var{file}.sig @var{file}
+@end example
+
+@noindent
+For a single-file package, @var{file} is the package Lisp file;
+for a multi-file package, it is the package tar file.
+You can also sign the archive's contents file in the same way.
+Make the @file{.sig} files available in the same location as the packages.
+You should also make your public key available for people to download;
+e.g., by uploading it to a key server such as @url{http://pgp.mit.edu/}.
+When people install packages from your archive, they can use
+your public key to verify the signatures.
+
+A full explanation of these matters is outside the scope of this
+manual.  For more information on crytopgraphic keys and signing,
+@pxref{Top,, GnuPG, gnupg, The GNU Privacy Guard Manual}.  Emacs comes
+with an interface to GNU Privacy Guard, @pxref{Top,, EasyPG, epa,
+Emacs EasyPG Assistant Manual}.