Carlos ELPA

An Emacs Lisp package archive, served at https://elpa.cpradog.com/.

Every file in the archive is signed with the key described under Archive key.

Set up the archive

Add the archive to package-archives:

(require 'package)
(add-to-list 'package-archives
             '("cpradog" . "https://elpa.cpradog.com/")
             t)

Import the archive key. This is a one-time step:

(package-import-keyring
 (url-file-local-copy "https://elpa.cpradog.com/archive-key.asc"))

Download the package list:

M-x package-refresh-contents

Install a package

M-x package-install RET NAME RET

M-x list-packages lists everything the archive offers alongside your other archives.

Require a valid signature

By default Emacs installs a package whether or not it is signed. To refuse any package that does not carry a verified signature:

(setq package-check-signature t)

This applies to every entry in package-archives. If you also use an archive that publishes no signatures, add its URL to package-unsigned-archives to exempt it.

Archive key

The key is served from the same host as the packages. Check it against the fingerprint below before trusting the archive:

uid          Carlos Prado Garcia <carlos.prado@cpradog.com>
fingerprint  37BC 545D 584E 7C89 3835 21CE 53F8 2593 B0F6 8B93
signing key  A890CDA549A21E7B

Print the fingerprints of what you imported with:

(let ((ctx (epg-make-context 'OpenPGP)))
  (setf (epg-context-home-directory ctx) package-gnupghome-dir)
  (dolist (key (epg-list-keys ctx))
    (dolist (sub-key (epg-key-sub-key-list key))
      (message "%s %s"
               (epg-sub-key-capability sub-key)
               (epg-sub-key-fingerprint sub-key)))))