I build my Emacs distribution, including packages, using Nix[1], which means that input hashes of all the package sources are fully pinned. This process is exte

I build my Emacs distribution, including packages, using Nix[1], which means that input hashes of all the package sources are fully pinned. This process is external to Emacs though. The Emacs internal managers all go towards the same HTTP(S) sources and I haven't seen one that pins input hashes or uses signatures, with the exception of pinning git commit hashes when using git as a package source in straight.el[2]. [1]: https://github.com/tazjin/nixos-config/blob/master/emacs.nix https://github.com/tazjin/nixos-config/blob/master/emacs.nix [2]: https://github.com/raxod502/straight.el#advantages-of-straightel-2 https://github.com/raxod502/straight.el#advantages-of-straig...