[OS X Emacs] Verifying Aquamacs

[Win Treese]

> On Apr 24, 2020, at 4:15 PM, John Wroclawski <jtw at csail.mit.edu> wrote:
> 
> Hi David,
> 
>> On Apr 24, 2020, at 4:00 PM, David Reitter <david.reitter at gmail.com> wrote:
>> 
>> You forget that there are some 100,000 copies of Aquamacs sitting on people's computers.  You can't remotely update which certificates are trusted.
>> 
>> The simpler solution (going forward) is to change the update URL going forward to be something like update.aquamacs.org, and make the update check via HTTP. 
> 
> FWIW, this is a little confusing because I’m not sure why it would be any easier to remotely change the URL being checked for update than it would be to remotely update the certificate being trusted. If the update mechanism isn’t working, _any_ client-side change to fix it would seem to need a manual download to get started.
> 
> (But, having said that, I do agree that the simplest short-term thing to do is almost surely to change the website so that the (current) update URL is loaded via HTTP..)
> 
> (But, having said _that_, I do also recognize that many people would prefer to see it be HTTPS in the end notwithstanding the code-signing, so maybe sometime there'll be motivation to wire the whole thing into macOS certificate validation so it’ll all “just work” going forward..)

Hi, John. The version check seems to have at least two possible problems. The first one is that the check doesn’t work over TLS in any case, because there was an HTTP redirect along the way, and the code doesn’t accept a redirected response. 

The second is the certificate check. The check works fine on my system, so it’s probably dependent on the combination of Aquamacs version and Mac OS version.

 - Win