The Delpa Project

The Delpa project manages and hosts historical Melpa repository snapshots. A new snapshot is created roughly twice per month. You can use a pinned version here instead of directly installing from Melpa, which usually tracks latest commits from upstream.

Why Using a Snapshot?​

This is useful for two reasons, among other things.

Less Breakage​

Melpa usually tracks the latest commits from upstream, which often causes breakage. Using a snapshot offers some stability.

Less Prone to Supply Chain Attack​

Configuration frameworks such as Spacemacs and Doom Emacs commonly pull hundreds of packages from Melpa, depending on the configuration. This poses a significant supply chain security hazard: We become a victim if any of these hundreds of packages become malicious. This can happen for many reasons, such as when a maintainer's account is hacked, or a maintainer becomes malicious (example).

Thankfully, Melpa packages are open source: Most malicious behaviors can be found and corrected within a few days, if not hours. By using a snapshot that has been tested for some days, such as one week or more, we can significantly reduce the chance of becoming a victim of such a attack.

Usage​

To use a particular snapshot version, pick a version in the Available Snapshot Versions subsection below and add the following to your Emacs initialization file:

(add-to-list 'package-archives
             '("delpa" . "https://packages.delpa.org/melpa/snapshot/{your version}/") t)

Alternatively, add the following to your Emacs initialization file to use the most recent snapshot version that is at least N days old, where 1≤N≤270:

(add-to-list 'package-archives
             ;; Replace {N} with a number between 1 and 270
             '("delpa" . "https://packages.delpa.org/melpa/at-least-days-old/{N}/") t)

https://packages.delpa.org hosts the Delpa Redirection Server (source code), which redirects connections to where the snapshot files are stored. By connecting to https://packages.delpa.org, you acknowledge that you agree to the terms near the end of this page.

Available Snapshot Versions

Bug Report and Feature Request​

To report a bug or request a feature about the Delpa project in general, please open a ticket at the Delpa meta issue tracker.

Ask a Question or Show Off a Trick​

Please talk about them in the Forum.

Contribution​

Please follow the official GitHub guide to create a pull request for any relevant repositories in the delpa-org organization.

License and Terms

By connecting to https://packages.delpa.org, you acknowledge that you agree to the following terms:

Delpa Redirection Server is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

Delpa Redirection Server is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License along with this program. If not, see <https://www.gnu.org/licenses/\>.