Re: GnuPG homedir and package.el?

[Jens Lechtenboerger]

On 2017-03-14, at 15:37, Ted Zlatanov wrote:

> On Sat, 04 Mar 2017 17:41:54 +0100 Jens Lechtenboerger
> <address@hidden> wrote:
>
> JL> is there a reason that package.el sets up its own GnuPG homedir (in
> JL> package-import-keyring and package--check-signature-content)?
>
> Isolation? That way package management, where typically the user's
> personal setup doesn't matter, doesn't overlap with personal GnuPG usage.

Signature verification seems personal to me.

> JL> Attached is a patch introducing a new user option to use the
> JL> default GnuPG home.
>
> JL> +(defcustom package-use-separate-gnupghome t
>
> Maybe this could also be a specific directory the user chooses, so it
> could be a choice of nil, t, or 'string.

You are right.  I changed that to be a directory or nil.

Thanks
Jens

>From 4c76844e067ccf029c57189058d161831ca25ac7 Mon Sep 17 00:00:00 2001
From: Jens Lechtenboerger <address@hidden>
Date: Sat, 18 Mar 2017 12:17:02 +0100
Subject: [PATCH] Introduce customizable variable package-gnupghome-dir

* lisp/emacs-lisp/package.el (package-import-keyring,
  package--check-signature-content, package-check-signature):
  Use new variable package-gnupghome-dir to control which GnuPG homedir
  to use.
---
 lisp/emacs-lisp/package.el | 28 +++++++++++++++++++---------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/lisp/emacs-lisp/package.el b/lisp/emacs-lisp/package.el
index 8d5fac9..a809e39 100644
--- a/lisp/emacs-lisp/package.el
+++ b/lisp/emacs-lisp/package.el
@@ -305,6 +305,16 @@ package-directory-list
 (declare-function epg-find-configuration "epg-config"
                   (protocol &optional no-cache program-alist))
 
+(defcustom package-gnupghome-dir (expand-file-name "gnupg" package-user-dir)
+  "Directory containing GnuPG keyring or nil.
+This variable specifies the GnuPG home directory used by package.
+That directory is passed via the option \"--homedir\" to GnuPG.
+If nil, do not use the option \"--homedir\", but stick with GnuPG's
+default directory."
+  :type 'directory
+  :risky t
+  :version "26.0.50.2")
+
 (defcustom package-check-signature
   (if (and (require 'epg-config)
            (epg-find-configuration 'OpenPGP))
@@ -1207,9 +1217,9 @@ package--check-signature-content
   "Check signature CONTENT against STRING.
 SIG-FILE is the name of the signature file, used when signaling
 errors."
-  (let* ((context (epg-make-context 'OpenPGP))
-         (homedir (expand-file-name "gnupg" package-user-dir)))
-    (setf (epg-context-home-directory context) homedir)
+  (let ((context (epg-make-context 'OpenPGP)))
+    (when package-gnupghome-dir
+      (setf (epg-context-home-directory context) package-gnupghome-dir))
     (condition-case error
         (epg-verify-string context content string)
       (error (package--display-verify-error context sig-file)
@@ -1236,7 +1246,7 @@ package--check-signature
   "Check signature of the current buffer.
 Download the signature file from LOCATION by appending \".sig\"
 to FILE.
-GnuPG keyring is located under \"gnupg\" in `package-user-dir'.
+GnuPG keyring location depends on `package-gnupghome-dir'.
 STRING is the string to verify, it defaults to `buffer-string'.
 If ASYNC is non-nil, the download of the signature file is
 done asynchronously.
@@ -1476,11 +1486,11 @@ package-import-keyring
   "Import keys from FILE."
   (interactive "fFile: ")
   (setq file (expand-file-name file))
-  (let ((context (epg-make-context 'OpenPGP))
-        (homedir (expand-file-name "gnupg" package-user-dir)))
-    (with-file-modes 448
-      (make-directory homedir t))
-    (setf (epg-context-home-directory context) homedir)
+  (let ((context (epg-make-context 'OpenPGP)))
+    (when package-gnupghome-dir
+      (with-file-modes 448
+        (make-directory package-gnupghome-dir t))
+      (setf (epg-context-home-directory context) package-gnupghome-dir))
     (message "Importing %s..." (file-name-nondirectory file))
     (epg-import-keys-from-file context file)
     (message "Importing %s...done" (file-name-nondirectory file))))
-- 
2.7.4