Subject: Re: bug#75017: 31.0.50; Untrusted user lisp files

From: Stefan Kangas <[email-masked]>
Date: Tue, 24 Dec 2024 23:58:20 +0000

Stefan Monnier via "Bug reports for GNU Emacs, the Swiss army knife of
text editors" <[email-masked]> writes:

>> Maybe we should trust the early-init-file as well, but then where does
>> this end?  The init files can load gobs of other files.  And there's
>> also custom-file (when it isn't nil), desktop-dirname and
>> desktop-base-file-name, etc. etc.
>> Stefan, WDYT about this?
>
> For Emacs-30, I see no need to make changes to what we have in this
> regard for the simple reason that `elisp-flymake-byte-compile` usually
> doesn't give great feedback in init files or in most of those other
> funny loaded files like desktop's (both false positives and false
> negatives).  So there's no hurry in deciding whether to include
> `early-init-file`, or `custom-file`, or `desktop-dirname`, or ...
>
> More useful might be to auto-trust the packages's ELisp files
> found in `load-path` (because these are files for which that backend
> should usually give good quality feedback). But that's a bigger change
> and it's not completely clear which files we should trust there, so
> I don't think we're ready to add that in `emacs-30`.

I agree that what we have is fine for Emacs 30.