Re: GnuPG homedir and package.el?

[Jens Lechtenboerger]

On 2017-04-01, at 17:22, Eli Zaretskii wrote:

> They should be mentioned in NEWS, definitely.
>
> As for the manual (I guess you meant the user manual), it depends on
> whether you think the added option is important for users to know
> about.  (Btw, your ':version' rag is incorrect, it should be "26.1".)

The attached patch contains the above changes.

Best wishes
Jens

>From e7997d0e3bac084bbc1097ec7a3186146f77127d Mon Sep 17 00:00:00 2001
From: Jens Lechtenboerger <address@hidden>
Date: Sat, 1 Apr 2017 17:57:54 +0200
Subject: [PATCH] Introduce customizable variable package-gnupghome-dir

* lisp/emacs-lisp/package.el (package-import-keyring,
  package--check-signature-content, package-check-signature):
  Use new variable package-gnupghome-dir to control which GnuPG homedir
  to use.
* doc/emacs/package.texi: Mention this.
* etc/NEWS: Mention this.
---
 doc/emacs/package.texi     |  5 +++--
 etc/NEWS                   |  7 +++++++
 lisp/emacs-lisp/package.el | 28 +++++++++++++++++++---------
 3 files changed, 29 insertions(+), 11 deletions(-)

diff --git a/doc/emacs/package.texi b/doc/emacs/package.texi
index d6f88aa..de8f4d2 100644
--- a/doc/emacs/package.texi
+++ b/doc/emacs/package.texi
@@ -200,8 +200,9 @@ Package Installation
 on how you can obtain their public key.  One way is to download the
 key from a server such as @url{http://pgp.mit.edu/}.
 Use @kbd{M-x package-import-keyring} to import the key into Emacs.
-Emacs stores package keys in the @file{gnupg} subdirectory
-of @code{package-user-dir}.
+Emacs stores package keys in the directory specified by the variable
address@hidden, by default in the @file{gnupg}
+subdirectory of @code{package-user-dir}.
 The public key for the GNU package archive is distributed with Emacs,
 in the @file{etc/package-keyring.gpg}.  Emacs uses it automatically.
 
diff --git a/etc/NEWS b/etc/NEWS
index bfd7d2b..2bc3e18 100644
--- a/etc/NEWS
+++ b/etc/NEWS
@@ -629,6 +629,13 @@ In 'visual-line-mode' it will look for the true beginning 
of a header
 while in non-'visual-line-mode' it will move the point to the indented
 header's value.
 
+** Package
+
++++
+*** The new variable 'package-gnupghome-dir' has been added to control
+where the GnuPG home directory (used for signature verification) is
+located.
+
 ** Tramp
 
 +++
diff --git a/lisp/emacs-lisp/package.el b/lisp/emacs-lisp/package.el
index 8d5fac9..12635b3 100644
--- a/lisp/emacs-lisp/package.el
+++ b/lisp/emacs-lisp/package.el
@@ -305,6 +305,16 @@ package-directory-list
 (declare-function epg-find-configuration "epg-config"
                   (protocol &optional no-cache program-alist))
 
+(defcustom package-gnupghome-dir (expand-file-name "gnupg" package-user-dir)
+  "Directory containing GnuPG keyring or nil.
+This variable specifies the GnuPG home directory used by package.
+That directory is passed via the option \"--homedir\" to GnuPG.
+If nil, do not use the option \"--homedir\", but stick with GnuPG's
+default directory."
+  :type 'directory
+  :risky t
+  :version "26.1")
+
 (defcustom package-check-signature
   (if (and (require 'epg-config)
            (epg-find-configuration 'OpenPGP))
@@ -1207,9 +1217,9 @@ package--check-signature-content
   "Check signature CONTENT against STRING.
 SIG-FILE is the name of the signature file, used when signaling
 errors."
-  (let* ((context (epg-make-context 'OpenPGP))
-         (homedir (expand-file-name "gnupg" package-user-dir)))
-    (setf (epg-context-home-directory context) homedir)
+  (let ((context (epg-make-context 'OpenPGP)))
+    (when package-gnupghome-dir
+      (setf (epg-context-home-directory context) package-gnupghome-dir))
     (condition-case error
         (epg-verify-string context content string)
       (error (package--display-verify-error context sig-file)
@@ -1236,7 +1246,7 @@ package--check-signature
   "Check signature of the current buffer.
 Download the signature file from LOCATION by appending \".sig\"
 to FILE.
-GnuPG keyring is located under \"gnupg\" in `package-user-dir'.
+GnuPG keyring location depends on `package-gnupghome-dir'.
 STRING is the string to verify, it defaults to `buffer-string'.
 If ASYNC is non-nil, the download of the signature file is
 done asynchronously.
@@ -1476,11 +1486,11 @@ package-import-keyring
   "Import keys from FILE."
   (interactive "fFile: ")
   (setq file (expand-file-name file))
-  (let ((context (epg-make-context 'OpenPGP))
-        (homedir (expand-file-name "gnupg" package-user-dir)))
-    (with-file-modes 448
-      (make-directory homedir t))
-    (setf (epg-context-home-directory context) homedir)
+  (let ((context (epg-make-context 'OpenPGP)))
+    (when package-gnupghome-dir
+      (with-file-modes 448
+        (make-directory package-gnupghome-dir t))
+      (setf (epg-context-home-directory context) package-gnupghome-dir))
     (message "Importing %s..." (file-name-nondirectory file))
     (epg-import-keys-from-file context file)
     (message "Importing %s...done" (file-name-nondirectory file))))
-- 
2.7.4