GnuPG homedir and package.el?

[Jens Lechtenboerger <jens.lechtenboerger@fsfe.org>]

[-- Attachment #1: Type: text/plain, Size: 359 bytes --]

Hi there,

is there a reason that package.el sets up its own GnuPG homedir (in
package-import-keyring and package--check-signature-content)?

That choice does not work with Qubes OS and Split GPG [0].

Attached is a patch introducing a new user option to use the
default GnuPG home.

Best wishes
Jens

[0] https://github.com/QubesOS/qubes-issues/issues/2660


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: package.diff --]
[-- Type: text/x-diff, Size: 2467 bytes --]

commit 28105308487b231e57770c1af0c5989ba6d6b66c
Author: Jens Lechtenboerger <jens.lechtenboerger@fsfe.org>
Date:   Sat Mar 4 17:17:52 2017 +0100

    Introduce customizable variable package-use-separate-gnupghome
    
    * lisp/emacs-lisp/package.el (package-import-keyring)
      (package--check-signature-content): Use new variable
      package-use-separate-gnupghome to decide whether to use separate
      GnuPG homedir or default one.

diff --git a/lisp/emacs-lisp/package.el b/lisp/emacs-lisp/package.el
index 8d5fac9..f212028 100644
--- a/lisp/emacs-lisp/package.el
+++ b/lisp/emacs-lisp/package.el
@@ -305,6 +305,17 @@ package-directory-list
 (declare-function epg-find-configuration "epg-config"
                   (protocol &optional no-cache program-alist))
 
+(defcustom package-use-separate-gnupghome t
+  "Whether to use default GnuPG homedir or create a separate one.
+If t (the default), package creates a separate directory to store
+ELPA signing keys.  That directory is then used as GnuPG homedir
+when verifying signatures on packages.
+If you want to keep all public keys in one place, including the
+ELPA signing key, set to nil."
+  :type 'boolean
+  :risky t
+  :version "26.0.50.2")
+
 (defcustom package-check-signature
   (if (and (require 'epg-config)
            (epg-find-configuration 'OpenPGP))
@@ -1209,7 +1220,8 @@ package--check-signature-content
 errors."
   (let* ((context (epg-make-context 'OpenPGP))
          (homedir (expand-file-name "gnupg" package-user-dir)))
-    (setf (epg-context-home-directory context) homedir)
+    (when package-use-separate-gnupghome
+      (setf (epg-context-home-directory context) homedir))
     (condition-case error
         (epg-verify-string context content string)
       (error (package--display-verify-error context sig-file)
@@ -1478,9 +1490,10 @@ package-import-keyring
   (setq file (expand-file-name file))
   (let ((context (epg-make-context 'OpenPGP))
         (homedir (expand-file-name "gnupg" package-user-dir)))
-    (with-file-modes 448
-      (make-directory homedir t))
-    (setf (epg-context-home-directory context) homedir)
+    (when package-use-separate-gnupghome
+      (with-file-modes 448
+        (make-directory homedir t))
+      (setf (epg-context-home-directory context) homedir))
     (message "Importing %s..." (file-name-nondirectory file))
     (epg-import-keys-from-file context file)
     (message "Importing %s...done" (file-name-nondirectory file))))