how accept all values for a specific var in safe-local-variable-values?

how accept all values for a specific var in safe-local-variable-values?

[Thomas Koch]

Hi,

I use the variable epa-file-encrypt-to as a file local variable with all 
possible permutations and subsets of my coworkers gpg keys. It's rather 
annoying to have all this different values as acceptable values in epa-file-
encrypt-to and to be queried each time a new key is added.

Is it possible to somehow tell emacs that it should accept values for epa-file-
encrypt-to in general, indifferent of the value?

(It is possible of course, but I also want it to be easy and elegant :-)

Would there be any security risk involved in accepting all values?

I must of course take care not by accident to encrypt the file to GPG keys that 
should not read it.

Regards, Thomas Koch

Re: how accept all values for a specific var in safe-local-variable-values?

[Tassilo Horn]

Thomas Koch <thomas@koch.ro> writes:

Hi Thomas,

> I use the variable epa-file-encrypt-to as a file local variable with all 
> possible permutations and subsets of my coworkers gpg keys. It's rather 
> annoying to have all this different values as acceptable values in epa-file-
> encrypt-to and to be queried each time a new key is added.
>
> Is it possible to somehow tell emacs that it should accept values for
> epa-file-encrypt-to in general, indifferent of the value?

You can setup a predicate that determines if a value is considered
safe.  See:

,----[ (info "(elisp)File Local Variables") ]
|    You can specify safe values for a variable with a
| ‘safe-local-variable’ property.  The property has to be a function of
| one argument; any value is safe if the function returns non-‘nil’ given
| that value.  Many commonly-encountered file variables have
| ‘safe-local-variable’ properties; these include ‘fill-column’,
| ‘fill-prefix’, and ‘indent-tabs-mode’.  For boolean-valued variables
| that are safe, use ‘booleanp’ as the property value.  Lambda expressions
| should be quoted so that ‘describe-variable’ can display the predicate.
`----

So you could say

  (put 'epa-file-encrypt-to 'safe-local-variable
       #'my-isa-subset-of-coworkers-gpg-keys)

or even

  (put 'epa-file-encrypt-to 'safe-local-variable
       #'(lambda (val) t))

to accept any value.

Hm, right now it already has this safe-local-variable predicate (in
epa-hooks.el):

--8<---------------cut here---------------start------------->8---
(put 'epa-file-encrypt-to 'safe-local-variable
     (lambda (val)
       (or (stringp val)
	   (and (listp val)
		(catch 'safe
		  (mapc (lambda (elt)
			  (unless (stringp elt)
			    (throw 'safe nil)))
			val)
		  t)))))
--8<---------------cut here---------------end--------------->8---

That says that values are considered safe if they are a string or a list
of strings.  Do you set it to something different than a string or list
of strings locally?  Or maybe you are using an emacs version that
doesn't have that property for `epa-file-encrypt-to' yet?

BTW, as the docs above suggest, that lambda should be quoted in order
for `describe-variable' to display the predicate.  I just did that on
the emacs trunk.

Bye,
Tassilo