Auto-trusting my own stuff in Emacs 31

Published on
Tags: emacs, programming, dotfiles

I upgraded my Emacs to 31.1 almost a month ago, but it's only today that I notice the lack of Flymake/ShellCheck (normally automatic in the sh major mode).

The reason is a good one: Emacs stopped trusting every file by default, which means no more sh script linting for me! A bit of searching around got me this blog post about the subject, including a ergonomic package to handle the trusted-content path list.

But Emacs is all about DIY, so here's my extremely simple solution: trust stuff that's inside a git repository I own. A bit of monkeying around got me this:

(require 'vc-git)
(defvar trusted-git-repo-prefixes
  '("https://git.sr.ht/~q3cpma/"
    "git@git.sr.ht:~q3cpma/"))
(add-hook* 'find-file-hook
  (when (not (trusted-content-p))
    ;; Maybe use magit-toplevel if it is already available ?
    (when-let* ((git-root (vc-git-root (buffer-file-name)))
                (git-url  (vc-git-repository-url git-root)))
      (when (member-if (lambda (p) (string-prefix-p p git-url))
                       trusted-git-repo-prefixes)
        (cl-pushnew git-root trusted-content :test #'equal)))))

It just worked after the first try, would you believe that? Of course, it's still vulnerable to any tarball containing a spoofed .git/config, but that should be okay for now.