Re: ELPA security

[Daiki Ueno]

Ted Zlatanov <address@hidden> writes:

> TZ> Using EPG functions, however, I could not figure out how to verify with
> TZ> an external public GPG key.  I don't see that option with any of the
> TZ> context functions.  Perhaps someone knows?  Without that option, the
> TZ> user has to explicitly load the maintainer's public GPG key, which is
> TZ> very impractical around package.el.

I guess you probably mean something like debian-keyring by "external
public GPG key", right?  If so, you can use an alternative ~/.gnupg
directory (e.g. ~/.emacs.d/elpa/gnupg/) set through
epg-gpg-home-directory, and import the keyring with
epg-import-keys-from-file on M-x package-list-packages, etc.

I'm not following the discussion nor the code, sorry if I'm missing the
point.

Regards,
-- 
Daiki Ueno