Re: install-elisp.el --- Simple Emacs Lisp installer using curl

[Ted Zlatanov]

On Thu, 26 Jul 2007 04:45:56 +0900 (JST) address@hidden wrote: 

r> From: Ted Zlatanov <address@hidden>
r> Subject: Re: install-elisp.el --- Simple Emacs Lisp installer using curl
r> Date: Wed, 25 Jul 2007 14:16:48 -0400

>> I'm attaching a simple patch to customize the retrieval program.  Please
>> consider using defcustom instead of defvar, though (I used defvar to be
>> consistent).

r> Thank you. Updated.

r> http://www.emacswiki.org/cgi-bin/wiki/download/install-elisp.el

> (defcustom install-elisp-use-url-retrieve (fboundp 
> 'url-retrieve-synchronously)
>   "If nil, use curl instead.")

> ...

> (defcustom install-elisp-retrieval-program "curl --silent '%s'"
>   "URL retrieving program used when `install-elisp-use-url-retrieve' is nil.
> If you use wget, set it to \"wget -q -O- '%s'\".")

You can unite these two into a single defcustom that lets you choose
between predefined strings (curl and wget), a symbol ('url-retrieve) and
a user-defined string.  Usually this kind of variable is called a
method, e.g.

(defcustom install-elisp-retrieval-method ...)

And then in your code you say

(if (equal install-elisp-retrieval-method 'url-retrieve)
...
(if (stringp install-elisp-retrieval-method)
...

I hope this helps.

>> Also consider security implications of downloading code from a wiki.
>> Maybe there could be a way for authors to publish PGP keys outside or
>> inside the wiki, and those keys can authenticate the code on the wiki?

r> I have already implemented confirmation for security reason.

> (defcustom install-elisp-confirm-flag t
>   "If non-nil, do install confirmation.
> You should set it non-nil for security reason.")

I don't think this is sufficient.  Users will just answer yes.  If
you're interested in working with the EmacsWiki administrators on
signing source code, you should contact them.  There are better ways of
doing this, is what I'm trying to say.

Ted