Toward Trust in Emacs

Up through version 30, Emacs did not distinguish between trusted and untrusted files, effectively trusting nearly all files, which could lead to code execution vulnerabilities like CVE-2024-53920.

To address this, Emacs 30 introduced the concept of explicit trust and changed the default to all files untrusted. However, this approach is too conservative, causing significant inconvenience during use, which ultimately leads users to simply turn off the trust mechanism altogether.

To solve this, the trust-manager package is proposed.

• It only asks about trust when a project's files are opened for the first time, and remembers the choice afterward.
• If trust is granted, the corresponding project directory is saved as trusted.
• The init file, early init file, custom file, and directories in load-path are automatically treated as trusted.
• Untrusted Emacs Lisp buffers show a red ? in the mode line; clicking it immediately grants trust and re-enables disabled features.
• Saved choices remain in trust-manager-trust-alist, and can be directly modified with trust-manager-customize, trust-manager-set-project-trust, or trust-manager-set-file-trust.
• It integrates with project-forget-project, so when a project is forgotten, its related trust entries are automatically removed.

The core idea is to maintain security while sparing users from having to adjust settings every time. With trust-manager-mode enabled, Emacs 30's trust system can be used in a much less intrusive way.