Re: How to make Emacs more secure?

>> We have had `package-vc-checkout' for a while now, which check out the
>> source code behind a package in a directory of your choice.
> While useful (and something I was unaware of until now :-)),
> this is not quite the same as "these are the exact files
> that will be installed when you press 'Install'".

Right.  "Install" usually means: download + untar + generate autoloads +
activate + compile.  It would be nice feature to be able to untar "out
of place", then let the user browse the result and once done trigger th
actual install (which would move/copy the untarred tree + generate
autoloads + activate + compile).

To a large extent, this sounds like a special case of the new
package-review feature, where the "diff" is against an empty
previous tree.


=== Stefan