CVS commit: pkgsrc/editors

Modified files:

Index: pkgsrc/editors/emacs30/Makefile
diff -u pkgsrc/editors/emacs30/Makefile:1.16 pkgsrc/editors/emacs30/Makefile:1.17
--- pkgsrc/editors/emacs30/Makefile:1.16	Mon Aug  3 18:10:23 2026
+++ pkgsrc/editors/emacs30/Makefile	Tue Aug 25 17:44:23 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.16 2026/08/03 18:10:23 wiz Exp $
+# $NetBSD: Makefile,v 1.17 2026/08/25 17:44:23 wiz Exp $
 
 CONFLICTS+=	emacs30-nox11-[0-9]*
 
-PKGREVISION= 12
+PKGREVISION= 13
 .include "../../editors/emacs30/Makefile.common"
 
 .include "options.mk"

Index: pkgsrc/editors/emacs30/distinfo
diff -u pkgsrc/editors/emacs30/distinfo:1.3 pkgsrc/editors/emacs30/distinfo:1.4
--- pkgsrc/editors/emacs30/distinfo:1.3	Sun Dec 21 06:35:26 2025
+++ pkgsrc/editors/emacs30/distinfo	Tue Aug 25 17:44:23 2026
@@ -1,6 +1,12 @@
-$NetBSD: distinfo,v 1.3 2025/12/21 06:35:26 wiz Exp $
+$NetBSD: distinfo,v 1.4 2026/08/25 17:44:23 wiz Exp $
 
 BLAKE2s (emacs-30.2.tar.xz) = f88fd83bf4d3c4ef6c2240c50e23ca570c3219da9e9a463951aaf83ef9dc931f
 SHA512 (emacs-30.2.tar.xz) = 313432d11e95c74f8cd35c5b1da442e6223f5d40f9173c55883c0339ecbfb97a0bedf79177ef8902afd3e33c078a233777bed01f5caffa1e7524f17d58bfc9a2
 Size (emacs-30.2.tar.xz) = 55320324 bytes
+SHA1 (patch-doc_misc_tramp.texi) = 5ace7a462953478e1fcce0e3237ead16670d0b36
+SHA1 (patch-lisp_net_tramp-gvfs.el) = 92e0007d6d1b8c2359eb0de5f5d763fc683b0330
+SHA1 (patch-lisp_net_tramp-rclone.el) = ca52b50099cb06259be32e40045848164b96fca7
+SHA1 (patch-lisp_net_tramp-smb.el) = 4cbf31f75638a2ad97260d4c1c41fd3549848a8b
+SHA1 (patch-lisp_net_tramp.el) = 783c3303b40e9404a8ec3c01828b401ace217b0f
 SHA1 (patch-src_treesit.c) = fc3165a2febcb4dda2e87d031524fa5b90721c38
+SHA1 (patch-test_lisp_net_tramp-tests.el) = d37ffc57f21fda19121f7a0e3339cbd299e43d51

Index: pkgsrc/editors/emacs30-nox11/Makefile
diff -u pkgsrc/editors/emacs30-nox11/Makefile:1.2 pkgsrc/editors/emacs30-nox11/Makefile:1.3
--- pkgsrc/editors/emacs30-nox11/Makefile:1.2	Wed Dec 24 22:21:00 2025
+++ pkgsrc/editors/emacs30-nox11/Makefile	Tue Aug 25 17:44:23 2026
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.2 2025/12/24 22:21:00 wiz Exp $
+# $NetBSD: Makefile,v 1.3 2026/08/25 17:44:23 wiz Exp $
 
 PKGNAME=	${DISTNAME:S/emacs/emacs30/:S/-/-nox11-/}
+PKGREVISION=	1
 
 CONFLICTS+=	emacs30-[0-9]*
 

Added files:

Index: pkgsrc/editors/emacs30/patches/patch-doc_misc_tramp.texi
diff -u /dev/null pkgsrc/editors/emacs30/patches/patch-doc_misc_tramp.texi:1.1
--- /dev/null	Tue Aug 25 17:44:24 2026
+++ pkgsrc/editors/emacs30/patches/patch-doc_misc_tramp.texi	Tue Aug 25 17:44:23 2026
@@ -0,0 +1,18 @@
+$NetBSD: patch-doc_misc_tramp.texi,v 1.1 2026/08/25 17:44:23 wiz Exp $
+
+CVE-2026-79992: Fix local command execution vulnerability in tramp
+https://gitweb.gentoo.org/proj/emacs-patches.git/commit/emacs/30.2/05_all_tramp.patch?id=2a6292f81affedcc468c594c60808e652ae87118
+
+--- doc/misc/tramp.texi.orig	2025-04-05 11:01:10.000000000 +0000
++++ doc/misc/tramp.texi
+@@ -3601,7 +3601,9 @@ different name using the proper syntax will override t
+ By default, @value{tramp} will use the current local user name as the
+ remote user name for log in to the remote host.  Specifying a
+ different name using the proper syntax will override this default
+-behavior: @file{@trampfn{method,user@@host,path/to/file}}.
++behavior: @file{@trampfn{method,user@@host,path/to/file}}.  The user
++name can also be taken from an environment variable, like
++@file{@trampfn{method,@env{$MY_REMOTE_USER}@@host,path/to/file}}.
+ 
+ @file{@trampfn{ssh,daniel@@melancholia,.emacs}} is for file
+ @file{.emacs} in @samp{daniel}'s home directory on the host,
Index: pkgsrc/editors/emacs30/patches/patch-lisp_net_tramp-gvfs.el
diff -u /dev/null pkgsrc/editors/emacs30/patches/patch-lisp_net_tramp-gvfs.el:1.1
--- /dev/null	Tue Aug 25 17:44:24 2026
+++ pkgsrc/editors/emacs30/patches/patch-lisp_net_tramp-gvfs.el	Tue Aug 25 17:44:23 2026
@@ -0,0 +1,121 @@
+$NetBSD: patch-lisp_net_tramp-gvfs.el,v 1.1 2026/08/25 17:44:23 wiz Exp $
+
+CVE-2026-79992: Fix local command execution vulnerability in tramp
+https://gitweb.gentoo.org/proj/emacs-patches.git/commit/emacs/30.2/05_all_tramp.patch?id=2a6292f81affedcc468c594c60808e652ae87118
+
+--- lisp/net/tramp-gvfs.el.orig	2025-04-05 11:01:10.000000000 +0000
++++ lisp/net/tramp-gvfs.el
+@@ -1241,7 +1241,7 @@ file names."
+ 	  (when (string-match
+ 		 (rx bos "/" (+ (not "/")) (group "/.." (? "/"))) localname)
+ 	    (setq localname (replace-match "/" t t localname 1)))
+-	(when (string-match (rx bol "/.." (? "/")) localname)
++	(when (string-match (rx bos "/.." (? "/")) localname)
+ 	  (setq localname (replace-match "/" t t localname))))
+       ;; There might be a double slash.  Remove this.
+       (while (string-match "//" localname)
+@@ -1335,8 +1335,8 @@ If FILE-SYSTEM is non-nil, return file system attribut
+   (with-parsed-tramp-file-name filename nil
+     (setq localname (file-name-unquote localname))
+     (if (or (and (string-match-p
+-		  (rx bol (| "afp" (: "dav" (? "s")) "smb") eol) method)
+-		 (string-match-p (rx bol (? "/") (+ (not "/")) eol) localname))
++		  (rx bos (| "afp" (: "dav" (? "s")) "smb") eos) method)
++		 (string-match-p (rx bos (? "/") (+ (not "/")) eos) localname))
+ 	    (string-equal localname "/"))
+ 	(tramp-gvfs-get-root-attributes filename)
+       (assoc
+@@ -1773,14 +1773,14 @@ ID-FORMAT valid values are `string' and `integer'."
+   "Retrieve file name from D-Bus OBJECT-PATH."
+   (dbus-unescape-from-identifier
+    (replace-regexp-in-string
+-    (rx bol (* nonl) "/" (group (+ (not "/"))) eol) "\\1" object-path)))
++    (rx bos (* nonl) "/" (group (+ (not "/"))) eos) "\\1" object-path)))
+ 
+ (defun tramp-gvfs-url-host (url)
+   "Return the host name part of URL, a string.
+ We cannot use `url-host', because `url-generic-parse-url' returns
+ a downcased host name only."
+   (and (stringp url)
+-       (string-match (rx bol (+ alnum) "://" (group (+ (not (any "/:"))))) url)
++       (string-match (rx bos (+ alnum) "://" (group (+ (not (any "/:"))))) url)
+        (match-string 1 url)))
+ 
+ ;; This is used in GNU ELPA package tramp-locproc.el.
+@@ -1934,7 +1934,7 @@ Their full names are \"org.gtk.vfs.MountTracker.mounte
+ 		   (cadr (assoc "ssl" (cadr mount-spec)))))
+ 	     (uri (tramp-gvfs-dbus-byte-array-to-string
+ 		   (cadr (assoc "uri" (cadr mount-spec))))))
+-	(when (string-match (rx bol (group (| "afp" "smb"))) method)
++	(when (string-match (rx bos (group (| "afp" "smb"))) method)
+ 	  (setq method (match-string 1 method)))
+ 	(when (and (string-equal "dav" method) (string-equal "true" ssl))
+ 	  (setq method "davs"))
+@@ -2034,7 +2034,7 @@ Their full names are \"org.gtk.vfs.MountTracker.mounte
+ 		      (or
+ 		       (cadr (assoc "share" (cadr mount-spec)))
+ 		       (cadr (assoc "volume" (cadr mount-spec)))))))
+-	 (when (string-match (rx bol (group (| "afp" "smb"))) method)
++	 (when (string-match (rx bos (group (| "afp" "smb"))) method)
+ 	   (setq method (match-string 1 method)))
+ 	 (when (and (string-equal "dav" method) (string-equal "true" ssl))
+ 	   (setq method "davs"))
+@@ -2067,7 +2067,7 @@ Their full names are \"org.gtk.vfs.MountTracker.mounte
+ 		(string-equal host (tramp-file-name-host vec))
+ 		(string-equal port (tramp-file-name-port vec))
+ 		(string-match-p
+-		 (rx bol "/" (literal (or share "")))
++		 (rx bos "/" (literal (or share "")))
+ 		 (tramp-file-name-unquote-localname vec)))
+ 	   ;; Set mountpoint and location.
+ 	   (tramp-set-file-property vec "/" "fuse-mountpoint" fuse-mountpoint)
+@@ -2093,7 +2093,7 @@ It was \"a(say)\", but has changed to \"a{sv})\"."
+ (defun tramp-gvfs-mount-spec-entry (key value)
+   "Construct a mount-spec entry to be used in a mount_spec.
+ It was \"a(say)\", but has changed to \"a{sv})\"."
+-  (if (string-match-p (rx bol "(aya{sv})") tramp-gvfs-mountlocation-signature)
++  (if (string-match-p (rx bos "(aya{sv})") tramp-gvfs-mountlocation-signature)
+       (list :dict-entry key
+ 	    (list :variant (tramp-gvfs-dbus-string-to-byte-array value)))
+     (list :struct key (tramp-gvfs-dbus-string-to-byte-array value))))
+@@ -2112,9 +2112,9 @@ It was \"a(say)\", but has changed to \"a{sv})\"."
+ 		   (tramp-media-device-port media) (tramp-file-name-port vec)))
+ 	 (localname (tramp-file-name-unquote-localname vec))
+ 	 (share (when (string-match
+-		       (rx bol (? "/") (group (+ (not "/")))) localname)
++		       (rx bos (? "/") (group (+ (not "/")))) localname)
+ 		  (match-string 1 localname)))
+-	 (ssl (if (string-match-p (rx bol (| "davs" "nextcloud")) method)
++	 (ssl (if (string-match-p (rx bos (| "davs" "nextcloud")) method)
+ 		  "true" "false"))
+ 	 (mount-spec
+           `(:array
+@@ -2123,7 +2123,7 @@ It was \"a(say)\", but has changed to \"a{sv})\"."
+                 (list (tramp-gvfs-mount-spec-entry "type" "smb-share")
+                       (tramp-gvfs-mount-spec-entry "server" host)
+                       (tramp-gvfs-mount-spec-entry "share" share)))
+-               ((string-match-p (rx bol (| "davs" "nextcloud")) method)
++               ((string-match-p (rx bos (| "davs" "nextcloud")) method)
+                 (list (tramp-gvfs-mount-spec-entry "type" "dav")
+                       (tramp-gvfs-mount-spec-entry "host" host)
+                       (tramp-gvfs-mount-spec-entry "ssl" ssl)))
+@@ -2137,7 +2137,7 @@ It was \"a(say)\", but has changed to \"a{sv})\"."
+                ((string-equal "nextcloud" method)
+                 (list (tramp-gvfs-mount-spec-entry "type" "owncloud")
+                       (tramp-gvfs-mount-spec-entry "host" host)))
+-               ((string-match-p (rx bol "http") method)
++               ((string-match-p (rx bos "http") method)
+                 (list (tramp-gvfs-mount-spec-entry "type" "http")
+                       (tramp-gvfs-mount-spec-entry
+ 		       "uri"
+@@ -2154,8 +2154,8 @@ It was \"a(say)\", but has changed to \"a{sv})\"."
+             ,@(when port
+                 (list (tramp-gvfs-mount-spec-entry "port" port)))))
+ 	 (mount-pref
+-          (if (and (string-match-p (rx bol "dav") method)
+-                   (string-match (rx bol (? "/") (+ (not "/"))) localname))
++          (if (and (string-match-p (rx bos "dav") method)
++                   (string-match (rx bos (? "/") (+ (not "/"))) localname))
+               (match-string 0 localname)
+ 	    (tramp-gvfs-get-remote-prefix vec))))
+ 
Index: pkgsrc/editors/emacs30/patches/patch-lisp_net_tramp-rclone.el
diff -u /dev/null pkgsrc/editors/emacs30/patches/patch-lisp_net_tramp-rclone.el:1.1
--- /dev/null	Tue Aug 25 17:44:24 2026
+++ pkgsrc/editors/emacs30/patches/patch-lisp_net_tramp-rclone.el	Tue Aug 25 17:44:23 2026
@@ -0,0 +1,25 @@
+$NetBSD: patch-lisp_net_tramp-rclone.el,v 1.1 2026/08/25 17:44:23 wiz Exp $
+
+CVE-2026-79992: Fix local command execution vulnerability in tramp
+https://gitweb.gentoo.org/proj/emacs-patches.git/commit/emacs/30.2/05_all_tramp.patch?id=2a6292f81affedcc468c594c60808e652ae87118
+
+--- lisp/net/tramp-rclone.el.orig	2025-04-05 11:01:10.000000000 +0000
++++ lisp/net/tramp-rclone.el
+@@ -191,7 +191,7 @@ arguments to pass to the OPERATION."
+   (with-tramp-connection-property nil "rclone-device-names"
+     (tramp-compat-seq-keep
+      (lambda (line)
+-       (when (string-match (rx bol (group (+ (not blank))) ":" eol) line)
++       (when (string-match (rx bos (group (+ (not blank))) ":" eos) line)
+ 	 `(nil ,(match-string 1 line))))
+      (tramp-process-lines nil tramp-rclone-program "listremotes"))))
+ 
+@@ -365,7 +365,7 @@ file names."
+ 	  (tramp-rclone-maybe-open-connection v)
+ 	  ;; TODO: This shall be handled by `expand-file-name'.
+ 	  (setq localname
+-		(replace-regexp-in-string (rx bol ".") "" (or localname "")))
++		(replace-regexp-in-string (rx bos ".") "" (or localname "")))
+ 	  (format "%s%s" (tramp-fuse-mounted-p v) localname)))
+     ;; It is a local file name.
+     filename))
Index: pkgsrc/editors/emacs30/patches/patch-lisp_net_tramp-smb.el
diff -u /dev/null pkgsrc/editors/emacs30/patches/patch-lisp_net_tramp-smb.el:1.1
--- /dev/null	Tue Aug 25 17:44:24 2026
+++ pkgsrc/editors/emacs30/patches/patch-lisp_net_tramp-smb.el	Tue Aug 25 17:44:23 2026
@@ -0,0 +1,34 @@
+$NetBSD: patch-lisp_net_tramp-smb.el,v 1.1 2026/08/25 17:44:23 wiz Exp $
+
+CVE-2026-79992: Fix local command execution vulnerability in tramp
+https://gitweb.gentoo.org/proj/emacs-patches.git/commit/emacs/30.2/05_all_tramp.patch?id=2a6292f81affedcc468c594c60808e652ae87118
+
+--- lisp/net/tramp-smb.el.orig	2025-04-05 11:01:10.000000000 +0000
++++ lisp/net/tramp-smb.el
+@@ -1550,7 +1550,7 @@ VEC or USER, or if there is no home directory, return 
+   "Return the share name of LOCALNAME."
+   (save-match-data
+     (let ((localname (tramp-file-name-unquote-localname vec)))
+-      (when (string-match (rx bol (? "/") (group (+ (not "/"))) "/") localname)
++      (when (string-match (rx bos (? "/") (group (+ (not "/"))) "/") localname)
+ 	(match-string 1 localname)))))
+ 
+ (defun tramp-smb-get-localname (vec)
+@@ -1561,7 +1561,7 @@ If VEC has no cifs capabilities, exchange \"/\" by \"\
+       (setq
+        localname
+        (if (string-match
+-	    (rx bol (? "/") (+ (not "/")) (group "/" (* nonl))) localname)
++	    (rx bos (? "/") (+ (not "/")) (group "/" (* nonl))) localname)
+ 	   ;; There is a share, separated by "/".
+ 	   (if (not (tramp-smb-get-cifs-capabilities vec))
+ 	       (mapconcat
+@@ -1569,7 +1569,7 @@ If VEC has no cifs capabilities, exchange \"/\" by \"\
+ 		(match-string 1 localname) "")
+ 	     (match-string 1 localname))
+ 	 ;; There is just a share.
+-	 (if (string-match (rx bol (? "/") (group (+ (not "/"))) eol) localname)
++	 (if (string-match (rx bos (? "/") (group (+ (not "/"))) eos) localname)
+ 	     (match-string 1 localname)
+ 	   "")))
+ 
Index: pkgsrc/editors/emacs30/patches/patch-lisp_net_tramp.el
diff -u /dev/null pkgsrc/editors/emacs30/patches/patch-lisp_net_tramp.el:1.1
--- /dev/null	Tue Aug 25 17:44:24 2026
+++ pkgsrc/editors/emacs30/patches/patch-lisp_net_tramp.el	Tue Aug 25 17:44:23 2026
@@ -0,0 +1,63 @@
+$NetBSD: patch-lisp_net_tramp.el,v 1.1 2026/08/25 17:44:23 wiz Exp $
+
+CVE-2026-79992: Fix local command execution vulnerability in tramp
+https://gitweb.gentoo.org/proj/emacs-patches.git/commit/emacs/30.2/05_all_tramp.patch?id=2a6292f81affedcc468c594c60808e652ae87118
+
+--- lisp/net/tramp.el.orig	2025-05-10 11:38:42.000000000 +0000
++++ lisp/net/tramp.el
+@@ -973,11 +973,11 @@ Used in `tramp-make-tramp-file-name'.")
+ 
+ (defun tramp-build-prefix-regexp ()
+   "Return `tramp-prefix-regexp'."
+-  (rx bol (literal (tramp-build-prefix-format))))
++  (rx bos (literal (tramp-build-prefix-format))))
+ 
+ (defvar tramp-prefix-regexp nil ; Initialized when defining `tramp-syntax'!
+   "Regexp matching the very beginning of Tramp file names.
+-Should always start with \"^\".  Derived from `tramp-prefix-format'.")
++Should always start with \"\\\\=`\".  Derived from `tramp-prefix-format'.")
+ 
+ (defconst tramp-method-regexp-alist
+   `((default . ,(rx (| (literal tramp-default-method-marker) (>= 2 alnum))))
+@@ -1019,7 +1019,10 @@ Derived from `tramp-postfix-method-format'.")
+   "Regexp matching delimiter between method and user or host names.
+ Derived from `tramp-postfix-method-format'.")
+ 
+-(defconst tramp-user-regexp (rx (+ (not (any "/:|" blank))))
++(defconst tramp-user-regexp
++  (rx (| (+ (not (any "/\\^$?*:;|[]{}()<>`'\"" blank)))
++	 ;; Environment variable.
++	 (: "$" (+ (any "_" alnum)))))
+   "Regexp matching user names.")
+ 
+ (defconst tramp-prefix-domain-format "%"
+@@ -1801,6 +1804,8 @@ default values are used."
+ 	    (hop       (match-string (nth 5 tramp-file-name-structure) name))
+ 	    domain port v)
+ 	(when user
++	  (while (string-match (rx bos "$" (group (+ (any "_" alnum))) eos) user)
++	    (setq user (getenv (match-string 1 user))))
+ 	  (when (string-match tramp-user-with-domain-regexp user)
+ 	    (setq domain (match-string 2 user)
+ 		  user (match-string 1 user))))
+@@ -2491,9 +2496,9 @@ Fall back to normal file name handler if no Tramp file
+ 	;; `file-remote-p' is called for everything, even for symbolic
+ 	;; links which look remote.  We don't want to get an error.
+ 	(non-essential (or non-essential (eq operation 'file-remote-p))))
++    (setq filename (tramp-replace-environment-variables filename))
+     (if (tramp-tramp-file-p filename)
+ 	(save-match-data
+-          (setq filename (tramp-replace-environment-variables filename))
+           (with-parsed-tramp-file-name filename nil
+             (let ((current-connection tramp-current-connection)
+ 		  (foreign
+@@ -6537,6 +6542,9 @@ to cache the result.  Return the modified ATTR."
+ 			       (caar attr))
+ 			      (decode-coding-string
+ 			       (match-string 1 (caar attr)) 'utf-8))))
++	       ;; Quote remote-like symlink.
++	       (when (and (stringp (car attr)) (tramp-tramp-file-p (car attr)))
++		 (setcar attr (file-name-quote (car attr) 'top)))
+ 	       ;; Set file's gid change bit.
+ 	       (setcar
+ 		(nthcdr 9 attr)
Index: pkgsrc/editors/emacs30/patches/patch-test_lisp_net_tramp-tests.el
diff -u /dev/null pkgsrc/editors/emacs30/patches/patch-test_lisp_net_tramp-tests.el:1.1
--- /dev/null	Tue Aug 25 17:44:24 2026
+++ pkgsrc/editors/emacs30/patches/patch-test_lisp_net_tramp-tests.el	Tue Aug 25 17:44:23 2026
@@ -0,0 +1,118 @@
+$NetBSD: patch-test_lisp_net_tramp-tests.el,v 1.1 2026/08/25 17:44:23 wiz Exp $
+
+CVE-2026-79992: Fix local command execution vulnerability in tramp
+https://gitweb.gentoo.org/proj/emacs-patches.git/commit/emacs/30.2/05_all_tramp.patch?id=2a6292f81affedcc468c594c60808e652ae87118
+
+--- test/lisp/net/tramp-tests.el.orig	2025-05-17 10:45:04.000000000 +0000
++++ test/lisp/net/tramp-tests.el
+@@ -325,6 +325,7 @@ is greater than 10.
+ 	  (should (tramp-tramp-file-p "/method:user@:"))
+ 	  (should (tramp-tramp-file-p "/method:user@host:"))
+ 	  (should (tramp-tramp-file-p "/method:user@email@host:"))
++	  (should (tramp-tramp-file-p "/method:$USER@host:"))
+ 
+ 	  ;; Using a port.
+ 	  (should (tramp-tramp-file-p "/method:host#1234:"))
+@@ -421,6 +422,7 @@ is greater than 10.
+ 	  (should (tramp-tramp-file-p "/user@:"))
+ 	  (should (tramp-tramp-file-p "/user@host:"))
+ 	  (should (tramp-tramp-file-p "/user@email@host:"))
++	  (should (tramp-tramp-file-p "/$USER@host:"))
+ 
+ 	  ;; Using a port.
+ 	  (should (tramp-tramp-file-p "/host#1234:"))
+@@ -483,6 +485,7 @@ is greater than 10.
+ 	  (should (tramp-tramp-file-p "/[method/user@]"))
+ 	  (should (tramp-tramp-file-p "/[method/user@host]"))
+ 	  (should (tramp-tramp-file-p "/[method/user@email@host]"))
++	  (should (tramp-tramp-file-p "/[method/$USER@host]"))
+ 
+ 	  ;; Using a port.
+ 	  (should (tramp-tramp-file-p "/[method/host#1234]"))
+@@ -671,6 +674,28 @@ is greater than 10.
+ 	  (should (string-equal
+ 		   (file-remote-p "/method:user@email@host:" 'hop) nil))
+ 
++	  ;; Expand environment variable.  It can be cascaded.
++	  (with-environment-variables
++	      (("REMOTE_USER" "$REMOTE_USER1") ("REMOTE_USER1" "remote-user"))
++	    (should (string-equal
++		     (file-remote-p "/method:$REMOTE_USER@host:")
++		     (format "/%s:%s@%s:" "method" "remote-user" "host")))
++	    (should
++	     (string-equal
++	      (file-remote-p "/method:$REMOTE_USER@host:" 'method) "method"))
++	    (should
++	     (string-equal
++	      (file-remote-p "/method:$REMOTE_USER@host:" 'user) "remote-user"))
++	    (should
++	     (string-equal
++	      (file-remote-p "/method:$REMOTE_USER@host:" 'host) "host"))
++	    (should
++	     (string-equal
++	      (file-remote-p "/method:$REMOTE_USER@host:" 'localname) ""))
++	    (should
++	     (string-equal
++	      (file-remote-p "/method:$REMOTE_USER@host:" 'hop) nil)))
++
+ 	  ;; Expand `tramp-default-method' and `tramp-default-user'.
+ 	  (should
+ 	   (string-equal
+@@ -1151,6 +1176,28 @@ is greater than 10.
+ 	  (should (string-equal
+ 		   (file-remote-p "/user@email@host:" 'hop) nil))
+ 
++	  ;; Expand environment variable.  It can be cascaded.
++	  (with-environment-variables
++	      (("REMOTE_USER" "$REMOTE_USER1") ("REMOTE_USER1" "remote-user"))
++	    (should (string-equal
++		     (file-remote-p "/$REMOTE_USER@host:")
++		     (format "/%s@%s:" "remote-user" "host")))
++	    (should
++	     (string-equal
++	      (file-remote-p "/$REMOTE_USER@host:" 'method) "default-method"))
++	    (should
++	     (string-equal
++	      (file-remote-p "/$REMOTE_USER@host:" 'user) "remote-user"))
++	    (should
++	     (string-equal
++	      (file-remote-p "/$REMOTE_USER@host:" 'host) "host"))
++	    (should
++	     (string-equal
++	      (file-remote-p "/$REMOTE_USER@host:" 'localname) ""))
++	    (should
++	     (string-equal
++	      (file-remote-p "/$REMOTE_USER@host:" 'hop) nil)))
++
+ 	  ;; Expand `tramp-default-method' and `tramp-default-user'.
+ 	  (should (string-equal
+ 		   (file-remote-p "/host#1234:")
+@@ -1616,6 +1663,28 @@ is greater than 10.
+ 		   (file-remote-p "/[method/user@email@host]" 'localname) ""))
+ 	  (should (string-equal
+ 		   (file-remote-p "/[method/user@email@host]" 'hop) nil))
++
++	  ;; Expand environment variable.  It can be cascaded.
++	  (with-environment-variables
++	      (("REMOTE_USER" "$REMOTE_USER1") ("REMOTE_USER1" "remote-user"))
++	    (should (string-equal
++		     (file-remote-p "/[method/$REMOTE_USER@host]")
++		     (format "/[%s/%s@%s]" "method" "remote-user" "host")))
++	    (should
++	     (string-equal
++	      (file-remote-p "/[method/$REMOTE_USER@host]" 'method) "method"))
++	    (should
++	     (string-equal
++	      (file-remote-p "/[method/$REMOTE_USER@host]" 'user) "remote-user"))
++	    (should
++	     (string-equal
++	      (file-remote-p "/[method/$REMOTE_USER@host]" 'host) "host"))
++	    (should
++	     (string-equal
++	      (file-remote-p "/[method/$REMOTE_USER@host]" 'localname) ""))
++	    (should
++	     (string-equal
++	      (file-remote-p "/[method/$REMOTE_USER@host]" 'hop) nil)))
+ 
+ 	  ;; Expand `tramp-default-method' and `tramp-default-user'.
+ 	  (should (string-equal