The manual nodes (elisp) Custom Themes
, (emacs) Custom Themes
and (emacs) Creating Custom Themes
make no mention of byte-compilation, so why is it not done?
At the time of writing, the manuals indeed do not explicitly mention byte-compilation. Nevertheless, custom themes are described several times in all referenced sections as comprising Elisp source, as opposed to byte-compiled, files.
Why are functions custom-available-themes
and load-path
so restrictive? Does byte-compiling custom themes present any issues or disadvantages?
In brief, byte-compiling a custom theme obfuscates any code it may contain and thus undermines the defences mentioned in the following sections against inadvertently loading arbitrary and possibly malicious code.
Quoth (emacs) Custom Themes
:
When you first enable a Custom theme, Emacs displays the contents of
the theme file and asks if you really want to load it. Because loading
a Custom theme can execute arbitrary Lisp code, you should only say yes
if you know that the theme is safe; in that case, Emacs offers to
remember in the future that the theme is safe (this is done by saving
the theme file’s SHA-256 hash to the variable ‘custom-safe-themes’; if
you want to treat all themes as safe, change its value to ‘t’). Themes
that come with Emacs (in the ‘etc/themes’ directory) are exempt from
this check, and are always considered safe.
Quoth (elisp) Custom Themes
:
In theory, a theme file can also contain other Lisp forms, which
would be evaluated when loading the theme, but that is bad form. To
protect against loading themes containing malicious code, Emacs displays
the source file and asks for confirmation from the user before loading
any non-built-in theme for the first time.
Quoth Stefan Monnier (with express permission):
Is this "aversion" to byte-compilation of custom themes intentional?
I think it's due to the idea that users might download theme files from
random places without realizing that it contains arbitrary Lisp code
(contrary to normal Emacs packages where we consider that users should
know that it contains arbitrary Lisp code). So we prompt users to
confirm that they think the theme file is safe, and users can't be
expected to assess the safety of a .elc file, so we insist on using the
.el file, which the user can inspect without nearly as much pain.
An amendment to the Elisp manual has been suggested to this effect.
Update
As of July 2018, Emacs 27 no longer refuses to load byte-compiled themes that are considered safe. This was discussed in the following emacs-devel
thread:
emacs-devel
mailing list; here is the relevant thread, for posterity: lists.gnu.org/archive/html/emacs-devel/2018-01/msg00614.html