You can clone with
HTTPS or Subversion.
When installing 0.6.1 (but not 0.6), Emacs prompts the user to confirm the safety of the local variables set in ~/.emacs.d/elpa/company-0.6.1 -- I guess this is because the .dir-locals.el is included in the package.
.dir-locals.el itself is fine. But specifically the variable emacs-lisp-docstring-fill-column isn't considered "safe" by Emacs.
Um, yes. emacs-lisp-docstring-fill-column is not safe, probably due to oversight.
I'll try to find out of we can exclude .dir-locals.el from packaging while keeping it in the repository.
To be sure, I made this variable unsafe again on the local machine and tried to download the package.
It installed and turned on fine, the prompt only shows up when you try to open one of the files. Is that accurate?
Nope. If I delete the company-0.6.1 directory and restart Emacs, configured such that it automatically package-installs company at start-up, then I get the same message. This is with Emacs HEAD as of a couple of days ago.
And just to confirm, the prompt indeed relates to emacs-lisp-docstring-fill-column.
Evaluating (package-install 'company) doesn't do it for me either. Also a recent trunk build here, and package.el hasn't seen any changes that could be related for a while now.
If you found out what piece of your config exactly creates this problem, that would be helpful. Though I'd probably have to fix it on this side anyway.
Discussion on emacs-devel: http://lists.gnu.org/archive/html/emacs-devel/2013-03/msg00624.html
Okay, right, my bad -- it works fine in a clean Emacs. I have a local configuration tweak which closes any dangling -autoloads files after package installation (since package.el used to leave such buffers lying around), and that caused the prompt. Sorry for the noise...
It's good to know that the problem is not in some third-party package.
Nope, just good old-fashioned Pilot Error.