summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNorbert Preining <preining@logic.at>2016-04-12 06:10:02 +0000
committerNorbert Preining <preining@logic.at>2016-04-12 06:10:02 +0000
commit891bd590ba9068adae1e8070e07abf95a3f3d413 (patch)
tree1cb63fcaaaffcdcf4e88ed229b2d75f7696c601f
parent61d9ec43616124e96862cca64c4b5a81479944d4 (diff)
unify the verify_* functions, simplify code, verify checksum file
git-svn-id: svn://tug.org/texlive/trunk@40444 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r--Master/tlpkg/TeXLive/TLUtils.pm165
1 files changed, 78 insertions, 87 deletions
diff --git a/Master/tlpkg/TeXLive/TLUtils.pm b/Master/tlpkg/TeXLive/TLUtils.pm
index 4300bb486ea..23abd1f9f3d 100644
--- a/Master/tlpkg/TeXLive/TLUtils.pm
+++ b/Master/tlpkg/TeXLive/TLUtils.pm
@@ -100,7 +100,6 @@ C<TeXLive::TLUtils> -- utilities used in TeX Live infrastructure
TeXLive::TLUtils::give_ctan_mirror_base();
TeXLive::TLUtils::tlmd5($path);
TeXLive::TLUtils::tlchecksum($path);
- TeXLive::TLUtils::verify_checksum($file, $checksum);
TeXLive::TLUtils::setup_gpg();
TeXLive::TLUtils::verify_download($file, $url);
TeXLive::TLUtils::compare_tlpobjs($tlpA, $tlpB);
@@ -178,7 +177,6 @@ BEGIN {
&extract_mirror_entry
&tlmd5
&tlchecksum
- &verify_checksum
&setup_gpg
&verify_download
&wsystem
@@ -3622,57 +3620,6 @@ sub tlchecksum_data {
=pod
-=item C<< verify_checksum ($file, $checksum) >>
-
-Verifies the checksum of the (already downloaded) file against
-C<$checksum> (which can be a remote URL).
-
-Returns 1 on success, and a pair of 0 and a warning otherwise.
-
-=cut
-
-sub verify_checksum {
- my ($file_data, $checksum) = @_;
- ddebug("verify_checksum: remote path of digest = $checksum\n");
- my $local_digest;
- my $remote_digest;
- my ($cs_fh, $cs_file);
- my $ret = 1;
- if ($checksum =~ m,^(http|ftp)://,) {
- ($cs_fh, $cs_file) = File::Temp::tempfile();
- # now $cs_fh filehandle is open, the file created
- # TLUtils::download_file will just overwrite what is there
- # on windows that doesn't work, so we close the fh immediately
- # this creates a short loophole, but much better than before anyway
- close($cs_fh);
- $ret = download_file($checksum, $cs_file);
- } else {
- $cs_file = $checksum;
- }
- if ($ret && (-r "$cs_file")) {
- open $cs_fh, "<$cs_file" or return(0, "file not found");
- if (read ($cs_fh, $remote_digest, $ChecksumLength) != $ChecksumLength) {
- return(0, "read error");
- } else {
- close($cs_fh);
- ddebug("found remote digest: $remote_digest\n");
- }
- } else {
- return(0, "digest not found");
- }
- $local_digest = tlchecksum_data($file_data);
- ddebug("local_digest = $local_digest\n");
- if ($local_digest eq $remote_digest) {
- debug("checksum of local copy identical with remote hash\n");
- return(1);
- } else {
- return(0, "checksum error");
- }
- return(0, "not reachable");
-}
-
-=pod
-
=item C<< setup_gpg() >>
Tries to set up gpg command line C<$::gpg> used for
@@ -3706,12 +3653,9 @@ sub setup_gpg {
=pod
-=item C<< verify_download($file, $url) >>
-
-Verifies a download of C<$url> into C<$file> by checking C<$url.checksum>
-and if gpg is available, verifying that with C<$url.checksum.gpg>.
+=item C<< slurp_file($file) >>
-Returns 1 on success, and a pair of 0 and a warning otherwise.
+Reads the whole file and returns the content in a scalar.
=cut
@@ -3725,39 +3669,64 @@ sub slurp_file {
return($file_data);
}
+
+=pod
+
+=item C<< verify_download($file, $url) >>
+
+Verifies a download of C<$url> into C<$file> by checking C<$url.checksum>
+and if gpg is available, verifying that with C<$url.checksum.asc>.
+
+Returns 1 on success, and a pair of 0 and a warning otherwise.
+
+=cut
+
+sub download_to_temp_or_file {
+ my $url = shift;
+ my ($url_fh, $url_file);
+ if ($url =~ m,^(http|ftp|file)://,) {
+ ($url_fh, $url_file) = File::Temp::tempfile(UNLINK => 1);
+ # now $url_fh filehandle is open, the file created
+ # TLUtils::download_file will just overwrite what is there
+ # on windows that doesn't work, so we close the fh immediately
+ # this creates a short loophole, but much better than before anyway
+ close($url_fh);
+ $ret = download_file($url, $url_file);
+ } else {
+ $url_file = $url;
+ $ret = 1;
+ }
+ if ($ret && (-r "$url_file")) {
+ return $url_file;
+ }
+ return;
+}
+
sub verify_download {
my ($file, $url) = @_;
- # we need the tlpdb data read in
- my $file_data = slurp_file($file);
- # first verify digest
- my ($ret, $msg) = verify_checksum($file_data, "$url.checksum");
- return($ret,$msg) if (!$ret);
- # next try to verify gpg
- $ret = 1; # default for gpg download
+ # download checksum file
+ my $checksum_url = "$url.checksum";
+ my $signature_url = "$checksum_url.asc";
+
+ my $checksum_file = download_to_temp_or_file($checksum_url);
+ if (!$checksum_file) {
+ # we do not accept if not even a checksum file is present, error out
+ return(0, "checksum file not found");
+ }
+
+ # if we have $::gpg set, we try to verify cryptographic signatures
if ($::gpg) {
- my $urlgpg = "$url.asc";
- my ($signature_fh, $signature_file);
- if ($urlgpg =~ m,^(http|ftp|file)://,) {
- ($signature_fh, $signature_file) = File::Temp::tempfile(UNLINK => 1);
- # now $gpg_fh filehandle is open, the file created
- # TLUtils::download_file will just overwrite what is there
- # on windows that doesn't work, so we close the fh immediately
- # this creates a short loophole, but much better than before anyway
- close($signature_fh);
- $ret = download_file($urlgpg, $signature_file);
- } else {
- $signature_file = $urlgpg;
- }
- if ($ret && (-r "$signature_file")) {
- if (TeXLive::TLUtils::gpg_verify_signature($file, $signature_file)) {
- info("cryptographic signature of $url verified\n");
+ my $signature_file = download_to_temp_or_file($signature_url);
+ if ($signature_file) {
+ if (TeXLive::TLUtils::gpg_verify_signature($checksum_file, $signature_file)) {
+ info("cryptographic signature of $checksum_url verified\n");
} else {
- tldie(<<GPGERROR);
-Verification of downloaded file
- $file
+ return(0, <<GPGERROR);
+cryptograpic verification of
+ $checksum_url
against
- $urlgpg
-did not succeed. Please report to texlive\@tug.org
+ $signature_url
+failed. Please report to texlive\@tug.org
GPGERROR
}
} else {
@@ -3766,7 +3735,29 @@ GPGERROR
} else {
debug("gpg prog not defined, no checking of signatures\n");
}
- # we tldie out above if verification failed, so be happy for now
+
+ # if we are still here, then either verification was successful,
+ # or no gpg or signature found
+
+ # next step is verification of tlpdb checksum with checksum file
+ # existenc of checksum_file was checked above
+ open $cs_fh, "<$checksum_file" or die("cannot read file: $!");
+ if (read ($cs_fh, $remote_digest, $ChecksumLength) != $ChecksumLength) {
+ close($cs_fh);
+ return(0, "read error from $checksum_file");
+ } else {
+ close($cs_fh);
+ ddebug("found remote digest: $remote_digest\n");
+ }
+ $local_digest = tlchecksum($file);
+ ddebug("local_digest = $local_digest\n");
+ if ($local_digest ne $remote_digest) {
+ return(0, "checksum error");
+ }
+
+ # we are still here, so checksum also succeeded
+ debug("checksum of local copy identical with remote hash\n");
+
return(1);
}