summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNorbert Preining <preining@logic.at>2019-04-01 15:01:10 +0000
committerNorbert Preining <preining@logic.at>2019-04-01 15:01:10 +0000
commit31ccd24dea07e71686a98110919371de80ed0dc0 (patch)
treed312666810dec97067c807bcf492dbffa1f60194
parent9cd662864f3bb8d9c7648322e3bd354d0051f970 (diff)
gpg sigs: also recognize sigs of revoked keys
git-svn-id: svn://tug.org/texlive/trunk@50692 c570f23f-e606-0410-a88d-b1316a301751
-rwxr-xr-xMaster/texmf-dist/scripts/texlive/tlmgr.pl5
-rw-r--r--Master/tlpkg/TeXLive/TLCrypto.pm18
2 files changed, 18 insertions, 5 deletions
diff --git a/Master/texmf-dist/scripts/texlive/tlmgr.pl b/Master/texmf-dist/scripts/texlive/tlmgr.pl
index 1f9a0d051d1..5d11c99628c 100755
--- a/Master/texmf-dist/scripts/texlive/tlmgr.pl
+++ b/Master/texmf-dist/scripts/texlive/tlmgr.pl
@@ -6908,7 +6908,10 @@ END_NO_INTERNET
tldie("$prg: verification of checksum for $location failed: $msg\n");
} elsif ($ret == $VS_EXPKEYSIG) {
# do nothing, try to get new tlpdb and hope sig is better?
- debug("$prg: gpg key expired, continuing anyway!\n");
+ debug("$prg: good signature bug gpg key expired, continuing anyway!\n");
+ } elsif ($ret == $VS_REVKEYSIG) {
+ # do nothing, try to get new tlpdb and hope sig is better?
+ debug("$prg: good signature but from revoked gpg key, continuing anyway!\n");
} elsif ($ret == $VS_VERIFIED) {
$remotetlpdb = TeXLive::TLPDB->new(root => $location,
tlpdbfile => $loc_copy_of_remote_tlpdb);
diff --git a/Master/tlpkg/TeXLive/TLCrypto.pm b/Master/tlpkg/TeXLive/TLCrypto.pm
index ed6dff345c2..ecd949b4b2e 100644
--- a/Master/tlpkg/TeXLive/TLCrypto.pm
+++ b/Master/tlpkg/TeXLive/TLCrypto.pm
@@ -57,13 +57,13 @@ BEGIN {
%VerificationStatusDescription
$VS_VERIFIED $VS_CHECKSUM_ERROR $VS_SIGNATURE_ERROR $VS_CONNECTION_ERROR
$VS_UNSIGNED $VS_GPG_UNAVAILABLE $VS_PUBKEY_MISSING $VS_UNKNOWN
- $VS_EXPKEYSIG
+ $VS_EXPKEYSIG $VS_REVKEYSIG
);
@EXPORT = qw(
%VerificationStatusDescription
$VS_VERIFIED $VS_CHECKSUM_ERROR $VS_SIGNATURE_ERROR $VS_CONNECTION_ERROR
$VS_UNSIGNED $VS_GPG_UNAVAILABLE $VS_PUBKEY_MISSING $VS_UNKNOWN
- $VS_EXPKEYSIG
+ $VS_EXPKEYSIG $VS_REVKEYSIG
);
}
@@ -234,8 +234,10 @@ C<$VS_CONNECTION_ERROR> on connection error,
C<$VS_UNSIGNED> on missing signature file,
C<$VS_GPG_UNAVAILABLE> if no gpg program is available,
C<$VS_PUBKEY_MISSING> if the pubkey is not available,
-C<$VS_CHECKSUM_ERROR> on checksum errors,and
-C<$VS_SIGNATURE_ERROR> on signature errors.
+C<$VS_CHECKSUM_ERROR> on checksum errors,
+C<$VS_EXPKEYSIG> if the signature is good but was made with an expired key,
+C<$VS_REVKEYSIG> if the signature is good but was made with a revoked key,
+and C<$VS_SIGNATURE_ERROR> on signature errors.
In case of errors returns an informal message as second argument.
=cut
@@ -414,6 +416,8 @@ gpg signature in C<$url.asc>.
Returns
$VS_VERIFIED on success,
+$VS_REVKEYSIG on good signature but from revoked key,
+$VS_EXPKEYSIG on good signature but from expired key,
$VS_UNSIGNED on missing signature file,
$VS_SIGNATURE_ERROR on signature error,
$VS_GPG_UNAVAILABLE if no gpg is available, and
@@ -460,6 +464,8 @@ sub verify_signature {
return($VS_PUBKEY_MISSING, $out);
} elsif ($ret == $VS_EXPKEYSIG) {
return($VS_EXPKEYSIG, $out);
+ } elsif ($ret == $VS_REVKEYSIG) {
+ return($VS_REVKEYSIG, $out);
} else {
return($VS_SIGNATURE_ERROR, <<GPGERROR);
cryptographic signature verification of
@@ -516,6 +522,9 @@ sub gpg_verify_signature {
if (grep(/EXPKEYSIG/, @status_lines)) {
return($VS_EXPKEYSIG, "expired key");
}
+ if (grep(/REVKEYSIG/, @status_lines)) {
+ return($VS_REVKEYSIG, "revoked key");
+ }
debug("verification succeeded, output:\n$out\n");
return ($VS_VERIFIED, $out);
} else {
@@ -545,6 +554,7 @@ our $VS_GPG_UNAVAILABLE = -3;
our $VS_PUBKEY_MISSING = -4;
our $VS_EXPKEYSIG = -5;
our $VS_EXPSIG = -6;
+our $VS_REVKEYSIG = -7;
our $VS_UNKNOWN = -100;
our %VerificationStatusDescription = (