summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNorbert Preining <norbert@preining.info>2019-04-01 23:28:17 +0900
committerNorbert Preining <norbert@preining.info>2019-04-01 23:28:17 +0900
commite95860d57e06003f281be956743f84200f41f231 (patch)
tree8ab3b6e1e48d55e86d3ca13d650de45984c46652
parentc8f5078ae6b8ff05c3d29447803c8f617696119b (diff)
finish support of expired key warningsmerged/gpg-status
-rwxr-xr-xMaster/texmf-dist/scripts/texlive/tlmgr.pl3
-rw-r--r--Master/tlpkg/TeXLive/TLCrypto.pm30
-rw-r--r--Master/tlpkg/TeXLive/TLPDB.pm3
3 files changed, 24 insertions, 12 deletions
diff --git a/Master/texmf-dist/scripts/texlive/tlmgr.pl b/Master/texmf-dist/scripts/texlive/tlmgr.pl
index 07f950cdfb6..1f9a0d051d1 100755
--- a/Master/texmf-dist/scripts/texlive/tlmgr.pl
+++ b/Master/texmf-dist/scripts/texlive/tlmgr.pl
@@ -6906,6 +6906,9 @@ END_NO_INTERNET
# TODO should we die here? Probably yes because one of
# checksum file or signature file has changed!
tldie("$prg: verification of checksum for $location failed: $msg\n");
+ } elsif ($ret == $VS_EXPKEYSIG) {
+ # do nothing, try to get new tlpdb and hope sig is better?
+ debug("$prg: gpg key expired, continuing anyway!\n");
} elsif ($ret == $VS_VERIFIED) {
$remotetlpdb = TeXLive::TLPDB->new(root => $location,
tlpdbfile => $loc_copy_of_remote_tlpdb);
diff --git a/Master/tlpkg/TeXLive/TLCrypto.pm b/Master/tlpkg/TeXLive/TLCrypto.pm
index fd52cc247cf..7c8848e5b15 100644
--- a/Master/tlpkg/TeXLive/TLCrypto.pm
+++ b/Master/tlpkg/TeXLive/TLCrypto.pm
@@ -57,11 +57,13 @@ BEGIN {
%VerificationStatusDescription
$VS_VERIFIED $VS_CHECKSUM_ERROR $VS_SIGNATURE_ERROR $VS_CONNECTION_ERROR
$VS_UNSIGNED $VS_GPG_UNAVAILABLE $VS_PUBKEY_MISSING $VS_UNKNOWN
+ $VS_EXPKEYSIG
);
@EXPORT = qw(
%VerificationStatusDescription
$VS_VERIFIED $VS_CHECKSUM_ERROR $VS_SIGNATURE_ERROR $VS_CONNECTION_ERROR
$VS_UNSIGNED $VS_GPG_UNAVAILABLE $VS_PUBKEY_MISSING $VS_UNKNOWN
+ $VS_EXPKEYSIG
);
}
@@ -450,12 +452,14 @@ sub verify_signature {
}
}
my ($ret, $out) = gpg_verify_signature($file, $signature_file);
- if ($ret == 1) {
+ if ($ret == $VS_VERIFIED) {
# no need to show the output
debug("cryptographic signature of $url verified\n");
return($VS_VERIFIED);
- } elsif ($ret == -1) {
+ } elsif ($ret == $VS_PUBKEY_MISSING) {
return($VS_PUBKEY_MISSING, $out);
+ } elsif ($ret == $VS_EXPKEYSIG) {
+ return($VS_EXPKEYSIG, $out);
} else {
return($VS_SIGNATURE_ERROR, <<GPGERROR);
cryptographic signature verification of
@@ -504,21 +508,23 @@ sub gpg_verify_signature {
# read status file
open($status_fd, "<", $status_file) || die("Cannot open status file: $!");
my @status_lines = <$status_fd>;
+ close($status_fd);
chomp(@status_lines);
+ debug(join("\n", "STATUS OUTPUT", @status_lines));
if ($ret == 0) {
+ # verification still might return success but key is expired!
+ if (grep(/KEYEXPIRED/, @status_lines)) {
+ return($VS_EXPKEYSIG, "expired key");
+ }
debug("verification succeeded, output:\n$out\n");
- debug(join("\n", "STATUS OUTPUT", @status_lines));
- return (1, $out);
+ return ($VS_VERIFIED, $out);
} else {
- open($status_fd, "<", $status_file) || die("Cannot open status file: $!");
- while (<$status_fd>) {
- if (m/^\[GNUPG:\] NO_PUBKEY (.*)/) {
- close($status_fd);
- debug("missing pubkey $1\n");
- return (-1, "missing pubkey $1");
- }
+ if (grep(/^\[GNUPG:\] NO_PUBKEY (.*)/, @status_lines)) {
+ debug("missing pubkey $1\n");
+ return ($VS_PUBKEY_MISSING, "missing pubkey $1");
}
- return (0, $out);
+ # we could do more checks on what is the actual problem here!
+ return ($VS_SIGNATURE_ERROR, $out);
}
}
diff --git a/Master/tlpkg/TeXLive/TLPDB.pm b/Master/tlpkg/TeXLive/TLPDB.pm
index a18bdfe2a81..2d6acb1d9be 100644
--- a/Master/tlpkg/TeXLive/TLPDB.pm
+++ b/Master/tlpkg/TeXLive/TLPDB.pm
@@ -406,6 +406,9 @@ sub from_file {
} elsif ($r == $VS_PUBKEY_MISSING) {
debug("$0: TLPDB: pubkey missing, continuing anyway!\n");
$self->verification_status($r);
+ } elsif ($r == $VS_EXPKEYSIG) {
+ debug("$0: TLPDB: signature verified, but key expired, continuing anyway!\n");
+ $self->verification_status($r);
} elsif ($r == $VS_VERIFIED) {
$is_verified = 1;
$self->verification_status($r);