diff options
| author | Karl Berry <karl@freefriends.org> | 2020-05-03 15:10:31 +0000 |
|---|---|---|
| committer | Karl Berry <karl@freefriends.org> | 2020-05-03 15:10:31 +0000 |
| commit | db0f0748773fa12fb16d10cd803f79887c77e44e (patch) | |
| tree | 12f4900d072a492749738c1b37874c105704ae98 | |
| parent | 8f1857f2c25b53e5ef594eb3e37f0f6f81066273 (diff) | |
fail if gpg fails or key expired
git-svn-id: svn://tug.org/texlive/trunk@54986 c570f23f-e606-0410-a88d-b1316a301751
| -rwxr-xr-x | Master/tlpkg/bin/tl-sign-file | 23 | ||||
| -rw-r--r-- | Master/tlpkg/gpg/tl-key-extension.txt | 7 |
2 files changed, 26 insertions, 4 deletions
diff --git a/Master/tlpkg/bin/tl-sign-file b/Master/tlpkg/bin/tl-sign-file index bab1d5fdff0..fbe71a41179 100755 --- a/Master/tlpkg/bin/tl-sign-file +++ b/Master/tlpkg/bin/tl-sign-file @@ -29,5 +29,24 @@ if test -n "$TL_GNUPGMAINOPTS" ; then gpgmainopts=$TL_GNUPGMAINOPTS fi -# sign -"$prg" $gpgmainopts $gpgopts "$1" +# sign, check that result doesn't use something expired. +# both --detach-sign and --verify exit 0 even when something is expired. +if "$prg" $gpgmainopts $gpgopts "$1"; then + if "$prg" --verify "$1".asc 2>&1 | grep xpired >/dev/null; then + echo "$0: expired key, output from $prg --verify $1.asc:" >&2 + "$prg" --verify "$1".asc + echo "$0: expired key, moving $1.asc to $1.asc.xpir." >&2 + mv "$1".asc "$1".asc.xpir || exit 1 + echo "$0: gpg command was:" >&2 + echo "$0:" "$prg" $gpgmainopts $gpgopts "$1" >&2 + echo "$0: good luck and goodbye." >&2 + exit 1 + fi +else + echo "$0: gpg failed, exiting." >&2 + echo "$0: gpg command was:" >&2 + echo "$0:" "$prg" $gpgmainopts $gpgopts "$1" >&2 + exit 1 +fi + +exit 0 diff --git a/Master/tlpkg/gpg/tl-key-extension.txt b/Master/tlpkg/gpg/tl-key-extension.txt index dcd14e279f0..0ceeab2c69d 100644 --- a/Master/tlpkg/gpg/tl-key-extension.txt +++ b/Master/tlpkg/gpg/tl-key-extension.txt @@ -4,13 +4,12 @@ $Id$ How to update TeX Live distribution signing key =============================================== -this should be done every year during the pretest. +This must be done every year! It's not optional. shut down networking service cp gpg directory from USB stick to computer - export GNUPGHOME=...<COPY OF USBSTICK gpg directory> export KEYID=0xC78B82D8C79512F79CC0D7C80D5E5D9106BAB6BC gpg --edit-key $KEYID @@ -44,3 +43,7 @@ svn/git commit # texlive.asc, see above how to export it) gpg --homedir ~texlive/.gnupg --import texlive.asc + +More info: +. we use tlpkg/bin/tl-sign-file to sign texlive.tlpdb. +. gpg --verify --verbose foo.asc for info on signature of file. |