summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2020-05-15 14:58:16 +0000
committerKarl Berry <karl@freefriends.org>2020-05-15 14:58:16 +0000
commitf069144acdb6dd02c2dbdbf64012a19f91154184 (patch)
treec73bbe38fecaebaf6efafc213bc44dcab773dc20
parentfbd75b29567f865c5319a4f40ce81e845711232e (diff)
verify signed file as with TLCrypto::gpg_verify_signature
git-svn-id: svn://tug.org/texlive/trunk@55147 c570f23f-e606-0410-a88d-b1316a301751
-rwxr-xr-xMaster/tlpkg/bin/tl-sign-file88
-rw-r--r--Master/tlpkg/gpg/tl-key-extension.txt14
2 files changed, 73 insertions, 29 deletions
diff --git a/Master/tlpkg/bin/tl-sign-file b/Master/tlpkg/bin/tl-sign-file
index fbe71a41179..f79a2256dcc 100755
--- a/Master/tlpkg/bin/tl-sign-file
+++ b/Master/tlpkg/bin/tl-sign-file
@@ -1,51 +1,85 @@
#!/bin/sh
# $Id$
-# Public domain. Originally written 2016, Norbert Preining.
-# Sign a file for release in TeX Live. Used in tl-update-images, etc.
-# See tlpkg/gpg/tl-key-extension.txt for some info.
+# Public domain. Originally written 2016, Norbert Preining.
+# Sign a file for release in TeX Live. Used in tl-update-images,
+# tl-update-tlnet, et al. See tlpkg/gpg/tl-key-extension.txt for some info.
if test $# -ne 1; then
echo "$0: Exactly one argument must be given, the file to sign." >&2
exit 1
fi
-# remove previous signature
+# remove previous signature else gpg will bail out.
rm -f "$1.asc"
-prg=gpg
-gpgopts="--batch --homedir /home/texlive/.gnupg \
+gpg_prog=gpg
+gpg_opts="--batch --homedir /home/texlive/.gnupg \
--passphrase-file /home/texlive/.gnupg/passphrase \
--local-user 0x06BAB6BC "
-gpgmainopts="--armor --detach-sign"
+gpg_sign_opts="--armor --detach-sign"
-# use the environment variables if available
-if test -n "$TL_GNUPG" ; then
- prg=$TL_GNUPG
+# use the environment variables if set. This is for testing;
+# we don't define them in normal usage.
+if test -n "$TL_GNUPG"; then
+ gpg_prog=$TL_GNUPG
fi
-if test -n "$TL_GNUPGOPTS" ; then
- gpgopts=$TL_GNUPGOPTS
+if test -n "$TL_GNUPGOPTS"; then
+ gpg_opts=$TL_GNUPGOPTS
fi
-if test -n "$TL_GNUPGMAINOPTS" ; then
- gpgmainopts=$TL_GNUPGMAINOPTS
+if test -n "$TL_GNUPG_SIGN_OPTS"; then
+ gpg_sign_opts=$TL_GNUPG_SIGN_OPTS
fi
-# sign, check that result doesn't use something expired.
+# sign, check that result is valid and doesn't use something expired.
# both --detach-sign and --verify exit 0 even when something is expired.
-if "$prg" $gpgmainopts $gpgopts "$1"; then
- if "$prg" --verify "$1".asc 2>&1 | grep xpired >/dev/null; then
- echo "$0: expired key, output from $prg --verify $1.asc:" >&2
- "$prg" --verify "$1".asc
- echo "$0: expired key, moving $1.asc to $1.asc.xpir." >&2
- mv "$1".asc "$1".asc.xpir || exit 1
- echo "$0: gpg command was:" >&2
- echo "$0:" "$prg" $gpgmainopts $gpgopts "$1" >&2
- echo "$0: good luck and goodbye." >&2
+if $gpg_prog $gpg_sign_opts $gpg_opts "$1"; then
+ status_out=`mktemp`
+ verify_out=`mktemp`
+ verify_cmd="$gpg_prog $gpg_opts --status-file=$status_out --verify --verbose"
+ if $verify_cmd "$1".asc >$verify_out 2>&1; then
+ if grep EXPKEYSIG $status_out >/dev/null; then
+ err="expired key"
+ elif grep REVKEYSIG $status_out >/dev/null; then
+ err="revoked key"
+ else
+ err= # ok we hope
+ fi
+ else
+ err="other error ($?)"
+ fi
+ if test -n "$err"; then
+ echo "$0: gpg verification failed." >&2
+ if test -r "$1".asc; then
+ echo "$0: moving $1.asc to $1.asc.badv." >&2
+ mv "$1".asc "$1".asc.badv || exit 1
+ else
+ echo "$0: no file $1.asc" >&2
+ fi
+ echo "$0: gpg verify command was:" >&2
+ echo "$0: $verify_cmd" "$1" >&2
+ echo "$0: STATUS FILE OUTPUT:" >&2
+ cat $status_out >&2
+ echo "$0: -------------------" >&2
+ echo "$0: STDOUT/STDERR:" >&2
+ cat $verify_out >&2
+ echo "$0: -------------------" >&2
+ echo "$0: goodbye and good luck." >&2
+ rm -f $status_out $verify_out
exit 1
fi
-else
- echo "$0: gpg failed, exiting." >&2
+ rm -f $status_out $verify_out
+
+else # the original gpg run failed.
+ echo "$0: gpg signing failed." >&2
+ if test -r "$1".asc; then
+ echo "$0: moving $1.asc to $1.asc.bads." >&2
+ mv "$1".asc "$1".asc.bads || exit 1
+ else
+ echo "$0: no file $1.asc" >&2
+ fi
echo "$0: gpg command was:" >&2
- echo "$0:" "$prg" $gpgmainopts $gpgopts "$1" >&2
+ echo "$0: $gpg_prog $gpg_sign_opts $gpg_opts" "$1" >&2
+ echo "$0: goodbye and good luck." >&2
exit 1
fi
diff --git a/Master/tlpkg/gpg/tl-key-extension.txt b/Master/tlpkg/gpg/tl-key-extension.txt
index 0ceeab2c69d..6c4569a410f 100644
--- a/Master/tlpkg/gpg/tl-key-extension.txt
+++ b/Master/tlpkg/gpg/tl-key-extension.txt
@@ -43,7 +43,17 @@ svn/git commit
# texlive.asc, see above how to export it)
gpg --homedir ~texlive/.gnupg --import texlive.asc
+# can view that .asc with:
+gpg --show-keyring texlive.asc
+
+# update web-accessible public key, keeping old files but updating symlink:
+cp texlive.asc ~www/texlive/files/texlive`date +%Y`.asc
+ln -s texlive`date +%Y`.asc ~www/texlive/files/texlive.asc
More info:
-. we use tlpkg/bin/tl-sign-file to sign texlive.tlpdb.
-. gpg --verify --verbose foo.asc for info on signature of file.
+. we use tlpkg/bin/tl-sign-file to sign texlive.tlpdb.sha512.
+. gpg --verify --verbose foo.asc for info on signature file.
+. but exit status is zero even with expired keys; to check,
+ use --status-file and inspect:
+gpg --verify --verbose --status-file=/tmp/st foo.asc
+. see tl-sign-file or TLCrypto.pm for full implementation.