glossaries (8may16)

git-svn-id: svn://tug.org/texlive/trunk@40959 c570f23f-e606-0410-a88d-b1316a301751

3 files changed, 315 insertions, 224 deletions

diff --git a/Build/source/texk/texlive/linked_scripts/epspdf/epspdf.tlu b/Build/source/texk/texlive/linked_scripts/epspdf/epspdf.tlu
index 7a7c2d78a97..709a2d9b691 100755
--- a/Build/source/texk/texlive/linked_scripts/epspdf/epspdf.tlu
+++ b/Build/source/texk/texlive/linked_scripts/epspdf/epspdf.tlu
@@ -7,9 +7,10 @@ kpse.set_program_name('texlua')
 -- 0.6.0: first texlua version
 -- 0.6.1: allow TeX installation on path with spaces
 -- 0.6.2: compatibility fix for luatex 0.81
+-- 0.6.3: compatibility fixes for luatex 0.9x
 
-ep_version = '0.6.2'
-ep_copyright = '2006, 2008, 2009, 2010, 2011, 2013, 2014, 2015'
+ep_version = '0.6.3'
+ep_copyright = '2006, 2008, 2009, 2010, 2011, 2013, 2014, 2015, 2016'
 
 --[[
 
@@ -58,15 +59,6 @@ POSSIBLE EXTENSIONS
 
 -- some general utilities and globals ---------------------------
 
---[[
-
-Simple-minded error handling. At most, we call a function which
-tries to write the error message to log before re-raising the error.
-
-When run from the Tcl/Tk gui, this gui will capture error messages.
-
---]]
-
 -- early initializations
 
 eol = false
@@ -88,9 +80,12 @@ from_gui = false -- whether epspdf is run from the epspsdtk gui
 
 cwd = ''
 
--- Windows: miktex, TL or neither
+-- Windows: miktex, TL or neither.
+-- Actual values determined during system-dependent initialization
 is_miktex = false
 is_tl_w32 = false
+-- recent versions of miktex include pdftops
+auto_psp = true -- configuration of pdftops_prog not needed or not allowed
 
 -- some global file- and directory names
 gs_prog = false
@@ -128,6 +123,7 @@ function print_log(s)
     print(s) -- intercepted by the gui
   end
 end
+
 function write_log(s)
     print_log(string.format('%s %s',
         os.date('%Y/%m/%d %H:%M:%S', os.time()), s))
@@ -139,6 +135,11 @@ end
 
 -- error- and debug -------------------------
 
+-- Simple-minded error handling. At most, we call a function which
+-- tries to write the error message to log before re-raising the error.
+
+-- When run from the Tcl/Tk gui, this gui will capture error messages.
+
 function errror(mess)
   if logfile then pcall(write_log, mess) end
   -- ignore result of pcall: we can do nothing about failure
@@ -598,8 +599,8 @@ function write_settings (file)
     end
   else -- stdout to be captured by epspdftk
     f = io.output()
-    if os.type=='windows' and not is_tl_w32 then
-      f:write('tl_w = no', eol)
+    if os.type=='windows' and not auto_psp then
+      f:write('psp_config = yes', eol)
     end
   end
   for k, v in pairs(settings) do
@@ -732,7 +733,7 @@ end
 
 -- boundingboxes ---------------------------------------------------
 
--- Bb.coords names now same as those of epdf PDFRectangle
+-- [HR]Bb.coords names now same as those of epdf PDFRectangle
 
 Bb = {}
 Bb.coords = {'x1', 'y1', 'x2', 'y2'}
@@ -777,7 +778,7 @@ function Bb:from_comment(s)
   return Bb:from_rect(b)
 end
 
---[[
+--[[ some no-longer-used bbox functions
 
 function Bb:copy ()
   local b = {}
@@ -807,7 +808,7 @@ function Bb:expand ()
   end
 end
 
--- no longer used: gs handles this
+-- gs handles this now
 -- call this via pcall
 function Bb:wrapper()
   local fn = mktemp('ps')
@@ -1424,7 +1425,7 @@ function PsPdf:eps_crop()
   return psp
 end -- eps_crop
 
---[===[ real conversions involving a single call of gs or pdftops --------
+--[===[ real conversions involving a single call of gs, pdftops or texlua
 
 Each conversion fullfills all options that it can: gray, bbox and
 page. gray when converting to pdf, bbox when converting from eps or
@@ -1458,38 +1459,43 @@ function PsPdf:pdf_crop()
     errror('PsPdf:pdf_crop called with non-existent page '.. options.page)
   end
   local pg = options.page or 1
-  local bb, hrbb
-  if options.bbox then
-    bb, hrbb = self:bb_from_gs(pg)
-  else
-    -- dbg('about to use epdf')
-    -- use [Trim|Crop|Media]Box instead
-    -- if os.type=='windows' then waitasec() end
-    local dummy = epdf.open(self.path)
-    -- if os.type=='windows' then waitasec() end
-    if not dummy then
+  local bb, hrbb, pgbox, pgboxname
+  do
+    local pdoc, pcat, ppage
+    -- we already have the pages, miver and maver properties
+    -- but need properties of the desired page as well
+    pdoc = epdf.open(self.path)
+    if not pdoc then
       errror('Epdf: cannot open '..self.path)
     end
     -- dbg('about to get catalog')
-    dummy = dummy:getCatalog()
-    if not dummy then
+    pcat = pdoc:getCatalog()
+    if not pcat then
       errror('Cannot open catalog of '..self.path)
     end
     -- dbg('got catalog')
-    dummy = dummy:getPage(pg)
-    if not dummy then
+    ppage = pcat:getPage(pg)
+    if not ppage then
       errror('Epdf: cannot open page object '..tostring(pg)..' of '..self.path)
     end
-    hrbb = dummy:getTrimBox()
-    if not hrbb then
-      hrbb = dummy:getCropBox()
+    pgboxname = 'trimbox'
+    pgbox = ppage:getTrimBox()
+    if not pgbox then
+      pgboxname = 'cropbox'
+      pgbox = ppage:getCropBox()
     end
-    if not hrbb then
-      hrbb = dummy:getMediaBox()
+    if not pgbox then
+      pgboxname = 'mediabox'
+      pgbox = ppage:getMediaBox()
     end
-    -- further checks, including for non-nil, by Bb:from_rect,
-    -- which errors out on failures
-    hrbb = HRBb:from_rect(hrbb)
+    -- normalization and further checks, including for non-nil,
+    -- by Bb:from_rect, which errors out on failures
+    pgbox = HRBb:from_rect(pgbox)
+  end
+  if options.bbox then
+    bb, hrbb = self:bb_from_gs(pg)
+  else
+    hrbb = pgbox
   end
 
   -- luatex on searchpath
@@ -1497,115 +1503,53 @@ function PsPdf:pdf_crop()
 
   -- write TeX file which includes cropped pdf page
   -- adapted from Heiko Oberdiek's pdfcrop utility.
-  -- first, create a table with the component strings for the tex source
-  dummy = {}
-  dummy[1] = [[
-\catcode37 14 % percent
-\catcode33 12 % exclam
-\catcode34 12 % quote
-\catcode35  6 % hash
-\catcode39 12 % apostrophe
-\catcode40 12 % left parenthesis
-\catcode41 12 % right parenthesis
-\catcode45 12 % minus
-\catcode46 12 % period
-\catcode60 12 % less
-\catcode61 12 % equals
-\catcode62 12 % greater
-\catcode64 12 % at
-\catcode91 12 % left square
-\catcode93 12 % right square
-\catcode96 12 % back tick
-\catcode123 1 % left curly brace
-\catcode125 2 % right curly brace
-\catcode126 12 % tilde
-\catcode`\#=6 %
-\escapechar=92 %
-\def\IfUndefined#1#2#3{%
-  \begingroup\expandafter\expandafter\expandafter\endgroup
-  \expandafter\ifx\csname#1\endcsname\relax
-    #2%
-  \else
-    #3%
-  \fi
-}
-
-% future modification: \pdfoutput => \outputmode
-\begingroup\expandafter\expandafter\expandafter\endgroup
-  \expandafter\ifx\csname pdfoutput\endcsname\relax
-  \let\pdfoutput \outputmode
-\fi
-
-\begingroup
-  \newlinechar=10 %
-  \endlinechar=\newlinechar %
-  \ifnum0%
-      \directlua{%
-        if tex.enableprimitives then
-          tex.enableprimitives('TEST', {
-            'luatexversion',
-            'pdfoutput',
-            'pdfcompresslevel',
-            'pdfhorigin',
-            'pdfvorigin',
-            'pagewidth',
-            'pageheight',
-            'pdfmapfile',
-            'pdfximage',
-            'pdflastximage',
-            'pdfrefximage',
-            'pdfminorversion',
-            'pdfobjcompresslevel',
-          })
-          tex.print('1')
-        end
-      }%
-      \ifx\TESTluatexversion\UnDeFiNeD\else 1\fi %
-      =11 %
-    \global\let\luatexversion\luatexversion %
-    \global\let\pdfoutput\TESTpdfoutput %
-    \global\let\pdfcompresslevel\TESTpdfcompresslevel %
-    \global\let\pdfhorigin\TESTpdfhorigin %
-    \global\let\pdfvorigin\TESTpdfvorigin %
-    \global\let\pagewidth\TESTpagewidth %
-    \global\let\pageheight\TESTpageheight %
-    \global\let\pdfmapfile\TESTpdfmapfile %
-    \global\let\pdfximage\TESTpdfximage %
-    \global\let\pdflastximage\TESTpdflastximage %
-    \global\let\pdfrefximage\TESTpdfrefximage %
-    \global\let\pdfminorversion\TESTpdfminorversion %
-    \global\let\pdfobjcompresslevel\TESTpdfobjcompresslevel %
-  \else %
-    \errmessage{%
-      Missing \string\luatexversion %
-    }%
-  \fi %
-\endgroup %
-
-\pdfoutput=1 %
-\pdfcompresslevel=9 %
-\csname pdfmapfile\endcsname{}
-\def\setpdfversion#1#2{%
-  \ifnum#2>1 %
-    \pdfobjcompresslevel=2 %
-    % including unsupported pdf version!
-    \pdfinclusionerrorlevel=0
-    \pdfminorversion=9\relax
-  \else
-    \ifnum#1>4 %
-      \pdfobjcompresslevel=2 %
-    \else
-      \pdfobjcompresslevel=0 %
-    \fi
-    \pdfminorversion=#1\relax
-  \fi
-}
+  -- the table `pieces' will contain the component strings for the tex source
+  -- first, for texlua <= 0.81
+  local pieces = {}
+  if status.luatex_version <= 80 then
+    pieces[1] = '\\pdfoutput=1\n'
+  else
+    pieces[1] = [[
+\edef\pdfminorversion {\pdfvariable minorversion}
+\edef\pdfcompresslevel {\pdfvariable compresslevel}
+\edef\pdfobjcompresslevel {\pdfvariable objcompresslevel}
+\edef\pdfdecimaldigits {\pdfvariable decimaldigits}
+\edef\pdfhorigin {\pdfvariable horigin}
+\edef\pdfvorigin {\pdfvariable vorigin}
+\let\pdfpagewidth\pagewidth
+\let\pdfpageheight\pageheight
+\let\pdfximage\saveimageresource
+\let\pdfrefximage\useimageresource
+\let\pdflastximage\lastsavedimageresourceindex
+
+\outputmode=1
+]]
+  end
+  if self.maver > 1 then
+    pieces[2] = '\\pdfminorversion=9\n'
+  else
+    pieces[2] = '\\pdfminorversion=' .. self.miver .. '\n'
+  end
+  if self.maver > 1 or self.miver > 4 then
+    pieces[3] = [[
+\pdfcompresslevel=9
+\pdfobjcompresslevel=2
+\pdfdecimaldigits=4
+]]
+  else
+    pieces[3] = [[
+\pdfcompresslevel=9
+\pdfobjcompresslevel=0
+\pdfdecimaldigits=4
+]]
+  end
+  pieces[4] = [[
 \def\page #1 [#2 #3 #4 #5]{%
   \count0=#1\relax
   \setbox0=\hbox{%
     \pdfximage page #1 mediabox{]]
-  dummy[2] = self.path
-  dummy[3] = [[}%
+  pieces[5] = self.path
+  pieces[6] = [[}%
     \pdfrefximage\pdflastximage
   }%
   \pdfhorigin=-#2bp\relax
@@ -1618,33 +1562,19 @@ function PsPdf:pdf_crop()
   \shipout\box0\relax
 }
 ]]
-  -- pdf minor version to write to tex header
-  local tex_miver = false
-  if settings.pdf_version=='default' then
-    tex_miver = self.miver
-  else
-    -- in this case, gs should already have converted to
-    -- a sufficiently low version
-    tex_miver = tonumber(settings.pdf_version)
-    if tex_miver>self.miver then
-      errror('Pdf_crop: forgot to reduce pdf version')
-    end
-  end
-  dummy[4] = string.format([[
-\setpdfversion{%d}{%d}
+  pieces[7] = string.format([[
 \page %d [%f %f %f %f]
 \csname @@end\endcsname
 \end
 ]],
-  tex_miver, self.maver, options.page or 1,
-  hrbb.x1, hrbb.y1, hrbb.x2, hrbb.y2)
+  options.page or 1, hrbb.x1, hrbb.y1, hrbb.x2, hrbb.y2)
 
-  local textemp = mktemp('tex') -- this also takes care of pdf:
+  local textemp = mktemp('tex') -- this also took care of pdf:
   local pdftemp = string.gsub(textemp, 'tex$', 'pdf')
   -- if os.type=='windows' then waitasec() end
   local f = io.open(textemp, 'w')
   -- if os.type=='windows' then waitasec() end
-  f:write(table.concat(dummy, ''))
+  f:write(table.concat(pieces, ''))
   f:close()
   local cmd, res, psp
   if os.type=='unix' then
@@ -2137,10 +2067,12 @@ if os.type == 'windows' then cwd = string.gsub(cwd, '\\', '/') end
 -- prepend (lua)tex directory to searchpath, if not already there
 maybe_add_path(os.selfdir, false)
 
--- Windows: miktex, TL or neither
+-- Windows: miktex, TL or neither. is_miktex, is_tl_w32, auto_psp
 -- no support yet for separate ghostscript
 is_miktex = false
 is_tl_w32 = false
+auto_psp = true -- only false for old miktex without included pdftops
+
 if os.type == 'windows' then
   if string.find (string.lower(kpse.version()), 'miktex') then
     is_miktex = true
@@ -2164,6 +2096,10 @@ if os.type == 'windows' then
           '/release-texlive.txt; TeX installation not supported.', 0)
     end -- if isfile
   end -- if not miktex
+  -- recent miktex and any windows tl include pdftops
+  if not lfs.isfile(string.gsub(os.selfdir, '\\', '/') .. '/pdftops.exe') then
+    auto_psp = false
+  end
 end -- if windows
 
 -- without Ghostscript we are dead in the water.
@@ -2275,7 +2211,8 @@ settings.use_hires_bb = false
 -- it will not be used for TeX Live and only be read and written on Windows.
 
 settings.pdftops_prog = false
-descriptions.pdftops_prog = 'Full path to pdftops.exe (not used with TeX Live)'
+descriptions.pdftops_prog =
+  'Full path to pdftops.exe (not used if TeX bin dir contains pdftops)'
 
 settings.use_pdftops = true
 descriptions.use_pdftops = 'Use pdftops if available'
@@ -2408,7 +2345,7 @@ do -- main program
       help = descriptions.pdf_version
     }
 
-    if os.type=='windows' and not is_tl_w32 then
+    if os.type=='windows' and not auto_psp then
       opts.pdftops_prog = {
         type = 'string', val = nil,
         forms = {'--pdftops'},
@@ -2497,7 +2434,7 @@ do -- main program
          'pdftops_prog', 'use_pdftops', 'save', 'info', 'debug',
          'version', 'help'}) do
         local v = opts[o]
-        if v~='pdftops_prog' or is_miktex then
+        if v~='pdftops_prog' or not auto_psp then
           if v and v.help then
             local synt = join(v.forms, ', ')
             if v.type ~= 'boolean' then synt = synt .. ' ' .. v.placeholder end
@@ -2518,7 +2455,7 @@ do -- main program
               end
             end
           end
-        end -- ~=pdftops_prog or is_miktex
+        end -- ~=pdftops_prog or not auto_psp
       end -- for
       if mess then os.exit(1) else os.exit() end
     end -- help
@@ -2660,13 +2597,13 @@ do -- main program
     -- pdftops program; pdftops has already been been initialized to false
 
     -- pdftops_prog as command-line option
-    if os.type=='windows' and not is_tl_w32 and opts.pdftops_prog.val then
+    if os.type=='windows' and not auto_psp and
+        opts.pdftops_prog.val then
       settings.pdftops_prog = is_prog(opts.pdftops_prog.val)
     end
 
-    -- pdftops should be on the path.
-    -- for miktex, make it so if possible.
-    if os.type=='windows' and not is_tl_w32 then
+    -- pdftops should be on the path. otherwise, make it so if possible.
+    if os.type=='windows' and not auto_psp then
       if settings.use_pdftops then
         pdftops = is_prog(settings.pdftops_prog)
         if pdftops then
@@ -2700,7 +2637,7 @@ do -- main program
       help()
     end
 
-    -- opts.info.val: need to get infile first
+    -- opts.info.val: do later; need to get infile first
 
     if opts.version.val then
       show_version()
diff --git a/Build/source/texk/texlive/linked_scripts/epspdf/epspdftk.tcl b/Build/source/texk/texlive/linked_scripts/epspdf/epspdftk.tcl
index e28118853f3..7e4a7bc4c3c 100755
--- a/Build/source/texk/texlive/linked_scripts/epspdf/epspdftk.tcl
+++ b/Build/source/texk/texlive/linked_scripts/epspdf/epspdftk.tcl
@@ -3,7 +3,7 @@
 # epspdf conversion utility, GUI frontend
 
 #####
-# Copyright (C) 2006, 2008, 2009, 2010, 2011, 2013, 2014, 2015 Siep Kroonenberg
+# Copyright (C) 2006, 2008, 2009, 2010, 2011, 2013, 2014, 2015, 2016 Siep Kroonenberg
 # n dot s dot kroonenberg at rug dot nl
 #
 # This program is free software, licensed under the GNU GPL, >=2.0.
@@ -95,7 +95,8 @@ proc is_prog {x} {
 # create a global empty settings array
 array set ::settings [list]
 
-set ::is_tl 1
+# windows: pdftops from tex distro?
+set ::psp_config 0
 
 # ask epspdf.tlu for currently configured settings.
 # this does not include automatically configured or transient settings.
@@ -107,7 +108,7 @@ proc getsettings {} {
   # write_log "settings from epspdf.tlu:\n$set_str\n"
   set l [split $set_str "\r\n"]
   if {$::tcl_platform(platform) eq "windows"} {
-    set ::is_tl 1
+    set ::psp_config 0
     set settings(pdftops_prog) ""
   }
   foreach e $l {
@@ -121,8 +122,8 @@ proc getsettings {} {
       set val [string trim [string range $e [expr $i+1] end]]
       if {$val eq "true"} {set val 1}
       if {$val eq "false"} {set val 0}
-      if {$para eq "tl_w"} {
-        set ::is_tl 0
+      if {$para eq "psp_config"} {
+        set ::psp_config 1
         write_log "TL for Windows not detected by epspdf"
       } else {
         set ::settings($para) $val
@@ -503,7 +504,7 @@ spacing .config_t
 packf [frame .config_t.psf] -ipadx 4 -fill x
 pack [label .config_t.psf.l_ps -text "Conversion to EPS and PostScript" \
           -font boldfont] -anchor w
-if {! $::is_tl} {
+if { $::psp_config} {
   if {[string tolower [string range $::settings(pdftops_prog) end-3 end]] ne \
           ".exe"} {set ::settings(pdftops_prog) ""}
   pack [label .config_t.psf.l_pdftops -text "Find pdftops"] -anchor w
diff --git a/Build/source/texk/texlive/linked_scripts/texlive/tlmgr.pl b/Build/source/texk/texlive/linked_scripts/texlive/tlmgr.pl
index 244de847ad3..64f9aedc1f7 100755
--- a/Build/source/texk/texlive/linked_scripts/texlive/tlmgr.pl
+++ b/Build/source/texk/texlive/linked_scripts/texlive/tlmgr.pl
@@ -1,13 +1,13 @@
 #!/usr/bin/env perl
-# $Id: tlmgr.pl 40844 2016-05-02 23:46:44Z karl $
+# $Id: tlmgr.pl 40915 2016-05-06 10:04:53Z preining $
 #
 # Copyright 2008-2016 Norbert Preining
 # This file is licensed under the GNU General Public License version 2
 # or any later version.
 #
 
-my $svnrev = '$Revision: 40844 $';
-my $datrev = '$Date: 2016-05-03 01:46:44 +0200 (Tue, 03 May 2016) $';
+my $svnrev = '$Revision: 40915 $';
+my $datrev = '$Date: 2016-05-06 12:04:53 +0200 (Fri, 06 May 2016) $';
 my $tlmgrrevision;
 my $prg;
 if ($svnrev =~ m/: ([0-9]+) /) {
@@ -214,6 +214,10 @@ my %action_specification = (
     "run-post" => 1,
     "function" => \&action_install
   },
+  "key" => {
+    "run-post" => 0,
+    "function" => \&action_key
+  },
   "option" => { 
     "run-post" => 1,
     "function" => \&action_option
@@ -339,6 +343,7 @@ sub main {
     "usermode|user-mode" => 1,
     "usertree|user-tree" => "=s",
     "verify-downloads" => "!",
+    "require-verification" => "!",
     "version" => 1,
   );
 
@@ -378,9 +383,9 @@ sub main {
 
   $action = shift @ARGV;
   if (!defined($action)) {
-    if ($opts{"gui"}) {			# -gui = gui
+    if ($opts{"gui"}) {   # -gui = gui
       $action = "gui";
-    } elsif ($opts{"print-platform"}) {	# -print-arch = print-arch
+    } elsif ($opts{"print-platform"}) { # -print-arch = print-arch
       $action = "print-platform";
     } else {
       $action = "";
@@ -594,31 +599,14 @@ for the full story.\n";
   $::no_execute_actions = 1 if (defined($opts{'no-execute-actions'}));
 
   # if we are asked to use persistent connections try to start it here
-  {
-    my $do_persistent;
-    if (defined($opts{'persistent-downloads'})) {
-      # a command line argument for persistent-downloads has been given,
-      # either with --no-... or --... that overrides any other setting
-      $do_persistent = $opts{'persistent-downloads'};
-    } else {
-      # check if it is set in the config file
-      if (defined($config{'persistent-downloads'})) {
-        $do_persistent = $config{'persistent-downloads'};
-      }
-    }
-    # default method is doing persistent downloads:
-    if (!defined($do_persistent)) {
-      $do_persistent = 1;
-    }
-    ddebug("tlmgr:main: do persistent downloads = $do_persistent\n");
-    if ($do_persistent) {
-      TeXLive::TLUtils::setup_persistent_downloads() ;
-    }
-    if (!defined($::tldownload_server)) {
-      debug("tlmgr:main: ::tldownload_server not defined\n");
-    } else {
-      debug("tlmgr:main: ::tldownload_server defined\n");
-    }
+  debug("tlmgr:main: do persistent downloads = $opts{'persistent-downloads'}\n");
+  if ($opts{'persistent-downloads'}) {
+    TeXLive::TLUtils::setup_persistent_downloads() ;
+  }
+  if (!defined($::tldownload_server)) {
+    debug("tlmgr:main: ::tldownload_server not defined\n");
+  } else {
+    debug("tlmgr:main: ::tldownload_server defined\n");
   }
 
   my $ret = execute_action($action, @ARGV);
@@ -5630,6 +5618,92 @@ sub texconfig_conf_mimic {
 }
 
 
+# Action key
+#
+# general key management
+#
+# tlmgr key list
+# tlmgr key add <filename>
+# tlmgr key delete <keyid>
+sub action_key {
+  my $arg = shift @ARGV;
+
+
+
+  if (!defined($arg)) {
+    tlwarn("missing arguments to action `key'\n");
+    return $F_ERROR;
+  }
+
+  $arg = lc($arg);
+  if ($arg =~ /^(add|delete|list)$/) {
+    handle_gpg_config_settings();
+    if (!$::gpg) {
+      tlwarn("gnupg is not found or setup, cannot continue with action `key'\n");
+      return $F_ERROR;
+    }
+    chomp (my $TEXMFSYSCONFIG = `kpsewhich -var-value=TEXMFSYSCONFIG`);
+    my $local_keyring = "$Master/tlpkg/gpg/repository-keys.gpg";
+    if ($arg eq 'list') {
+      debug("running $::gpg --list-keys\n");
+      system("$::gpg --list-keys");
+      return $F_OK;
+    } elsif ($arg eq 'delete') {
+      my $what = shift @ARGV;
+      if (!$what) {
+        tlwarn("missing argument to `key add'\n");
+        return $F_ERROR;
+      }
+      # we need to make sure that $local_keyring is existent!
+      if (! -r $local_keyring) {
+        tlwarn("no local keyring available, cannot delete anything!\n");
+        return $F_ERROR;
+      }
+      debug("running: $::gpg --primary-keyring repository-keys.gpg  --delete-key $what\n");
+      my ($out, $ret) = 
+          TeXLive::TLUtils::run_cmd("$::gpg --primary-keyring repository-keys.gpg --delete-key \"$what\" 2>&1");
+      if ($ret == 0) {
+        info("key successfully removed\n");
+        return $F_OK;
+      } else {
+        tlwarn("key removal failed, output:\n$out\n");
+        return $F_ERROR;
+      }
+      
+    } elsif ($arg eq 'add') {
+      my $what = shift @ARGV;
+      if (!$what) {
+        tlwarn("missing argument to `key add'\n");
+        return $F_ERROR;
+      }
+      # we need to make sure that $local_keyring is existent!
+      if (! -r $local_keyring) {
+        open(FOO, ">$local_keyring") || die("Cannot create $local_keyring: $!");
+        close(FOO);
+      }
+      debug("running: $::gpg --primary-keyring repository-keys.gpg  --import $what\n");
+      my ($out, $ret) = 
+          TeXLive::TLUtils::run_cmd("$::gpg --primary-keyring repository-keys.gpg  --import \"$what\" 2>&1");
+      if ($ret == 0) {
+        info("key successfully imported\n");
+        return $F_OK;
+      } else {
+        tlwarn("key import failed, output:\n$out\n");
+        return $F_ERROR;
+      }
+    } else {
+      tldie("should not be reached: tlmgr key $arg\n");
+    }
+    
+  } else {
+    tlwarn("unknown directive `$arg' to action `key'\n");
+    return $F_ERROR;
+  }
+  return $F_OK;
+}
+
+
+
 # Subroutines galore.
 #
 # set global $location variable.
@@ -5843,14 +5917,24 @@ END_NO_CHECKSUMS
   # depend on it:
   print "location-url\t$locstr\n" if $::machinereadable;
   info("$prg: package repositories\n");
+  my $verstat = "";
+  if (!$remotetlpdb->virtual_get_tlpdb('main')->is_verified) {
+    $verstat = ": ";
+    $verstat .= $remotetlpdb->virtual_get_tlpdb('main')->verification_status;
+  }
   info("\tmain = " . $repos{'main'} . " (" . 
     ($remotetlpdb->virtual_get_tlpdb('main')->is_verified ? "" : "not ") .
-    "verified)\n");
+    "verified$verstat)\n");
   for my $t (@tags) {
     if ($t ne 'main') {
+      $verstat = "";
+      if (!$remotetlpdb->virtual_get_tlpdb($t)->is_verified) {
+        $verstat = ": ";
+        $verstat .= $remotetlpdb->virtual_get_tlpdb($t)->verification_status;
+      }
       info("\t$t = " . $repos{$t} . " (" .
         ($remotetlpdb->virtual_get_tlpdb($t)->is_verified ? "" : "not ") .
-        "verified)\n");
+        "verified$verstat)\n");
     }
   }
   return 1;
@@ -5881,14 +5965,18 @@ sub _init_tlmedia {
     return(0, $errormsg);
   }
 
-
   # this "location-url" line should not be changed since GUI programs
   # depend on it:
   if ($::machinereadable) {
     print "location-url\t$location\n";
   } else {
+    my $verstat = "";
+    if (!$remotetlpdb->is_verified) {
+      $verstat = ": ";
+      $verstat .= $remotetlpdb->verification_status;
+    }
     info("$prg: package repository $location (" . 
-      ($remotetlpdb->is_verified ? "" : "not ") . "verified)\n");
+      ($remotetlpdb->is_verified ? "" : "not ") . "verified$verstat)\n");
   }
   return 1;
 }
@@ -5951,17 +6039,20 @@ END_NO_INTERNET
         $local_copy_tlpdb_used = 1;
       } elsif ($ret == -2) {
         # the remote database has not be signed, warn
-        debug("$0: remote database is not signed, continuing anyway!\n");
+        debug("$prg: remote database is not signed, continuing anyway!\n");
       } elsif ($ret == -3) {
         # no gpg available
-        debug("$0: no gpg available for verification, continuing anyway!\n");
+        debug("$prg: no gpg available for verification, continuing anyway!\n");
+      } elsif ($ret == -4) {
+        # pubkey missing
+        debug("$prg: $msg, continuing anyway!\n");
       } elsif ($ret == 1) {
         # no problem, checksum is wrong, we need to get new tlpdb
       } elsif ($ret == 2) {
         # umpf, signature error
         # TODO should we die here? Probably yes because one of 
         # checksum file or signature file has changed!
-        tldie("$0: verification of checksum for $location failed: $msg\n");
+        tldie("$prg: verification of checksum for $location failed: $msg\n");
       } elsif ($ret == 0) {
         $remotetlpdb = TeXLive::TLPDB->new(root => $location,
           tlpdbfile => $loc_copy_of_remote_tlpdb);
@@ -5969,7 +6060,7 @@ END_NO_INTERNET
         # we did verify this tlpdb, make sure that is recorded
         $remotetlpdb->is_verified(1);
       } else {
-        tldie("$0: unexpected return value from verify_checksum: $ret\n");
+        tldie("$prg: unexpected return value from verify_checksum: $ret\n");
       }
     }
   }
@@ -5979,6 +6070,10 @@ END_NO_INTERNET
   if (!defined($remotetlpdb)) {
     return(undef, $loadmediasrcerror . $location);
   }
+  if ($opts{"require-verification"} && !$remotetlpdb->is_verified) {
+    tldie("Remote TeX Live database ($location) is not verified, exiting.\n");
+  }
+
   # we allow a range of years to be specified by the remote tlpdb
   # for which it might work.
   # the lower limit is TLPDB->config_minrelease
@@ -6101,13 +6196,10 @@ sub finish {
 sub load_config_file {
   #
   # first set default values
-  # the default for gui-expertmode is 1 since that is what we
-  # have shipped till now
   $config{"gui-expertmode"} = 1;
-  #
-  # by default we remove packages
   $config{"auto-remove"} = 1;
-  #
+  $config{"require-verification"} = 0;
+  $config{"persistent-downloads"} = 1;
   # do NOT set this here, we distinguish between explicitly set in the config file
   # or implicitly true
   # $config{"verify-downloads"} = 1;
@@ -6124,6 +6216,14 @@ sub load_config_file {
   $tlmgr_config_file = TeXLive::TLConfFile->new($fn, "#", "=");
   load_options_from_config($tlmgr_config_file) if $tlmgr_config_file;
 
+  # set $opts{"key"} from $config{"key"} if not passed in on cmd line
+  if (!defined($opts{"require-verification"})) {
+    $opts{"require-verification"} = $config{"require-verification"};
+  }
+  if (!defined($opts{"persistent-downloads"})) {
+    $opts{"persistent-downloads"} = $config{"persistent-downloads"};
+  }
+
   # switched names for this one after initial release.
   if ($tlmgr_config_file->key_present("gui_expertmode")) {
     $tlmgr_config_file->rename_key("gui_expertmode", "gui-expertmode");
@@ -6163,6 +6263,15 @@ sub load_options_from_config {
         tlwarn("$prg: $fn: Unknown value for auto-remove: $val\n");
       }
 
+    } elsif ($key eq "require-verification") {
+      if ($val eq "0") {
+        $config{"require-verification"} = 0;
+      } elsif ($val eq "1") {
+        $config{"require-verification"} = 1;
+      } else {
+        tlwarn("$prg: $fn: Unknown value for require-verification: $val\n");
+      }
+
     } elsif ($key eq "verify-downloads") {
       if ($val eq "0") {
         $config{"verify-downloads"} = 0;
@@ -6535,6 +6644,15 @@ Change the pinning file location from C<TEXMFLOCAL/tlpkg/pinning.txt>
 (see L</Pinning> below).  Documented only for completeness, as this is
 only useful in debugging.
 
+=item B<--require-verification>
+
+=item B<--no-require-verification>
+
+Instructs C<tlmgr> to only accept signed and verified remotes. In any
+other case C<tlmgr> will quit operation.
+See L<CRYPTOGRAPHIC VERIFICATION> below for details.
+
+
 =item B<--usermode>
 
 Activates user mode for this run of C<tlmgr>; see L<USER MODE> below.
@@ -6998,6 +7116,29 @@ C<--reinstall>, as in (using the C<fontspec> package as the example):
 
 =back
 
+=head2 key I<args>
+
+=over 4
+
+=item B<key list>
+
+=item B<key add I<what>>
+
+=item B<key remove I<keyid>>
+
+The action C<key> allows listing, adding and removing additional keys
+to the set of trusted keys, that is those that are used to verify the
+TeX Live databases. 
+
+With the C<list> argument lists all keys.
+
+The C<add> argument requires another argument, either a filename or
+C<-> for stdin, from which the key is added. The key is added to the
+local keyring C<GNUPGHOME/repository-keys.gpg>, which normally is
+C<tlpkg/gpg/repository-keys.gpg>.
+
+The C<delete> argument requires a key id and removes the requested id
+from the local keyring.
 
 =head2 option
 
@@ -7652,6 +7793,9 @@ command-line option.
 =item C<persistent-downloads>, value 0 or 1 (default 1), same as
 command-line option.
 
+=item C<require-verification>, value 0 or 1 (default 1), same as
+command-line option.
+
 =item C<verify-downloads>, value 0 or 1 (default 1), same as
 command-line option.
 
@@ -7673,7 +7817,7 @@ make sense to set this.
 
 =back
 
-The <no-checksums> key needs more explanation.  By default, package
+The C<no-checksums> key needs more explanation.  By default, package
 checksums computed and stored on the server (in the TLPDB) are compared
 to checksums computed locally after downloading.  C<no-checksums>
 disables this.
@@ -7694,7 +7838,10 @@ If a working GnuPG binary (C<gpg>) is found (see below for the search
 method), by default verification of downloaded files is performed. This
 can be suppressed by specifying C<--no-verify-downloads> on the command
 line, or adding an entry C<verify-downloads = 0> to a tlmgr config file
-(described in L<CONFIGURATION FILE FOR TLMGR>).
+(described in L<CONFIGURATION FILE FOR TLMGR>). On the other hand,
+it is possible to B<require> verification by either specifying 
+C<--require-verification> on the command line, or adding an entry
+C<require-verification = 1> to a tlmgr config file.
 
 Verification is performed as follows: For each C<texlive.tlpdb> loaded
 for a repository, the respective checksum C<texlive.tlpdb.sha512> is
@@ -7709,6 +7856,8 @@ is signed by Karl Berry's key 0x9DEB46C0 and Norbert Preining's key
 0x6CACA448.  All of these keys are obtainable from the standard key
 servers.
 
+Additional trusted keys can be added using the C<key> action.
+
 =head2 Configuration of GnuPG invocation
 
 The executable used for GnuPG is searched as follows: If the environment
@@ -7790,6 +7939,10 @@ collection-context> would install C<collection-basic> and other
 collections, while in user mode, I<only> the packages mentioned in
 C<collection-context> are installed.
 
+If a package shipping map files is installed in user mode, a backup of
+the user's C<updmap.cfg> in C<USERTREE/web2c/> is made, and then this file
+regenerated from the list of installed packages.
+
 =head2 User mode backup, restore, remove, update
 
 In user mode, these actions check that all packages to be acted on are