summaryrefslogtreecommitdiff
path: root/Master/texmf-dist/scripts
diff options
context:
space:
mode:
authorNorbert Preining <preining@logic.at>2017-11-07 23:44:28 +0000
committerNorbert Preining <preining@logic.at>2017-11-07 23:44:28 +0000
commita990ed286beea7f44b29751057ac954a4cbf27fd (patch)
tree6a9362d092b70827762ae577eff6cc5b440a0438 /Master/texmf-dist/scripts
parent9e0a9d40affe0f0901528981cab3d6d83484e044 (diff)
add more info to tlmgr man page about crypto
git-svn-id: svn://tug.org/texlive/trunk@45716 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Master/texmf-dist/scripts')
-rwxr-xr-xMaster/texmf-dist/scripts/texlive/tlmgr.pl10
1 files changed, 10 insertions, 0 deletions
diff --git a/Master/texmf-dist/scripts/texlive/tlmgr.pl b/Master/texmf-dist/scripts/texlive/tlmgr.pl
index 5a052686f31..831ae58ecb6 100755
--- a/Master/texmf-dist/scripts/texlive/tlmgr.pl
+++ b/Master/texmf-dist/scripts/texlive/tlmgr.pl
@@ -8554,6 +8554,13 @@ report C<(verified)> after loading the TLPDB; otherwise, they report
C<(not verified)>. Either way, by default the installation and/or
updates proceed normally.
+If a program C<gpg> is available (that is, it is found in the C<PATH>),
+cryptographic signatures will be checked. In this case we require that
+the main repository is signed. This is not required for additional r
+repositories. If C<gpg> is not available, signatures are not checked
+and no verification is carried out, but C<tlmgr> proceeds normally.
+This is the behavior of C<tlmgr> up to TeX Live 2016.
+
The attempted verification can be suppressed by specifying
C<--no-verify-downloads> on the command line, or the entry
C<verify-downloads = 0> in a C<tlmgr> config file (described in
@@ -8561,6 +8568,9 @@ L<CONFIGURATION FILE FOR TLMGR>). On the other hand, it is possible to
I<require> verification by specifying C<--require-verification> on the
command line, or C<require-verification = 1> in a C<tlmgr> config file;
in this case, if verification is not possible, the program quits.
+Note that as mentioned above, if C<gpg> is available, the main repository
+is always required to have a signature. Using the C<--require-verification>
+switch, C<tlmgr> also requires signatures from additional repositories.
Cryptographic verification requires checksum checking (described just
above) to succeed, and a working GnuPG (C<gpg>) program (see below for