continue despite missing pubkey, report details for failed verification

git-svn-id: svn://tug.org/texlive/trunk@40898 c570f23f-e606-0410-a88d-b1316a301751

1 files changed, 17 insertions, 5 deletions

diff --git a/Master/tlpkg/TeXLive/TLCrypto.pm b/Master/tlpkg/TeXLive/TLCrypto.pm
index ecfb7797dc7..f604b2b4f39 100644
--- a/Master/tlpkg/TeXLive/TLCrypto.pm
+++ b/Master/tlpkg/TeXLive/TLCrypto.pm
@@ -203,8 +203,8 @@ Verifies that C<$file> has checksum C<$checksum_url>, and if gpg is
 available also verifies that the checksum is signed.
 
 Returns 0 on success, -1 on connection error, -2 on missing signature
-file, -3 if no gpg program is available, 1 on checksum,
-and 2 on signature errors.
+file, -3 if no gpg program is available, -4 if the pubkey is not
+available,  1 on checksum errors, and 2 on signature errors.
 In case of errors returns an informal message as second argument.
 
 =cut
@@ -363,7 +363,7 @@ Verifies a download of C<$url> into C<$file> by cheking the
 gpg signature in C<$url.asc>.
 
 Returns 0 on success, -2 on missing signature file, 2 on signature error,
-and -3 if no gpg is available.
+-3 if no gpg is available, and -4 if a pubkey is missing.
 In case of errors returns an informal message as second argument.
 
 =cut
@@ -378,10 +378,12 @@ sub verify_signature {
       = TeXLive::TLUtils::download_to_temp_or_file($signature_url);
     if ($signature_file) {
       my ($ret, $out) = gpg_verify_signature($file, $signature_file);
-      if ($ret) {
+      if ($ret == 1) {
         # no need to show the output
         debug("cryptographic signature of $url verified\n");
         return(0);
+      } elsif ($ret == -1) {
+        return(-4, $out);
       } else {
         return(2, <<GPGERROR);
 cryptographic signature verification of
@@ -423,12 +425,22 @@ sub gpg_verify_signature {
   }
   $file_quote = TeXLive::TLUtils::quotify_path_with_spaces ($file);
   $sig_quote = TeXLive::TLUtils::quotify_path_with_spaces ($sig);
+  my ($status_fh, $status_file) = File::Temp::tempfile(UNLINK => 1);
+  close($status_fh);
   my ($out, $ret)
-    = TeXLive::TLUtils::run_cmd("$::gpg --verify $sig_quote $file_quote 2>&1");
+    = TeXLive::TLUtils::run_cmd("$::gpg --status-file \"$status_file\" --verify $sig_quote $file_quote 2>&1");
   if ($ret == 0) {
     debug("verification succeeded, output:\n$out\n");
     return (1, $out);
   } else {
+    open($status_fd, "<", $status_file) || die("Cannot open status file: $!");
+    while (<$status_fd>) {
+      if (m/^\[GNUPG:\] NO_PUBKEY (.*)/) {
+        close($status_fd);
+        debug("missing pubkey $1\n");
+        return (-1, "missing pubkey $1");
+      }
+    }
     return (0, $out);
   }
 }