work on gpg verification function

git-svn-id: svn://tug.org/texlive/trunk@40435 c570f23f-e606-0410-a88d-b1316a301751

1 files changed, 65 insertions, 1 deletions

diff --git a/Master/tlpkg/TeXLive/TLUtils.pm b/Master/tlpkg/TeXLive/TLUtils.pm
index e5da10df1d6..bd91a62f6b1 100644
--- a/Master/tlpkg/TeXLive/TLUtils.pm
+++ b/Master/tlpkg/TeXLive/TLUtils.pm
@@ -101,6 +101,7 @@ C<TeXLive::TLUtils> -- utilities used in TeX Live infrastructure
   TeXLive::TLUtils::tlmd5($path);
   TeXLive::TLUtils::tlchecksum($path);
   TeXLive::TLUtils::verify_checksum($file, $checksum);
+  TeXLive::TLUtils::verify_download($file, $url);
   TeXLive::TLUtils::compare_tlpobjs($tlpA, $tlpB);
   TeXLive::TLUtils::compare_tlpdbs($tlpdbA, $tlpdbB);
   TeXLive::TLUtils::report_tlpdb_differences(\%ret);
@@ -177,6 +178,7 @@ BEGIN {
     &tlmd5
     &tlchecksum
     &verify_checksum
+    &verify_download
     &wsystem
     &xsystem
     &run_cmd
@@ -2320,7 +2322,7 @@ sub setup_unix_one {
         debug("Using system $p (tested).\n");
       } else {
         if ($donotwarn) {
-          tldebug("$0: initialization of $p failed but ignored!\n");
+          debug("$0: initialization of $p failed but ignored!\n");
         } else {
           tlwarn("$0: Initialization failed (in setup_unix_one):\n");
           tlwarn("$0: could not find a usable $p.\n");
@@ -3657,6 +3659,68 @@ sub verify_checksum {
   return(0, "not reachable");
 }
 
+=pod
+
+=item C<< verify_download($file, $url) >>
+
+Verifies a download of C<$url> into C<$file> by checking C<$url.checksum>
+and if gpg is available, verifying that with C<$url.checksum.gpg>.
+
+Returns 1 on success, and a pair of 0 and a warning otherwise.
+
+=cut
+
+sub verify_download {
+  
+  # TODO TODO
+  # we need to set gpg parameters!!!
+
+  die("GPG PARAMEters need to be set!!!\n");
+
+  my ($file, $url) = @_;
+  # first verify digest
+  my ($ret, $msg) = verify_checksum($file, "$url.checksum");
+  return($ret,$mst) if (!$ret);
+  # next try to verify gpg
+  $ret = 1; # default for gpg download
+  if ($::progs{'gpg'}) {
+    my $gpg = new Crypt::GPG;
+    $gpg->gpgbin($::progs{'gpg'});
+    my $urlgpg = "$url.asc";
+    my ($gpg_fh, $gpg_file);
+    if ($gpg =~ m,^(http|ftp|file)://,) {
+      ($gpg_fh, $gpg_file) = tempfile();
+      # now $gpg_fh filehandle is open, the file created
+      # TLUtils::download_file will just overwrite what is there
+      # on windows that doesn't work, so we close the fh immediately
+      # this creates a short loophole, but much better than before anyway
+      close($gpg_fh);
+      $ret = download_file($urlgpg, $gpg_file);
+    } else {
+      $gpg_file = $urlgpg;
+    }
+    if ($ret && (-r "$gpg_file")) {
+      my ($plaintext, $signature) = $gpg->verify($file, $gpg_file);
+      if ($signature->validity ne "GOOD") {
+        tldie(<<GPGERROR);
+Verification of downloaded file
+  $file
+against
+  $urlgpg
+did not succeed. Please report to texlive\@tug.org
+GPGERROR
+      } else {
+        info("cryptographic signature $path verified\n");
+      }
+    } else {
+      debug("no access to cryptographic signature $urlgpg");
+    }
+  } else {
+    debug("gpg prog not defined, no checking of signatures\n");
+  }
+}
+
+
 #
 # compare_tlpobjs 
 # returns a hash