finish support of expired key warnings

git-svn-id: svn://tug.org/texlive/trunk@50689 c570f23f-e606-0410-a88d-b1316a301751

2 files changed, 21 insertions, 12 deletions

diff --git a/Master/tlpkg/TeXLive/TLCrypto.pm b/Master/tlpkg/TeXLive/TLCrypto.pm
index fd52cc247cf..7c8848e5b15 100644
--- a/Master/tlpkg/TeXLive/TLCrypto.pm
+++ b/Master/tlpkg/TeXLive/TLCrypto.pm
@@ -57,11 +57,13 @@ BEGIN {
     %VerificationStatusDescription
     $VS_VERIFIED $VS_CHECKSUM_ERROR $VS_SIGNATURE_ERROR $VS_CONNECTION_ERROR
     $VS_UNSIGNED $VS_GPG_UNAVAILABLE $VS_PUBKEY_MISSING $VS_UNKNOWN
+    $VS_EXPKEYSIG
   );
   @EXPORT = qw(
     %VerificationStatusDescription
     $VS_VERIFIED $VS_CHECKSUM_ERROR $VS_SIGNATURE_ERROR $VS_CONNECTION_ERROR
     $VS_UNSIGNED $VS_GPG_UNAVAILABLE $VS_PUBKEY_MISSING $VS_UNKNOWN
+    $VS_EXPKEYSIG
   );
 }
 
@@ -450,12 +452,14 @@ sub verify_signature {
         }
       }
       my ($ret, $out) = gpg_verify_signature($file, $signature_file);
-      if ($ret == 1) {
+      if ($ret == $VS_VERIFIED) {
         # no need to show the output
         debug("cryptographic signature of $url verified\n");
         return($VS_VERIFIED);
-      } elsif ($ret == -1) {
+      } elsif ($ret == $VS_PUBKEY_MISSING) {
         return($VS_PUBKEY_MISSING, $out);
+      } elsif ($ret == $VS_EXPKEYSIG) {
+        return($VS_EXPKEYSIG, $out);
       } else {
         return($VS_SIGNATURE_ERROR, <<GPGERROR);
 cryptographic signature verification of
@@ -504,21 +508,23 @@ sub gpg_verify_signature {
   # read status file
   open($status_fd, "<", $status_file) || die("Cannot open status file: $!");
   my @status_lines = <$status_fd>;
+  close($status_fd);
   chomp(@status_lines);
+  debug(join("\n", "STATUS OUTPUT", @status_lines));
   if ($ret == 0) {
+    # verification still might return success but key is expired!
+    if (grep(/KEYEXPIRED/, @status_lines)) {
+      return($VS_EXPKEYSIG, "expired key");
+    }
     debug("verification succeeded, output:\n$out\n");
-    debug(join("\n", "STATUS OUTPUT", @status_lines));
-    return (1, $out);
+    return ($VS_VERIFIED, $out);
   } else {
-    open($status_fd, "<", $status_file) || die("Cannot open status file: $!");
-    while (<$status_fd>) {
-      if (m/^\[GNUPG:\] NO_PUBKEY (.*)/) {
-        close($status_fd);
-        debug("missing pubkey $1\n");
-        return (-1, "missing pubkey $1");
-      }
+    if (grep(/^\[GNUPG:\] NO_PUBKEY (.*)/, @status_lines)) {
+      debug("missing pubkey $1\n");
+      return ($VS_PUBKEY_MISSING, "missing pubkey $1");
     }
-    return (0, $out);
+    # we could do more checks on what is the actual problem here!
+    return ($VS_SIGNATURE_ERROR, $out);
   }
 }
 
diff --git a/Master/tlpkg/TeXLive/TLPDB.pm b/Master/tlpkg/TeXLive/TLPDB.pm
index a18bdfe2a81..2d6acb1d9be 100644
--- a/Master/tlpkg/TeXLive/TLPDB.pm
+++ b/Master/tlpkg/TeXLive/TLPDB.pm
@@ -406,6 +406,9 @@ sub from_file {
       } elsif ($r == $VS_PUBKEY_MISSING) {
         debug("$0: TLPDB: pubkey missing, continuing anyway!\n");
         $self->verification_status($r);
+      } elsif ($r == $VS_EXPKEYSIG) {
+        debug("$0: TLPDB: signature verified, but key expired, continuing anyway!\n");
+        $self->verification_status($r);
       } elsif ($r == $VS_VERIFIED) {
         $is_verified = 1;
         $self->verification_status($r);