summaryrefslogtreecommitdiff
path: root/Master/tlpkg/TeXLive
diff options
context:
space:
mode:
authorNorbert Preining <preining@logic.at>2017-09-13 01:55:27 +0000
committerNorbert Preining <preining@logic.at>2017-09-13 01:55:27 +0000
commite93b2d183454ff002d8526083f8706347afd28cc (patch)
tree2e1f3d619700b8fa98711268dfc03cf09124bed1 /Master/tlpkg/TeXLive
parentb41be8e206af34f91f7336b0fc4f0621ca26a295 (diff)
crypto: use symbolic constants, require verification of main tlpdb
git-svn-id: svn://tug.org/texlive/trunk@45286 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Master/tlpkg/TeXLive')
-rw-r--r--Master/tlpkg/TeXLive/TLCrypto.pm77
-rw-r--r--Master/tlpkg/TeXLive/TLPDB.pm49
2 files changed, 86 insertions, 40 deletions
diff --git a/Master/tlpkg/TeXLive/TLCrypto.pm b/Master/tlpkg/TeXLive/TLCrypto.pm
index 877de79057a..ed54df1cc42 100644
--- a/Master/tlpkg/TeXLive/TLCrypto.pm
+++ b/Master/tlpkg/TeXLive/TLCrypto.pm
@@ -12,7 +12,7 @@ use TeXLive::TLConfig;
use TeXLive::TLUtils qw(debug ddebug win32 which platform conv_to_w32_path tlwarn tldie);
-my $svnrev = '$Revision: 40650 $';
+my $svnrev = '$Revision$';
my $_modulerevision = ($svnrev =~ m/: ([0-9]+) /) ? $1 : "unknown";
sub module_revision { return $_modulerevision; }
@@ -54,6 +54,14 @@ BEGIN {
&verify_checksum
&setup_gpg
&verify_signature
+ %VerificationStatusDescription
+ $VS_VERIFIED $VS_CHECKSUM_ERROR $VS_SIGNATURE_ERROR $VS_CONNECTION_ERROR
+ $VS_UNSIGNED $VS_GPG_UNAVAILABLE $VS_PUBKEY_MISSING $VS_UNKNOWN
+ );
+ @EXPORT = qw(
+ %VerificationStatusDescription
+ $VS_VERIFIED $VS_CHECKSUM_ERROR $VS_SIGNATURE_ERROR $VS_CONNECTION_ERROR
+ $VS_UNSIGNED $VS_GPG_UNAVAILABLE $VS_PUBKEY_MISSING $VS_UNKNOWN
);
}
@@ -216,9 +224,14 @@ sub tl_short_digest { return (Digest::MD5::md5_hex(shift)); }
Verifies that C<$file> has checksum C<$checksum_url>, and if gpg is
available also verifies that the checksum is signed.
-Returns 0 on success, -1 on connection error, -2 on missing signature
-file, -3 if no gpg program is available, -4 if the pubkey is not
-available, 1 on checksum errors, and 2 on signature errors.
+Returns
+C<$VS_VERIFIED> on success,
+C<$VS_CONNECTION_ERROR> on connection error,
+C<$VS_UNSIGNED> on missing signature file,
+C<$VS_GPG_UNAVAILABLE> if no gpg program is available,
+C<$VS_PUBKEY_MISSING> if the pubkey is not available,
+C<$VS_CHECKSUM_ERROR> on checksum errors,and
+C<$VS_SIGNATURE_ERROR> on signature errors.
In case of errors returns an informal message as second argument.
=cut
@@ -227,14 +240,14 @@ sub verify_checksum {
my ($file, $checksum_url) = @_;
# don't do anything if we cannot determine a checksum method
# return -2 which is as much as missing signature
- return(-2) if (!$::checksum_method);
+ return($VS_UNSIGNED) if (!$::checksum_method);
my $checksum_file
= TeXLive::TLUtils::download_to_temp_or_file($checksum_url);
# next step is verification of tlpdb checksum with checksum file
# existenc of checksum_file was checked above
if (!$checksum_file) {
- return(-1, "download did not succeed: $checksum_url");
+ return($VS_CONNECTION_ERROR, "download did not succeed: $checksum_url");
}
# check the signature
my ($ret, $msg) = verify_signature($checksum_file, $checksum_url);
@@ -244,7 +257,7 @@ sub verify_checksum {
open $cs_fh, "<$checksum_file" or die("cannot read file: $!");
if (read ($cs_fh, $remote_digest, $ChecksumLength) != $ChecksumLength) {
close($cs_fh);
- return(1, "incomplete read from $checksum_file");
+ return($VS_CHECKSUM_ERROR, "incomplete read from $checksum_file");
} else {
close($cs_fh);
ddebug("found remote digest: $remote_digest\n");
@@ -252,7 +265,7 @@ sub verify_checksum {
$local_digest = tlchecksum($file);
ddebug("local_digest = $local_digest\n");
if ($local_digest ne $remote_digest) {
- return(1, "digest disagree");
+ return($VS_CHECKSUM_ERROR, "digest disagree");
}
# we are still here, so checksum also succeeded
@@ -378,8 +391,12 @@ sub test_one_gpg {
Verifies a download of C<$url> into C<$file> by cheking the
gpg signature in C<$url.asc>.
-Returns 0 on success, -2 on missing signature file, 2 on signature error,
--3 if no gpg is available, and -4 if a pubkey is missing.
+Returns
+$VS_VERIFIED on success,
+$VS_UNSIGNED on missing signature file,
+$VS_SIGNATURE_ERROR on signature error,
+$VS_GPG_UNAVAILABLE if no gpg is available, and
+$VS_PUBKEY_MISSING if a pubkey is missing.
In case of errors returns an informal message as second argument.
=cut
@@ -397,11 +414,11 @@ sub verify_signature {
if ($ret == 1) {
# no need to show the output
debug("cryptographic signature of $url verified\n");
- return(0);
+ return($VS_VERIFIED);
} elsif ($ret == -1) {
- return(-4, $out);
+ return($VS_PUBKEY_MISSING, $out);
} else {
- return(2, <<GPGERROR);
+ return($VS_SIGNATURE_ERROR, <<GPGERROR);
cryptographic signature verification of
$file
against
@@ -413,15 +430,15 @@ GPGERROR
}
} else {
debug("no access to cryptographic signature $signature_url\n");
- return(-2, "no access to cryptographic signature");
+ return($VS_UNSIGNED, "no access to cryptographic signature");
}
} else {
debug("gpg prog not defined, no checking of signatures\n");
# we return 0 (= success) if not gpg is available
- return(-3, "no gpg available");
+ return($VS_GPG_UNAVAILABLE, "no gpg available");
}
# not reached
- return (0);
+ return ($VS_UNKNOWN);
}
=pod
@@ -461,6 +478,34 @@ sub gpg_verify_signature {
}
}
+=pod
+
+=item C<< %VerificationStatusDescription >>
+
+Provides a textual representation for the verification status values.
+
+=cut
+
+our $VS_VERIFIED = 0;
+our $VS_CHECKSUM_ERROR = 1;
+our $VS_SIGNATURE_ERROR = 2;
+our $VS_CONNECTION_ERROR = -1;
+our $VS_UNSIGNED = -2;
+our $VS_GPG_UNAVAILABLE = -3;
+our $VS_PUBKEY_MISSING = -4;
+our $VS_UNKNOWN = -100;
+
+our %VerificationStatusDescription = (
+ $VS_VERIFIED => 'verified',
+ $VS_CHECKSUM_ERROR => 'checksum error',
+ $VS_SIGNATURE_ERROR => 'signature error',
+ $VS_CONNECTION_ERROR => 'connection error',
+ $VS_UNSIGNED => 'unsigned',
+ $VS_GPG_UNAVAILABLE => 'gpg unavailable',
+ $VS_PUBKEY_MISSING => 'pubkey missing',
+ $VS_UNKNOWN => 'unknown',
+);
+
=back
=cut
diff --git a/Master/tlpkg/TeXLive/TLPDB.pm b/Master/tlpkg/TeXLive/TLPDB.pm
index fbf22f8853c..1dcdb3b91cb 100644
--- a/Master/tlpkg/TeXLive/TLPDB.pm
+++ b/Master/tlpkg/TeXLive/TLPDB.pm
@@ -271,7 +271,7 @@ sub from_file {
} else {
$self->root($root_from_path);
}
- $self->verification_status("unknown");
+ $self->verification_status($VS_UNKNOWN);
my $retfh;
my $tlpdbfile;
my $is_verified = 0;
@@ -367,24 +367,24 @@ sub from_file {
# before we open and proceed, verify the downloaded file
if ($params{'verify'} && $media ne 'local_uncompressed') {
my ($r, $m) = TeXLive::TLCrypto::verify_checksum($tlpdbfile, "$path.$TeXLive::TLConfig::ChecksumExtension");
- if ($r == 1) {
+ if ($r == $VS_CHECKSUM_ERROR) {
tldie("$0: checksum error when downloading $tlpdbfile from $path: $m\n");
- } elsif ($r == 2) {
+ } elsif ($r == $VS_SIGNATURE_ERROR) {
tldie("$0: signature verification error of $tlpdbfile from $path: $m\n");
- } elsif ($r == -1) {
+ } elsif ($r == $VS_CONNECTION_ERROR) {
tldie("$0: cannot download: $m\n");
- } elsif ($r == -2) {
+ } elsif ($r == $VS_UNSIGNED) {
debug("$0: remote database checksum is not signed, continuing anyway!\n");
- $self->verification_status("not signed");
- } elsif ($r == -3) {
+ $self->verification_status($r);
+ } elsif ($r == $VS_GPG_UNAVAILABLE) {
debug("$0: TLPDB: no gpg available, continuing anyway!\n");
- $self->verification_status("gnupg not available");
- } elsif ($r == -4) {
+ $self->verification_status($r);
+ } elsif ($r == $VS_PUBKEY_MISSING) {
debug("$0: TLPDB: pubkey missing, continuing anyway!\n");
- $self->verification_status("pubkey missing");
- } elsif ($r == 0) {
+ $self->verification_status($r);
+ } elsif ($r == $VS_VERIFIED) {
$is_verified = 1;
- $self->verification_status("verified");
+ $self->verification_status($r);
} else {
tldie("$0: unexpected return value from verify_checksum: $r\n");
}
@@ -393,23 +393,24 @@ sub from_file {
} else {
if ($params{'verify'} && $media ne 'local_uncompressed') {
my ($r, $m) = TeXLive::TLCrypto::verify_checksum($path, "$path.$TeXLive::TLConfig::ChecksumExtension");
- if ($r == 1) {
+ if ($r == $VS_CHECKSUM_ERROR) {
tldie("$0: checksum error when downloading $path from $path: $m\n");
- } elsif ($r == 2) {
+ } elsif ($r == $VS_SIGNATURE_ERROR) {
tldie("$0: signature verification error of $path from $path: $m\n");
- } elsif ($r == -1) {
+ } elsif ($r == $VS_CONNECTION_ERROR) {
tldie("$0: cannot download: $m\n");
- } elsif ($r == -2) {
+ } elsif ($r == $VS_UNSIGNED) {
debug("$0: remote database checksum is not signed, continuing anyway!\n");
- $self->verification_status("not signed");
- } elsif ($r == -3) {
+ $self->verification_status($r);
+ } elsif ($r == $VS_GPG_UNAVAILABLE) {
debug("$0: TLPDB: no gpg available, continuing anyway!\n");
- $self->verification_status("gnupg not available");
- } elsif ($r == -4) {
+ $self->verification_status($r);
+ } elsif ($r == $VS_PUBKEY_MISSING) {
debug("$0: TLPDB: pubkey missing, continuing anyway!\n");
- $self->verification_status("pubkey missing");
- } elsif ($r == 0) {
+ $self->verification_status($r);
+ } elsif ($r == $VS_VERIFIED) {
$is_verified = 1;
+ $self->verification_status($r);
} else {
tldie("$0: unexpected return value from verify_checksum: $r\n");
}
@@ -1174,8 +1175,8 @@ sub is_verified {
=item C<< $tlpdb->verification_status >>
-Returns a short textual explanation of the verification status.
-In particular if the database is not verified, it returns the reason.
+Returns the id of the verification status. To obtain a textual representation
+us %TLCrypto::VerificationStatusDescription.
=cut