verify signed file as with TLCrypto::gpg_verify_signature

git-svn-id: svn://tug.org/texlive/trunk@55147 c570f23f-e606-0410-a88d-b1316a301751

1 files changed, 61 insertions, 27 deletions

diff --git a/Master/tlpkg/bin/tl-sign-file b/Master/tlpkg/bin/tl-sign-file
index fbe71a41179..f79a2256dcc 100755
--- a/Master/tlpkg/bin/tl-sign-file
+++ b/Master/tlpkg/bin/tl-sign-file
@@ -1,51 +1,85 @@
 #!/bin/sh
 # $Id$
-# Public domain.  Originally written 2016, Norbert Preining.
-# Sign a file for release in TeX Live. Used in tl-update-images, etc.
-# See tlpkg/gpg/tl-key-extension.txt for some info.
+# Public domain. Originally written 2016, Norbert Preining.
+# Sign a file for release in TeX Live. Used in tl-update-images,
+# tl-update-tlnet, et al. See tlpkg/gpg/tl-key-extension.txt for some info.
 
 if test $# -ne 1; then
   echo "$0: Exactly one argument must be given, the file to sign." >&2
   exit 1
 fi
 
-# remove previous signature
+# remove previous signature else gpg will bail out.
 rm -f "$1.asc"
 
-prg=gpg
-gpgopts="--batch --homedir /home/texlive/.gnupg  \
+gpg_prog=gpg
+gpg_opts="--batch --homedir /home/texlive/.gnupg  \
   --passphrase-file /home/texlive/.gnupg/passphrase \
   --local-user 0x06BAB6BC "
-gpgmainopts="--armor --detach-sign"
+gpg_sign_opts="--armor --detach-sign"
 
-# use the environment variables if available
-if test -n "$TL_GNUPG" ; then
-  prg=$TL_GNUPG
+# use the environment variables if set. This is for testing;
+# we don't define them in normal usage.
+if test -n "$TL_GNUPG"; then
+  gpg_prog=$TL_GNUPG
 fi
-if test -n "$TL_GNUPGOPTS" ; then
-  gpgopts=$TL_GNUPGOPTS
+if test -n "$TL_GNUPGOPTS"; then
+  gpg_opts=$TL_GNUPGOPTS
 fi
-if test -n "$TL_GNUPGMAINOPTS" ; then
-  gpgmainopts=$TL_GNUPGMAINOPTS
+if test -n "$TL_GNUPG_SIGN_OPTS"; then
+  gpg_sign_opts=$TL_GNUPG_SIGN_OPTS
 fi
 
-# sign, check that result doesn't use something expired.
+# sign, check that result is valid and doesn't use something expired.
 # both --detach-sign and --verify exit 0 even when something is expired.
-if "$prg" $gpgmainopts $gpgopts "$1"; then
-  if "$prg" --verify "$1".asc 2>&1 | grep xpired >/dev/null; then
-    echo "$0: expired key, output from $prg --verify $1.asc:" >&2
-    "$prg" --verify "$1".asc
-    echo "$0: expired key, moving $1.asc to $1.asc.xpir." >&2
-    mv "$1".asc "$1".asc.xpir || exit 1
-    echo "$0: gpg command was:" >&2
-    echo "$0:" "$prg" $gpgmainopts $gpgopts "$1" >&2
-    echo "$0: good luck and goodbye." >&2
+if $gpg_prog $gpg_sign_opts $gpg_opts "$1"; then
+  status_out=`mktemp`
+  verify_out=`mktemp`
+  verify_cmd="$gpg_prog $gpg_opts --status-file=$status_out --verify --verbose"
+  if $verify_cmd "$1".asc >$verify_out 2>&1; then
+    if grep EXPKEYSIG $status_out >/dev/null; then
+      err="expired key"
+    elif grep REVKEYSIG $status_out >/dev/null; then
+      err="revoked key"
+    else
+      err= # ok we hope
+    fi
+  else
+    err="other error ($?)"
+  fi
+  if test -n "$err"; then
+    echo "$0: gpg verification failed." >&2
+    if test -r "$1".asc; then
+      echo "$0: moving $1.asc to $1.asc.badv." >&2
+      mv "$1".asc "$1".asc.badv || exit 1
+    else
+      echo "$0: no file $1.asc" >&2
+    fi      
+    echo "$0: gpg verify command was:" >&2
+    echo "$0: $verify_cmd" "$1" >&2
+    echo "$0: STATUS FILE OUTPUT:" >&2
+    cat $status_out >&2
+    echo "$0: -------------------" >&2    
+    echo "$0: STDOUT/STDERR:" >&2
+    cat $verify_out >&2
+    echo "$0: -------------------" >&2    
+    echo "$0: goodbye and good luck." >&2
+    rm -f $status_out $verify_out
     exit 1
   fi
-else
-  echo "$0: gpg failed, exiting." >&2
+  rm -f $status_out $verify_out
+
+else # the original gpg run failed.
+  echo "$0: gpg signing failed." >&2
+  if test -r "$1".asc; then
+    echo "$0: moving $1.asc to $1.asc.bads." >&2
+    mv "$1".asc "$1".asc.bads || exit 1
+  else
+    echo "$0: no file $1.asc" >&2
+  fi
   echo "$0: gpg command was:" >&2
-  echo "$0:" "$prg" $gpgmainopts $gpgopts "$1" >&2
+  echo "$0: $gpg_prog $gpg_sign_opts $gpg_opts" "$1" >&2
+  echo "$0: goodbye and good luck." >&2
   exit 1
 fi