diff options
author | Karl Berry <karl@freefriends.org> | 2020-05-17 17:43:50 +0000 |
---|---|---|
committer | Karl Berry <karl@freefriends.org> | 2020-05-17 17:43:50 +0000 |
commit | ad41eab31b79739233027df1c00bdc7951030d14 (patch) | |
tree | ae5c4967c649ae9a504705fd71a24ca47800e48c /Master/tlpkg/bin/tlgpg-verify | |
parent | f8c9cbfe16ae8eac7e44b3353f4d3a8bf64e3936 (diff) |
tlgpg: new program for common gpg arguments for TL usage, notably --homedir.
tlgpg-verify: new script, following TLCrypto.pm for checks.
tl-sign-file: use tlgpg and tlgpg-verify.
tl-update-tlnet: run tlgpg-verify on the new tlnet's tlpdb, both before and
installation, since we've seen it fail.
git-svn-id: svn://tug.org/texlive/trunk@55180 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Master/tlpkg/bin/tlgpg-verify')
-rwxr-xr-x | Master/tlpkg/bin/tlgpg-verify | 61 |
1 files changed, 61 insertions, 0 deletions
diff --git a/Master/tlpkg/bin/tlgpg-verify b/Master/tlpkg/bin/tlgpg-verify new file mode 100755 index 00000000000..1f0a6b0fb40 --- /dev/null +++ b/Master/tlpkg/bin/tlgpg-verify @@ -0,0 +1,61 @@ +#!/bin/sh +# $Id$ +# Public domain. Originally written 2020, Norbert Preining. +# gpg --verify ARG.asc. If verification fails, show all output. +# Adapted from TeXLive/TLCrypto.pm. + +if test $# -ne 1; then + echo "$0: Exactly one argument must be given, the file to verify," >&2 + echo "$0: with or without the .asc." >&2 + exit 1 +fi + +if echo "$1" | grep '\.asc$' >/dev/null; then + asc_file=$1 +else + asc_file=$1.asc +fi + +if test ! -s "$asc_file"; then + echo "$0: $asc_file nonexistent or empty, goodbye." >&2 + exit 1 +fi + +mydir=`cd \`dirname $0\` && pwd` +PATH=$mydir:$PATH # for our tlgpg command + +status_out=`mktemp` +verify_out=`mktemp` +verify_cmd="tlgpg --status-file=$status_out --verify --verbose" + +# gpg exit status is zero with expired keys, +# but we want to fail in that case. +if $verify_cmd "$asc_file" >$verify_out 2>&1; then + if grep EXPKEYSIG $status_out >/dev/null; then + err="expired key" + elif grep REVKEYSIG $status_out >/dev/null; then + err="revoked key" + else + err= # ok we hope + fi +else + err="other error ($?)" +fi + +if test -n "$err"; then + echo "$0: gpg verification failed for: $asc_file" >&2 + echo "$0: moving $asc_file to $asc_file.badv." >&2 + mv "$asc_file" "$asc_file".badv || exit 1 + echo "$0: gpg verify command was:" >&2 + echo "$0: $verify_cmd" "$1" >&2 + echo "$0: GPG STATUS FILE OUTPUT:" >&2 + cat $status_out >&2 + echo "$0: GPG STDOUT/STDERR:" >&2 + cat $verify_out >&2 + echo "$0: goodbye and good luck." >&2 + rm -f $status_out $verify_out + exit 1 +fi +rm -f $status_out $verify_out + +exit 0 |