summaryrefslogtreecommitdiff
path: root/Master/tlpkg/bin/tlgpg-verify
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2020-05-17 17:43:50 +0000
committerKarl Berry <karl@freefriends.org>2020-05-17 17:43:50 +0000
commitad41eab31b79739233027df1c00bdc7951030d14 (patch)
treeae5c4967c649ae9a504705fd71a24ca47800e48c /Master/tlpkg/bin/tlgpg-verify
parentf8c9cbfe16ae8eac7e44b3353f4d3a8bf64e3936 (diff)
tlgpg: new program for common gpg arguments for TL usage, notably --homedir.
tlgpg-verify: new script, following TLCrypto.pm for checks. tl-sign-file: use tlgpg and tlgpg-verify. tl-update-tlnet: run tlgpg-verify on the new tlnet's tlpdb, both before and installation, since we've seen it fail. git-svn-id: svn://tug.org/texlive/trunk@55180 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Master/tlpkg/bin/tlgpg-verify')
-rwxr-xr-xMaster/tlpkg/bin/tlgpg-verify61
1 files changed, 61 insertions, 0 deletions
diff --git a/Master/tlpkg/bin/tlgpg-verify b/Master/tlpkg/bin/tlgpg-verify
new file mode 100755
index 00000000000..1f0a6b0fb40
--- /dev/null
+++ b/Master/tlpkg/bin/tlgpg-verify
@@ -0,0 +1,61 @@
+#!/bin/sh
+# $Id$
+# Public domain. Originally written 2020, Norbert Preining.
+# gpg --verify ARG.asc. If verification fails, show all output.
+# Adapted from TeXLive/TLCrypto.pm.
+
+if test $# -ne 1; then
+ echo "$0: Exactly one argument must be given, the file to verify," >&2
+ echo "$0: with or without the .asc." >&2
+ exit 1
+fi
+
+if echo "$1" | grep '\.asc$' >/dev/null; then
+ asc_file=$1
+else
+ asc_file=$1.asc
+fi
+
+if test ! -s "$asc_file"; then
+ echo "$0: $asc_file nonexistent or empty, goodbye." >&2
+ exit 1
+fi
+
+mydir=`cd \`dirname $0\` && pwd`
+PATH=$mydir:$PATH # for our tlgpg command
+
+status_out=`mktemp`
+verify_out=`mktemp`
+verify_cmd="tlgpg --status-file=$status_out --verify --verbose"
+
+# gpg exit status is zero with expired keys,
+# but we want to fail in that case.
+if $verify_cmd "$asc_file" >$verify_out 2>&1; then
+ if grep EXPKEYSIG $status_out >/dev/null; then
+ err="expired key"
+ elif grep REVKEYSIG $status_out >/dev/null; then
+ err="revoked key"
+ else
+ err= # ok we hope
+ fi
+else
+ err="other error ($?)"
+fi
+
+if test -n "$err"; then
+ echo "$0: gpg verification failed for: $asc_file" >&2
+ echo "$0: moving $asc_file to $asc_file.badv." >&2
+ mv "$asc_file" "$asc_file".badv || exit 1
+ echo "$0: gpg verify command was:" >&2
+ echo "$0: $verify_cmd" "$1" >&2
+ echo "$0: GPG STATUS FILE OUTPUT:" >&2
+ cat $status_out >&2
+ echo "$0: GPG STDOUT/STDERR:" >&2
+ cat $verify_out >&2
+ echo "$0: goodbye and good luck." >&2
+ rm -f $status_out $verify_out
+ exit 1
+fi
+rm -f $status_out $verify_out
+
+exit 0