summaryrefslogtreecommitdiff
path: root/Master/tlpkg/gpg/tl-key-extension.txt
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2021-10-21 18:17:33 +0000
committerKarl Berry <karl@freefriends.org>2021-10-21 18:17:33 +0000
commit25e7b2e3067a8b7ae0f9856883facc0275c07686 (patch)
tree8488e200929f4f5cb2c437275ed7f594ce4cbdac /Master/tlpkg/gpg/tl-key-extension.txt
parent614772193fc66e1b78ae77bd5d5fb4ec45f9fe35 (diff)
misc doc updates: clisp build, gpg procedure, setup_sys_user_mode() args
git-svn-id: svn://tug.org/texlive/trunk@60823 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Master/tlpkg/gpg/tl-key-extension.txt')
-rw-r--r--Master/tlpkg/gpg/tl-key-extension.txt28
1 files changed, 20 insertions, 8 deletions
diff --git a/Master/tlpkg/gpg/tl-key-extension.txt b/Master/tlpkg/gpg/tl-key-extension.txt
index 6c4569a410f..4157e0fca4b 100644
--- a/Master/tlpkg/gpg/tl-key-extension.txt
+++ b/Master/tlpkg/gpg/tl-key-extension.txt
@@ -30,30 +30,42 @@ unset GNUPGHOME
gpg --send-keys $KEYID
-
# update TeX Live repository
-export GNUPGHOME=/path/to/texlive-svn/Master/tlpkg/gpg
+export GNUPGHOME=/home/texlive/Master/tlpkg/gpg # wherever svn checkout
# use gpg version 1 here!!!
gpg1 --import texlive.asc
-svn/git commit
+svn commit
# on the TUG server (needs the exported public key in
# texlive.asc, see above how to export it)
-gpg --homedir ~texlive/.gnupg --import texlive.asc
+gpg --homedir /home/texlive/.gnupg --import texlive.asc
# can view that .asc with:
-gpg --show-keyring texlive.asc
+gpg --homedir /home/texlive/.gnupg texlive.asc
# update web-accessible public key, keeping old files but updating symlink:
cp texlive.asc ~www/texlive/files/texlive`date +%Y`.asc
ln -s texlive`date +%Y`.asc ~www/texlive/files/texlive.asc
More info:
-. we use tlpkg/bin/tl-sign-file to sign texlive.tlpdb.sha512.
-. gpg --verify --verbose foo.asc for info on signature file.
+. tlgpg runs a gpg command with the above TL .gnupg directory, etc.
+
+. tl-sign-file (uses tlgpg) is used to sign texlive.tlpdb.sha512.
+
+. tlgpg-verify foo[.asc] will check for expired key, per below.
+ tl-sign-file uses this to make sure it is not signing with an expired key.
+
+. (tl)gpg foo.asc will sometimes report expiration info.
+
+. given files updated in Master/tlpkg/gpg, can export into asc:
+gpg --homedir ..../Master/tlpkg/gpg --export -a 0x0D5E5D9106BAB6BC >tl.asc
+
+. gpg --verify --verbose foo.asc reports some info.
+
. but exit status is zero even with expired keys; to check,
use --status-file and inspect:
gpg --verify --verbose --status-file=/tmp/st foo.asc
-. see tl-sign-file or TLCrypto.pm for full implementation.
+
+. see tlgpg, tl-sign-file, TLCrypto.pm for full implementation.