verification reporting reworked: be non-intrusive

git-svn-id: svn://tug.org/texlive/trunk@40640 c570f23f-e606-0410-a88d-b1316a301751

2 files changed, 41 insertions, 17 deletions

diff --git a/Master/tlpkg/TeXLive/TLPDB.pm b/Master/tlpkg/TeXLive/TLPDB.pm
index a3c22358000..65999bfc9a5 100644
--- a/Master/tlpkg/TeXLive/TLPDB.pm
+++ b/Master/tlpkg/TeXLive/TLPDB.pm
@@ -368,18 +368,32 @@ sub from_file {
     # before we open and proceed, verify the downloaded file
     if ($params{'verify'} && $media ne 'local_uncompressed') {
       my ($r, $m) = TeXLive::TLUtils::verify_checksum($tlpdbfile, "$path.$TeXLive::TLConfig::ChecksumExtension");
-      # TODO here we could check for -1 as return value
-      # which would indicate that the checksum could not be downloaded!
-      if ($r != 0) {
-        tldie("$0: verification of $tlpdbfile from $path failed ($r): $m\n");
+      if ($r == 1) {
+        tldie("$0: checksum error when downloading $tlpdbfile from $path: $m\n");
+      } elsif ($r == 2) {
+        tldie("$0: signature verification error of $tlpdbfile from $path: $m\n");
+      } elsif ($r == -1) {
+        tldie("$0: connection problems, cannot download: $m\n");
+      } elsif ($r == 0) {
+        # all is fine, do nothing
+      } else {
+        tldie("$0: unexpected return value from verify_checksum: $r\n");
       }
     }
     open($retfh, "<$tlpdbfile") || die "$0: open($tlpdbfile) failed: $!";
   } else {
     if ($params{'verify'} && $media ne 'local_uncompressed') {
       my ($r, $m) = TeXLive::TLUtils::verify_checksum($path, "$path.$TeXLive::TLConfig::ChecksumExtension");
-      if ($r != 0) {
-        tldie("$0: verification of $path failed ($r): $m\n");
+      if ($r == 1) {
+        tldie("$0: checksum error when downloading $tlpdbfile from $path: $m\n");
+      } elsif ($r == 2) {
+        tldie("$0: signature verification error of $tlpdbfile from $path: $m\n");
+      } elsif ($r == -1) {
+        tldie("$0: connection problems, cannot download: $m\n");
+      } elsif ($r == 0) {
+        # all is fine, do nothing
+      } else {
+        tldie("$0: unexpected return value from verify_checksum: $r\n");
       }
     }
     open(TMP, "<$path") || die "$0: open($path) failed: $!";
diff --git a/Master/tlpkg/TeXLive/TLUtils.pm b/Master/tlpkg/TeXLive/TLUtils.pm
index 8de05ee9d75..dc3c909df08 100644
--- a/Master/tlpkg/TeXLive/TLUtils.pm
+++ b/Master/tlpkg/TeXLive/TLUtils.pm
@@ -3750,9 +3750,11 @@ sub slurp_file {
 
 =item C<< verify_checksum($file, $checksum_url) >>
 
-Verifies that C<$file> has checksum C<$checksum_url>.
+Verifies that C<$file> has checksum C<$checksum_url>, and if gpg is
+available also verifies that the checksum is signed.
 
-Returns 0 on success, -1 on connection error, 1 on checksum error.
+Returns 0 on success, -1 on connection error, 1 on checksum, and 
+2 on signature errors.
 In case of errors returns an informal message as second argument.
 
 =cut
@@ -3829,7 +3831,7 @@ sub download_to_temp_or_file {
 Verifies a download of C<$url> into C<$file> by cheking the 
 gpg signature in C<$url.asc>.
 
-Returns 0 on success, -1 on connection error, 1 on checksum error.
+Returns 0 on success, -1 on connection error, 2 on signature error.
 In case of errors returns an informal message as second argument.
 
 =cut
@@ -3842,23 +3844,32 @@ sub verify_signature {
   if ($::gpg) {
     my $signature_file = download_to_temp_or_file($signature_url);
     if ($signature_file) {
-      if (TeXLive::TLUtils::gpg_verify_signature($file, $signature_file)) {
-        info("cryptographic signature of $url verified\n");
+      my ($ret, $out) = gpg_verify_signature($file, $signature_file);
+      if ($ret) {
+        # no need to show the output
+        debug("cryptographic signature of $url verified\n");
+        return(0);
       } else {
-        return(1, <<GPGERROR);
-cryptograpic verification of
+        return(2, <<GPGERROR);
+cryptographic signature verification of
   $file
 against
   $signature_url
-failed. Please report to texlive\@tug.org
+failed. Output was
+$out
+Please report to texlive\@tug.org
 GPGERROR
       }
     } else {
       debug("no access to cryptographic signature $signature_url\n");
+      return(-1);
     }
   } else {
     debug("gpg prog not defined, no checking of signatures\n");
+    # we return 0 (= success) if not gpg is available
+    return(0);
   }
+  # not reached
   return (0);
 }
 
@@ -3874,10 +3885,9 @@ sub gpg_verify_signature {
   my ($out, $ret) = run_cmd("$::gpg --verify $sig_quote $file_quote 2>&1");
   if ($ret == 0) {
     debug("verification succeeded, output:\n$out\n");
-    return 1;
+    return (1, $out);
   } else {
-    tlwarn("verification failed, output:\n$out\n");
-    return 0;
+    return (0, $out);
   }
 }