diff options
author | Karl Berry <karl@freefriends.org> | 2020-05-15 14:58:16 +0000 |
---|---|---|
committer | Karl Berry <karl@freefriends.org> | 2020-05-15 14:58:16 +0000 |
commit | f069144acdb6dd02c2dbdbf64012a19f91154184 (patch) | |
tree | c73bbe38fecaebaf6efafc213bc44dcab773dc20 /Master/tlpkg | |
parent | fbd75b29567f865c5319a4f40ce81e845711232e (diff) |
verify signed file as with TLCrypto::gpg_verify_signature
git-svn-id: svn://tug.org/texlive/trunk@55147 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Master/tlpkg')
-rwxr-xr-x | Master/tlpkg/bin/tl-sign-file | 88 | ||||
-rw-r--r-- | Master/tlpkg/gpg/tl-key-extension.txt | 14 |
2 files changed, 73 insertions, 29 deletions
diff --git a/Master/tlpkg/bin/tl-sign-file b/Master/tlpkg/bin/tl-sign-file index fbe71a41179..f79a2256dcc 100755 --- a/Master/tlpkg/bin/tl-sign-file +++ b/Master/tlpkg/bin/tl-sign-file @@ -1,51 +1,85 @@ #!/bin/sh # $Id$ -# Public domain. Originally written 2016, Norbert Preining. -# Sign a file for release in TeX Live. Used in tl-update-images, etc. -# See tlpkg/gpg/tl-key-extension.txt for some info. +# Public domain. Originally written 2016, Norbert Preining. +# Sign a file for release in TeX Live. Used in tl-update-images, +# tl-update-tlnet, et al. See tlpkg/gpg/tl-key-extension.txt for some info. if test $# -ne 1; then echo "$0: Exactly one argument must be given, the file to sign." >&2 exit 1 fi -# remove previous signature +# remove previous signature else gpg will bail out. rm -f "$1.asc" -prg=gpg -gpgopts="--batch --homedir /home/texlive/.gnupg \ +gpg_prog=gpg +gpg_opts="--batch --homedir /home/texlive/.gnupg \ --passphrase-file /home/texlive/.gnupg/passphrase \ --local-user 0x06BAB6BC " -gpgmainopts="--armor --detach-sign" +gpg_sign_opts="--armor --detach-sign" -# use the environment variables if available -if test -n "$TL_GNUPG" ; then - prg=$TL_GNUPG +# use the environment variables if set. This is for testing; +# we don't define them in normal usage. +if test -n "$TL_GNUPG"; then + gpg_prog=$TL_GNUPG fi -if test -n "$TL_GNUPGOPTS" ; then - gpgopts=$TL_GNUPGOPTS +if test -n "$TL_GNUPGOPTS"; then + gpg_opts=$TL_GNUPGOPTS fi -if test -n "$TL_GNUPGMAINOPTS" ; then - gpgmainopts=$TL_GNUPGMAINOPTS +if test -n "$TL_GNUPG_SIGN_OPTS"; then + gpg_sign_opts=$TL_GNUPG_SIGN_OPTS fi -# sign, check that result doesn't use something expired. +# sign, check that result is valid and doesn't use something expired. # both --detach-sign and --verify exit 0 even when something is expired. -if "$prg" $gpgmainopts $gpgopts "$1"; then - if "$prg" --verify "$1".asc 2>&1 | grep xpired >/dev/null; then - echo "$0: expired key, output from $prg --verify $1.asc:" >&2 - "$prg" --verify "$1".asc - echo "$0: expired key, moving $1.asc to $1.asc.xpir." >&2 - mv "$1".asc "$1".asc.xpir || exit 1 - echo "$0: gpg command was:" >&2 - echo "$0:" "$prg" $gpgmainopts $gpgopts "$1" >&2 - echo "$0: good luck and goodbye." >&2 +if $gpg_prog $gpg_sign_opts $gpg_opts "$1"; then + status_out=`mktemp` + verify_out=`mktemp` + verify_cmd="$gpg_prog $gpg_opts --status-file=$status_out --verify --verbose" + if $verify_cmd "$1".asc >$verify_out 2>&1; then + if grep EXPKEYSIG $status_out >/dev/null; then + err="expired key" + elif grep REVKEYSIG $status_out >/dev/null; then + err="revoked key" + else + err= # ok we hope + fi + else + err="other error ($?)" + fi + if test -n "$err"; then + echo "$0: gpg verification failed." >&2 + if test -r "$1".asc; then + echo "$0: moving $1.asc to $1.asc.badv." >&2 + mv "$1".asc "$1".asc.badv || exit 1 + else + echo "$0: no file $1.asc" >&2 + fi + echo "$0: gpg verify command was:" >&2 + echo "$0: $verify_cmd" "$1" >&2 + echo "$0: STATUS FILE OUTPUT:" >&2 + cat $status_out >&2 + echo "$0: -------------------" >&2 + echo "$0: STDOUT/STDERR:" >&2 + cat $verify_out >&2 + echo "$0: -------------------" >&2 + echo "$0: goodbye and good luck." >&2 + rm -f $status_out $verify_out exit 1 fi -else - echo "$0: gpg failed, exiting." >&2 + rm -f $status_out $verify_out + +else # the original gpg run failed. + echo "$0: gpg signing failed." >&2 + if test -r "$1".asc; then + echo "$0: moving $1.asc to $1.asc.bads." >&2 + mv "$1".asc "$1".asc.bads || exit 1 + else + echo "$0: no file $1.asc" >&2 + fi echo "$0: gpg command was:" >&2 - echo "$0:" "$prg" $gpgmainopts $gpgopts "$1" >&2 + echo "$0: $gpg_prog $gpg_sign_opts $gpg_opts" "$1" >&2 + echo "$0: goodbye and good luck." >&2 exit 1 fi diff --git a/Master/tlpkg/gpg/tl-key-extension.txt b/Master/tlpkg/gpg/tl-key-extension.txt index 0ceeab2c69d..6c4569a410f 100644 --- a/Master/tlpkg/gpg/tl-key-extension.txt +++ b/Master/tlpkg/gpg/tl-key-extension.txt @@ -43,7 +43,17 @@ svn/git commit # texlive.asc, see above how to export it) gpg --homedir ~texlive/.gnupg --import texlive.asc +# can view that .asc with: +gpg --show-keyring texlive.asc + +# update web-accessible public key, keeping old files but updating symlink: +cp texlive.asc ~www/texlive/files/texlive`date +%Y`.asc +ln -s texlive`date +%Y`.asc ~www/texlive/files/texlive.asc More info: -. we use tlpkg/bin/tl-sign-file to sign texlive.tlpdb. -. gpg --verify --verbose foo.asc for info on signature of file. +. we use tlpkg/bin/tl-sign-file to sign texlive.tlpdb.sha512. +. gpg --verify --verbose foo.asc for info on signature file. +. but exit status is zero even with expired keys; to check, + use --status-file and inspect: +gpg --verify --verbose --status-file=/tmp/st foo.asc +. see tl-sign-file or TLCrypto.pm for full implementation. |