tlmgr: --require-verification (cmd line and tlgmr option)

git-svn-id: svn://tug.org/texlive/trunk@40914 c570f23f-e606-0410-a88d-b1316a301751

1 files changed, 39 insertions, 3 deletions

diff --git a/Master/texmf-dist/scripts/texlive/tlmgr.pl b/Master/texmf-dist/scripts/texlive/tlmgr.pl
index 72d2da50d1d..3f2f3e394df 100755
--- a/Master/texmf-dist/scripts/texlive/tlmgr.pl
+++ b/Master/texmf-dist/scripts/texlive/tlmgr.pl
@@ -343,6 +343,7 @@ sub main {
     "usermode|user-mode" => 1,
     "usertree|user-tree" => "=s",
     "verify-downloads" => "!",
+    "require-verification" => "!",
     "version" => 1,
   );
 
@@ -5981,7 +5982,6 @@ sub _init_tlmedia {
     return(0, $errormsg);
   }
 
-
   # this "location-url" line should not be changed since GUI programs
   # depend on it:
   if ($::machinereadable) {
@@ -6087,6 +6087,10 @@ END_NO_INTERNET
   if (!defined($remotetlpdb)) {
     return(undef, $loadmediasrcerror . $location);
   }
+  if ($opts{"require-verification"} && !$remotetlpdb->is_verified) {
+    tldie("Remote TeX Live database ($location) is not verified, exiting.\n");
+  }
+
   # we allow a range of years to be specified by the remote tlpdb
   # for which it might work.
   # the lower limit is TLPDB->config_minrelease
@@ -6216,6 +6220,9 @@ sub load_config_file {
   # by default we remove packages
   $config{"auto-remove"} = 1;
   #
+  # by default we do not require verification
+  $config{"require-verification"} = 0;
+  #
   # do NOT set this here, we distinguish between explicitly set in the config file
   # or implicitly true
   # $config{"verify-downloads"} = 1;
@@ -6232,6 +6239,11 @@ sub load_config_file {
   $tlmgr_config_file = TeXLive::TLConfFile->new($fn, "#", "=");
   load_options_from_config($tlmgr_config_file) if $tlmgr_config_file;
 
+  # set $opts{"key"} from $config{"key"} if not passed in on cmd line
+  if (!defined($opts{"require-verification"})) {
+    $opts{"require-verification"} = $config{"require-verification"};
+  }
+
   # switched names for this one after initial release.
   if ($tlmgr_config_file->key_present("gui_expertmode")) {
     $tlmgr_config_file->rename_key("gui_expertmode", "gui-expertmode");
@@ -6271,6 +6283,15 @@ sub load_options_from_config {
         tlwarn("$prg: $fn: Unknown value for auto-remove: $val\n");
       }
 
+    } elsif ($key eq "require-verification") {
+      if ($val eq "0") {
+        $config{"require-verification"} = 0;
+      } elsif ($val eq "1") {
+        $config{"require-verification"} = 1;
+      } else {
+        tlwarn("$prg: $fn: Unknown value for require-verification: $val\n");
+      }
+
     } elsif ($key eq "verify-downloads") {
       if ($val eq "0") {
         $config{"verify-downloads"} = 0;
@@ -6643,6 +6664,15 @@ Change the pinning file location from C<TEXMFLOCAL/tlpkg/pinning.txt>
 (see L</Pinning> below).  Documented only for completeness, as this is
 only useful in debugging.
 
+=item B<--require-verification>
+
+=item B<--no-require-verification>
+
+Instructs C<tlmgr> to only accept signed and verified remotes. In any
+other case C<tlmgr> will quit operation.
+See L<CRYPTOGRAPHIC VERIFICATION> below for details.
+
+
 =item B<--usermode>
 
 Activates user mode for this run of C<tlmgr>; see L<USER MODE> below.
@@ -7783,6 +7813,9 @@ command-line option.
 =item C<persistent-downloads>, value 0 or 1 (default 1), same as
 command-line option.
 
+=item C<require-verification>, value 0 or 1 (default 1), same as
+command-line option.
+
 =item C<verify-downloads>, value 0 or 1 (default 1), same as
 command-line option.
 
@@ -7804,7 +7837,7 @@ make sense to set this.
 
 =back
 
-The <no-checksums> key needs more explanation.  By default, package
+The C<no-checksums> key needs more explanation.  By default, package
 checksums computed and stored on the server (in the TLPDB) are compared
 to checksums computed locally after downloading.  C<no-checksums>
 disables this.
@@ -7825,7 +7858,10 @@ If a working GnuPG binary (C<gpg>) is found (see below for the search
 method), by default verification of downloaded files is performed. This
 can be suppressed by specifying C<--no-verify-downloads> on the command
 line, or adding an entry C<verify-downloads = 0> to a tlmgr config file
-(described in L<CONFIGURATION FILE FOR TLMGR>).
+(described in L<CONFIGURATION FILE FOR TLMGR>). On the other hand,
+it is possible to B<require> verification by either specifying 
+C<--require-verification> on the command line, or adding an entry
+C<require-verification = 1> to a tlmgr config file.
 
 Verification is performed as follows: For each C<texlive.tlpdb> loaded
 for a repository, the respective checksum C<texlive.tlpdb.sha512> is