summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rwxr-xr-xBuild/source/libs/harfbuzz/configure2
-rw-r--r--Build/source/texk/tests/TeXLive/TLConfig.pm25
-rw-r--r--Build/source/texk/tests/TeXLive/TLUtils.pm240
-rwxr-xr-xBuild/source/texk/texlive/linked_scripts/texlive/fmtutil.pl20
-rwxr-xr-xBuild/source/texk/texlive/linked_scripts/texlive/tlmgr.pl180
-rw-r--r--Master/tlpkg/tlpsrc/luatex.tlpsrc2
-rw-r--r--Master/tlpkg/tlpsrc/mflua.tlpsrc5
7 files changed, 386 insertions, 88 deletions
diff --git a/Build/source/libs/harfbuzz/configure b/Build/source/libs/harfbuzz/configure
index 656b46ebceb..34eeeceffaa 100755
--- a/Build/source/libs/harfbuzz/configure
+++ b/Build/source/libs/harfbuzz/configure
@@ -4206,7 +4206,7 @@ WARNING_CFLAGS=$kpse_cv_warning_cflags
HB_VERSION_MAJOR=1
HB_VERSION_MINOR=2
-HB_VERSION_MICRO=5
+HB_VERSION_MICRO=6
HB_VERSION=1.2.6
ac_ext=c
diff --git a/Build/source/texk/tests/TeXLive/TLConfig.pm b/Build/source/texk/tests/TeXLive/TLConfig.pm
index 4d35866893d..972f708f893 100644
--- a/Build/source/texk/tests/TeXLive/TLConfig.pm
+++ b/Build/source/texk/tests/TeXLive/TLConfig.pm
@@ -5,7 +5,7 @@
package TeXLive::TLConfig;
-my $svnrev = '$Revision: 40251 $';
+my $svnrev = '$Revision: 40475 $';
my $_modulerevision;
if ($svnrev =~ m/: ([0-9]+) /) {
$_modulerevision = $1;
@@ -49,6 +49,9 @@ BEGIN {
$NetworkTimeout
$PartialEngineSupport
$F_OK $F_WARNING $F_ERROR $F_NOPOSTACTION
+ $ChecksumLength
+ $ChecksumProgram
+ $ChecksumExtension
);
@EXPORT = @EXPORT_OK;
}
@@ -57,9 +60,10 @@ BEGIN {
# network packages, and in menu names, and other places.
$ReleaseYear = 2016;
-# users can upgrade from this year to the current year; maybe a spread
-# of more than one year will be useful at some point, but not now.
-$MinRelease = 2013; # upgrade from 2013 to 2015 should work, we'll see
+# users can upgrade from this year to the current year; might be the
+# same as the release year, or any number of releases earlier.
+# Generally not tested.
+$MinRelease = 2013;
# users can NOT upgrade due to internal changes, force a full installation
#$MinRelease = $ReleaseYear;
@@ -193,7 +197,7 @@ our %TLPDBSettings = (
our $WindowsMainMenuName = "TeX Live $ReleaseYear";
# Comma-separated list of engines which do not exist on all platforms.
-our $PartialEngineSupport = "luajittex";
+our $PartialEngineSupport = "luajittex,mfluajit";
# timeout for network connections (wget, LWP) in seconds
our $NetworkTimeout = 30;
@@ -211,6 +215,17 @@ our $F_ERROR = 2;
# all fine, but no need to run post actions
our $F_NOPOSTACTION = 4;
+# The length of a checksum generated by tlchecksum and contained in
+# texlive.tlpdb.checksum. Needs to be in agreement with the hash
+# method used in TLUtils::tlchecksum and TLUtils::tldigest
+$ChecksumLength = 128;
+
+# The program generating the checksum for the file given as first
+# argument
+$ChecksumProgram = "sha512sum";
+
+# The extension of the checksum file
+$ChecksumExtension = "sha512";
1;
diff --git a/Build/source/texk/tests/TeXLive/TLUtils.pm b/Build/source/texk/tests/TeXLive/TLUtils.pm
index ac14adf3f3e..bc4ab402d9d 100644
--- a/Build/source/texk/tests/TeXLive/TLUtils.pm
+++ b/Build/source/texk/tests/TeXLive/TLUtils.pm
@@ -5,7 +5,7 @@
package TeXLive::TLUtils;
-my $svnrev = '$Revision: 40251 $';
+my $svnrev = '$Revision: 40460 $';
my $_modulerevision;
if ($svnrev =~ m/: ([0-9]+) /) {
$_modulerevision = $1;
@@ -98,6 +98,10 @@ C<TeXLive::TLUtils> -- utilities used in TeX Live infrastructure
TeXLive::TLUtils::give_ctan_mirror();
TeXLive::TLUtils::give_ctan_mirror_base();
TeXLive::TLUtils::tlmd5($path);
+ TeXLive::TLUtils::tlchecksum($path);
+ TeXLive::TLUtils::setup_gpg();
+ TeXLive::TLUtils::verify_checksum($file, $url);
+ TeXLive::TLUtils::verify_signature($file, $url);
TeXLive::TLUtils::compare_tlpobjs($tlpA, $tlpB);
TeXLive::TLUtils::compare_tlpdbs($tlpdbA, $tlpdbB);
TeXLive::TLUtils::report_tlpdb_differences(\%ret);
@@ -172,6 +176,10 @@ BEGIN {
&create_mirror_list
&extract_mirror_entry
&tlmd5
+ &tlchecksum
+ &setup_gpg
+ &verify_checksum
+ &verify_signature
&wsystem
&xsystem
&run_cmd
@@ -198,6 +206,7 @@ BEGIN {
use Cwd;
use Digest::MD5;
+use Digest::SHA;
use Getopt::Long;
use File::Temp;
@@ -1957,7 +1966,7 @@ not agree. Does nothing if neither of the check arguments is given.
sub check_file {
my ($xzfile, $checksum, $size) = @_;
if ($checksum) {
- if (tlmd5($xzfile) ne $checksum) {
+ if (tlchecksum($xzfile) ne $checksum) {
tlwarn("TLUtils::check_file: found $xzfile, but hashsums differ, removing it.\n");
unlink($xzfile);
return;
@@ -2239,7 +2248,7 @@ sub setup_programs {
# Return 0 if failure, 1 if success.
#
sub setup_unix_one {
- my ($p, $def, $arg) = @_;
+ my ($p, $def, $arg, $donotwarn) = @_;
our $tmp;
my $test_fallback = 0;
if (-r $def) {
@@ -2313,9 +2322,13 @@ sub setup_unix_one {
if ($ret == 0) {
debug("Using system $p (tested).\n");
} else {
- tlwarn("$0: Initialization failed (in setup_unix_one):\n");
- tlwarn("$0: could not find a usable $p.\n");
- tlwarn("$0: Please install $p and try again.\n");
+ if ($donotwarn) {
+ debug("$0: initialization of $p failed but ignored!\n");
+ } else {
+ tlwarn("$0: Initialization failed (in setup_unix_one):\n");
+ tlwarn("$0: could not find a usable $p.\n");
+ tlwarn("$0: Please install $p and try again.\n");
+ }
return 0;
}
} else {
@@ -3578,6 +3591,221 @@ sub tlmd5 {
}
}
+sub tldigest {
+ return (Digest::SHA::sha512_hex(shift));
+}
+sub tl_short_digest {
+ return (Digest::MD5::md5_hex(shift));
+}
+
+sub tlchecksum {
+ my ($file) = @_;
+ if (-r $file) {
+ open(FILE, $file) || die "open($file) failed: $!";
+ binmode(FILE);
+ my $cshash = Digest::SHA->new(512)->addfile(*FILE)->hexdigest;
+ close(FILE);
+ return $cshash;
+ } else {
+ tlwarn("tlchecksum: given file not readable: $file\n");
+ return "";
+ }
+}
+
+sub tlchecksum_data {
+ my ($data) = @_;
+ my $cshash = Digest::SHA->new(512)->add($data)->hexdigest;
+ return $cshash;
+}
+
+
+=pod
+
+=item C<< setup_gpg() >>
+
+Tries to set up gpg command line C<$::gpg> used for
+verification of downloads.
+
+Returns 1/0 on success/failure.
+
+=cut
+
+sub setup_gpg {
+ my $master = shift;
+ # first search for a gpg binary
+ return 0 if (!setup_unix_one( 'gpg' , '/no/such/path', '--version', 1));
+ # ok, we found one
+ # Set up the gpg invocation:
+ $::gpg = "$::progs{'gpg'} ";
+ my $gpghome = ($ENV{'TL_GNUPGHOME'} ? $ENV{'TL_GNUPGHOME'} :
+ "$master/tlpkg/gpg" );
+ $gpghome =~ s!/!\\!g if win32();
+ my $gpghome_quote = "\"$gpghome\"";
+ # mind the final space for following args
+ $::gpg .= "--homedir $gpghome_quote ";
+ if ($ENV{'TL_GNUPGARGS'}) {
+ $::gpg .= $ENV{'TL_GNUPGARGS'};
+ } else {
+ $::gpg .= "--no-secmem-warning --no-permission-warning ";
+ }
+ debug("gpg command line: $::gpg\n");
+ return 1;
+}
+
+=pod
+
+=item C<< slurp_file($file) >>
+
+Reads the whole file and returns the content in a scalar.
+
+=cut
+
+sub slurp_file {
+ my $file = shift;
+ my $file_data = do {
+ local $/ = undef;
+ open my $fh, "<", $file || die "open($file) failed: $!";
+ <$fh>;
+ };
+ return($file_data);
+}
+
+
+=pod
+
+=item C<< verify_checksum($file, $checksum_url) >>
+
+Verifies that C<$file> has checksum C<$checksum_url>.
+
+Returns 0 on success, -1 on connection error, 1 on checksum error.
+In case of errors returns an informal message as second argument.
+
+=cut
+
+sub verify_checksum {
+ my ($file, $checksum_url) = @_;
+ my $checksum_file = download_to_temp_or_file($checksum_url);
+ # next step is verification of tlpdb checksum with checksum file
+ # existenc of checksum_file was checked above
+ if (!$checksum_file) {
+ return(-1, "download did not succeed: $checksum_url");
+ }
+ # check the signature
+ my ($ret, $msg) = verify_signature($checksum_file, $checksum_url);
+ return ($ret, $msg) if ($ret != 0);
+
+ # verify local data
+ open $cs_fh, "<$checksum_file" or die("cannot read file: $!");
+ if (read ($cs_fh, $remote_digest, $ChecksumLength) != $ChecksumLength) {
+ close($cs_fh);
+ return(1, "incomplete read from $checksum_file");
+ } else {
+ close($cs_fh);
+ ddebug("found remote digest: $remote_digest\n");
+ }
+ $local_digest = tlchecksum($file);
+ ddebug("local_digest = $local_digest\n");
+ if ($local_digest ne $remote_digest) {
+ return(1, "digest disagree");
+ }
+
+ # we are still here, so checksum also succeeded
+ debug("checksum of local copy identical with remote hash\n");
+
+ return(0);
+}
+
+=pod
+
+=item C<< download_to_temp_or_file($url) >>
+
+If C<$url> tries to download the file into a temporary file.
+In both cases returns the local file.
+
+Returns the local file name if succeeded, otherwise undef.
+
+=cut
+
+sub download_to_temp_or_file {
+ my $url = shift;
+ my ($url_fh, $url_file);
+ if ($url =~ m,^(http|ftp|file)://,) {
+ ($url_fh, $url_file) = File::Temp::tempfile(UNLINK => 1);
+ # now $url_fh filehandle is open, the file created
+ # TLUtils::download_file will just overwrite what is there
+ # on windows that doesn't work, so we close the fh immediately
+ # this creates a short loophole, but much better than before anyway
+ close($url_fh);
+ $ret = download_file($url, $url_file);
+ } else {
+ $url_file = $url;
+ $ret = 1;
+ }
+ if ($ret && (-r "$url_file")) {
+ return $url_file;
+ }
+ return;
+}
+
+=pod
+
+=item C<< verify_signature($file, $url) >>
+
+Verifies a download of C<$url> into C<$file> by cheking the
+gpg signature in C<$url.asc>.
+
+Returns 0 on success, -1 on connection error, 1 on checksum error.
+In case of errors returns an informal message as second argument.
+
+=cut
+
+sub verify_signature {
+ my ($file, $url) = @_;
+ my $signature_url = "$url.asc";
+
+ # if we have $::gpg set, we try to verify cryptographic signatures
+ if ($::gpg) {
+ my $signature_file = download_to_temp_or_file($signature_url);
+ if ($signature_file) {
+ if (TeXLive::TLUtils::gpg_verify_signature($file, $signature_file)) {
+ info("cryptographic signature of $url verified\n");
+ } else {
+ return(1, <<GPGERROR);
+cryptograpic verification of
+ $file
+against
+ $signature_url
+failed. Please report to texlive\@tug.org
+GPGERROR
+ }
+ } else {
+ debug("no access to cryptographic signature $signature_url\n");
+ }
+ } else {
+ debug("gpg prog not defined, no checking of signatures\n");
+ }
+ return (0);
+}
+
+sub gpg_verify_signature {
+ my ($file, $sig) = @_;
+ my ($file_quote, $sig_quote);
+ if (win32()) {
+ $file =~ s!/!\\!g;
+ $sig =~ s!/!\\!g;
+ }
+ $file_quote = "\"$file\"";
+ $sig_quote = "\"$sig\"";
+ my ($out, $ret) = run_cmd("$::gpg --verify $sig_quote $file_quote 2>&1");
+ if ($ret == 0) {
+ debug("verification succeeded, output:\n$out\n");
+ return 1;
+ } else {
+ tlwarn("verification failed, output:\n$out\n");
+ return 0;
+ }
+}
+
#
# compare_tlpobjs
# returns a hash
diff --git a/Build/source/texk/texlive/linked_scripts/texlive/fmtutil.pl b/Build/source/texk/texlive/linked_scripts/texlive/fmtutil.pl
index 831b40b2e7e..05b9022488b 100755
--- a/Build/source/texk/texlive/linked_scripts/texlive/fmtutil.pl
+++ b/Build/source/texk/texlive/linked_scripts/texlive/fmtutil.pl
@@ -1,5 +1,5 @@
#!/usr/bin/env perl
-# $Id: fmtutil.pl 39813 2016-02-22 05:25:37Z preining $
+# $Id: fmtutil.pl 40475 2016-04-12 20:56:58Z karl $
# fmtutil - utility to maintain format files.
# (Maintained in TeX Live:Master/texmf-dist/scripts/texlive.)
#
@@ -24,11 +24,11 @@ BEGIN {
TeX::Update->import();
}
-my $svnid = '$Id: fmtutil.pl 39813 2016-02-22 05:25:37Z preining $';
-my $lastchdate = '$Date: 2016-02-22 06:25:37 +0100 (Mon, 22 Feb 2016) $';
+my $svnid = '$Id: fmtutil.pl 40475 2016-04-12 20:56:58Z karl $';
+my $lastchdate = '$Date: 2016-04-12 22:56:58 +0200 (Tue, 12 Apr 2016) $';
$lastchdate =~ s/^\$Date:\s*//;
$lastchdate =~ s/ \(.*$//;
-my $svnrev = '$Revision: 39813 $';
+my $svnrev = '$Revision: 40475 $';
$svnrev =~ s/^\$Revision:\s*//;
$svnrev =~ s/\s*\$$//;
my $version = "r$svnrev ($lastchdate)";
@@ -502,7 +502,7 @@ sub rebuild_one_format {
my $addargs = $alldata->{'merged'}{$fmt}{$eng}{'args'};
# running parameters
- my $texengine;
+ my $enginedir;
my $jobswitch = "-jobname=$fmt";
my $prgswitch = "-progname=" ;
my $recorderswitch = ($opts{'recorder'} ? "-recorder" : "");
@@ -533,15 +533,15 @@ sub rebuild_one_format {
if ($eng eq "mpost") {
$fmtfile .= ".mem" ;
$kpsefmt = "mp" ;
- $texengine = "metapost"; # the directory, not the executable
- } elsif ($eng =~ m/^mf(w|-nowin)?$/) {
+ $enginedir = "metapost"; # the directory, not the executable
+ } elsif ($eng =~ m/^mf(lua(jit)?)?(w|-nowin)?$/) {
$fmtfile .= ".base" ;
$kpsefmt = "mf" ;
- $texengine = "metafont";
+ $enginedir = "metafont";
} else {
$fmtfile .= ".fmt" ;
$kpsefmt = "tex" ;
- $texengine = $eng;
+ $enginedir = $eng;
}
# check for existence of ini file before doing anything else
@@ -663,7 +663,7 @@ sub rebuild_one_format {
if ($opts{'no-engine-subdir'}) {
$fulldestdir = $opts{'fmtdir'};
} else {
- $fulldestdir = "$opts{'fmtdir'}/$texengine";
+ $fulldestdir = "$opts{'fmtdir'}/$enginedir";
}
TeXLive::TLUtils::mkdirhier($fulldestdir);
diff --git a/Build/source/texk/texlive/linked_scripts/texlive/tlmgr.pl b/Build/source/texk/texlive/linked_scripts/texlive/tlmgr.pl
index 84adda21eca..4acb2998709 100755
--- a/Build/source/texk/texlive/linked_scripts/texlive/tlmgr.pl
+++ b/Build/source/texk/texlive/linked_scripts/texlive/tlmgr.pl
@@ -1,13 +1,13 @@
#!/usr/bin/env perl
-# $Id: tlmgr.pl 40376 2016-04-10 00:31:57Z preining $
+# $Id: tlmgr.pl 40467 2016-04-12 06:14:51Z preining $
#
# Copyright 2008-2016 Norbert Preining
# This file is licensed under the GNU General Public License version 2
# or any later version.
#
-my $svnrev = '$Revision: 40376 $';
-my $datrev = '$Date: 2016-04-10 02:31:57 +0200 (Sun, 10 Apr 2016) $';
+my $svnrev = '$Revision: 40467 $';
+my $datrev = '$Date: 2016-04-12 08:14:51 +0200 (Tue, 12 Apr 2016) $';
my $tlmgrrevision;
my $prg;
if ($svnrev =~ m/: ([0-9]+) /) {
@@ -74,9 +74,16 @@ BEGIN {
# if not in bootstrapping mode => kpsewhich exists, so use it to get $Master
chomp($Master = `kpsewhich -var-value=SELFAUTOPARENT`);
}
- $::installerdir = $Master;
- #
+ # if we have no directory in which to find our modules,
+ # no point in going on.
+ if (! $Master) {
+ die ("Could not determine directory of tlmgr executable, "
+ . "maybe shared library woes?\nCheck for error messages above");
+ }
+
+ $::installerdir = $Master; # for config.guess et al., see TLUtils.pm
+
# make Perl find our packages first:
unshift (@INC, "$Master/tlpkg");
unshift (@INC, "$Master/texmf-dist/scripts/texlive");
@@ -129,22 +136,6 @@ our $common_fmtutil_args =
$::gui_mode = 0;
$::machinereadable = 0;
-my %globaloptions = (
- "gui" => 1,
- "gui-lang" => "=s",
- "debug-translation" => 1,
- "location|repository|repo" => "=s",
- "machine-readable" => 1,
- "package-logfile" => "=s",
- "persistent-downloads" => "!",
- "no-execute-actions" => 1,
- "pin-file" => "=s",
- "pause" => 1,
- "print-platform|print-arch" => 1,
- "version" => 1,
- "help" => 1,
- "h|?" => 1);
-
my %action_specification = (
'_include_tlpobj' => {
"run-post" => 0,
@@ -347,6 +338,7 @@ sub main {
"print-platform|print-arch" => 1,
"usermode|user-mode" => 1,
"usertree|user-tree" => "=s",
+ "verify-downloads" => "!",
"version" => 1,
);
@@ -630,6 +622,21 @@ for the full story.\n";
}
}
+ #
+ # setup gpg if available
+ # first line: --(no-)verify-downloads was passed in (opts defined)
+ # second line: not passed in but in config
+ if ((defined($opts{"verify-downloads"}) && $opts{"verify-downloads"})
+ ||
+ (!defined($opts{"verify-downloads"}) && $config{"verify-downloads"})) {
+ if (TeXLive::TLUtils::setup_gpg($Master)) {
+ log("Trying to verify cryptographic signatures!\n")
+ } else {
+ tlwarn("Setting up gpg did not succeed!\n");
+ }
+ }
+
+
my $ret = execute_action($action, @ARGV);
# F_ERROR stops processing immediately, and prevents postactions from
@@ -2130,7 +2137,7 @@ sub write_w32_updater {
push (@rst_info, "$pkg ^($oldrev^)");
next if ($opts{"dry-run"});
# create backup; make_container expects file name in a format: some-name.r[0-9]+
- my ($size, $md5, $fullname) = $localtlp->make_container("tar", $root, $temp, "__BACKUP_$pkg.r$oldrev");
+ my ($size, $checksum, $fullname) = $localtlp->make_container("tar", $root, $temp, "__BACKUP_$pkg.r$oldrev");
if ($size <= 0) {
tlwarn("$prg: Creation of backup container of $pkg failed.\n");
return 1; # backup failed? abort
@@ -5499,11 +5506,16 @@ sub action_init_usertree {
#
sub action_conf {
my $arg = shift @ARGV;
+ my $ret = $F_OK;
+
if (!defined($arg)) {
texconfig_conf_mimic();
- return;
- }
- if ($arg eq "tlmgr" || $arg eq "texmf" || $arg eq "updmap") {
+
+ } elsif ($arg !~ /^(tlmgr|texmf|updmap)$/) {
+ warn "$prg: unknown conf arg: $arg (try tlmgr or texmf or updmap)\n";
+ $ret = $F_ERROR;
+
+ } else {
my ($fn,$cf);
if ($opts{'conffile'}) {
$fn = $opts{'conffile'} ;
@@ -5531,6 +5543,7 @@ sub action_conf {
}
} else {
info("$arg config file $fn not present\n");
+ $ret = $F_WARNING;
}
} else {
if (!defined($val)) {
@@ -5540,6 +5553,7 @@ sub action_conf {
$cf->delete_key($key);
} else {
info("$arg $key not defined, cannot remove ($fn)\n");
+ $ret = $F_WARNING;
}
} else {
if (defined($cf->value($key))) {
@@ -5561,6 +5575,7 @@ sub action_conf {
} else {
if (defined($opts{'delete'})) {
warning("$arg --delete and value for key $key given, don't know what to do!\n");
+ $ret = $F_ERROR;
} else {
info("setting $arg $key to $val (in $fn)\n");
$cf->value($key, $val);
@@ -5570,8 +5585,6 @@ sub action_conf {
if ($cf->is_changed) {
$cf->save;
}
- } else {
- warn "$prg: unknown conf arg: $arg (try tlmgr or texmf or updmap)\n";
}
}
@@ -5839,7 +5852,7 @@ sub setup_one_remotetlpdb {
my $local_copy_tlpdb_used = 0;
if ($location =~ m;^(http|ftp)://;) {
# first check that the saved tlpdb is present at all
- my $loc_digest = Digest::MD5::md5_hex($location);
+ my $loc_digest = TeXLive::TLUtils::tl_short_digest($location);
my $loc_copy_of_remote_tlpdb =
"$Master/$InfraLocation/texlive.tlpdb.$loc_digest";
ddebug("loc_digest = $loc_digest\n");
@@ -5848,11 +5861,11 @@ sub setup_one_remotetlpdb {
ddebug("loc copy found!\n");
# we found the tlpdb matching the current location
# check for the remote hash
- my $path = "$location/$InfraLocation/$DatabaseName.md5";
+ my $path = "$location/$InfraLocation/$DatabaseName.$TeXLive::TLConfig::ChecksumExtension";
ddebug("remote path of digest = $path\n");
- my $fh = TeXLive::TLUtils::download_file($path, "|");
- my $rem_digest;
- if (read ($fh, $rem_digest, 32) != 32) {
+
+ my ($ret, $msg) = TeXLive::TLUtils::verify_checksum($loc_copy_of_remote_tlpdb, $path);
+ if ($ret < 0) {
info(<<END_NO_INTERNET);
No connection to the internet.
Unable to download the checksum of the remote TeX Live database,
@@ -5865,25 +5878,20 @@ http://tug.org/texlive/doc/install-tl.html
END_NO_INTERNET
# above text duplicated in install-tl
-
$remotetlpdb = TeXLive::TLPDB->new(root => $location,
tlpdbfile => $loc_copy_of_remote_tlpdb);
$local_copy_tlpdb_used = 1;
+ } elsif ($ret > 0) {
+ # no problem, checksum is wrong, we need to get new tlpdb
} else {
- ddebug("found remote digest: $rem_digest\n");
- my $rem_copy_digest = TeXLive::TLUtils::tlmd5($loc_copy_of_remote_tlpdb);
- ddebug("rem_copy_digest = $rem_copy_digest\n");
- if ($rem_copy_digest eq $rem_digest) {
- debug("md5 of local copy identical with remote hash\n");
- $remotetlpdb = TeXLive::TLPDB->new(root => $location,
- tlpdbfile => $loc_copy_of_remote_tlpdb);
- $local_copy_tlpdb_used = 1;
- }
+ $remotetlpdb = TeXLive::TLPDB->new(root => $location,
+ tlpdbfile => $loc_copy_of_remote_tlpdb);
+ $local_copy_tlpdb_used = 1;
}
}
}
if (!$local_copy_tlpdb_used) {
- $remotetlpdb = TeXLive::TLPDB->new(root => $location);
+ $remotetlpdb = TeXLive::TLPDB->new(root => $location, verify => 1);
}
if (!defined($remotetlpdb)) {
return(undef, $loadmediasrcerror . $location);
@@ -5959,9 +5967,9 @@ FROZEN
# save remote database if it is a net location
# make sure that the writeout of the tlpdb is done in UNIX mode
- # since otherwise the sha256 will change.
+ # since otherwise the checksum will change.
if (!$local_copy_tlpdb_used && $location =~ m;^(http|ftp)://;) {
- my $loc_digest = Digest::MD5::md5_hex($location);
+ my $loc_digest = TeXLive::TLUtils::tl_short_digest($location);
my $loc_copy_of_remote_tlpdb =
"$Master/$InfraLocation/texlive.tlpdb.$loc_digest";
my $tlfh;
@@ -6016,6 +6024,8 @@ sub load_config_file {
#
# by default we remove packages
$config{"auto-remove"} = 1;
+ #
+ $config{"verify-downloads"} = 1;
# loads system config file, this cannot be changes with tlmgr
chomp (my $TEXMFSYSCONFIG = `kpsewhich -var-value=TEXMFSYSCONFIG`);
@@ -6068,6 +6078,15 @@ sub load_options_from_config {
tlwarn("$prg: $fn: Unknown value for auto-remove: $val\n");
}
+ } elsif ($key eq "verify-downloads") {
+ if ($val eq "0") {
+ $config{"verify-downloads"} = 0;
+ } elsif ($val eq "1") {
+ $config{"verify-downloads"} = 1;
+ } else {
+ tlwarn("$prg: $fn: Unknown value for verify-downloads: $val\n");
+ }
+
} elsif ($sysmode) {
# keys here are only allowed in sys mode
if ($key eq "allowed-actions") {
@@ -6430,6 +6449,15 @@ Activates user mode for this run of C<tlmgr>; see L<USER MODE> below.
Uses I<dir> for the tree in user mode; see L<USER MODE> below.
+=item B<--verify-downloads>
+
+=item B<--no-verify-downloads>
+
+Enables or disables cryptographic verification of downloaded database files.
+A working GnuPG (C<gpg>) binary needs to be present in the path, otherwise
+this option has no effect. See L<CRYPTOGRAPHIC VERIFICATION> below for details.
+
+
=back
The standard options for TeX Live programs are also accepted:
@@ -6545,7 +6573,8 @@ Live Database are present.
=item B<runfiles>
-List those filenames that are occurring more than one time in the runfiles.
+List those filenames that are occurring more than one time in the
+runfiles sections.
=back
@@ -6569,12 +6598,13 @@ like the C<texconfig conf> call, but works on all supported platforms.
With either C<conf texmf>, C<conf tlmgr>, or C<conf updmap> given in
addition, shows all key/value pairs (i.e., all settings) as saved in
-C<ROOT/texmf.cnf>, the tlmgr configuration file (see below), or the
+C<ROOT/texmf.cnf>, the C<tlmgr> configuration file (see below), or the
first found (via kpsewhich) C<updmap.cfg> file, respectively.
If I<key> is given in addition, shows the value of only that I<key> in
-the respective file. If option I<--delete> is also given, the
-configuration file -- it is removed, not just commented out!
+the respective file. If option I<--delete> is also given, the value in
+the given configuration file is entirely removed (not just commented
+out).
If I<value> is given in addition, I<key> is set to I<value> in the
respective file. I<No error checking is done!>
@@ -6582,9 +6612,13 @@ respective file. I<No error checking is done!>
In all cases the file used can be explicitly specified via the option
C<--conffile I<file>>, in case one wants to operate on a different file.
-Practical application: if the execution of (some or all) system commands
-via C<\write18> was left enabled during installation, you can disable
-it afterwards:
+The PATH value shown is that used by C<tlmgr>. The directory in which
+the C<tlmgr> executable is found is automatically prepended to the PATH
+value inherited from the environment.
+
+Practical application of changing configuration values: if the execution
+of (some or all) system commands via C<\write18> was left enabled during
+installation, you can disable it afterwards:
tlmgr conf texmf shell_escape 0
@@ -6726,7 +6760,7 @@ location in C<TEXMFLOCAL>).
=item B<--rebuild-sys>
-tells tlmgr to run necessary programs after config files have been
+tells C<tlmgr> to run necessary programs after config files have been
regenerated. These are:
C<fmtutil-sys --all> after C<generate fmtutil>,
C<fmtutil-sys --byhyphen .../language.dat> after C<generate language.dat>,
@@ -6790,10 +6824,8 @@ dependencies in a similar way.
=item B<--only-installed>
-If this options is given, the installation source will
-not be used; only locally installed packages, collections, or schemes
-are listed.
-(Does not work for listing of packages for now)
+If this option is given, the installation source will not be used; only
+locally installed packages, collections, or schemes are listed.
=back
@@ -6931,7 +6963,9 @@ is not likely to be of interest except perhaps to developers.
The C<docfiles> and C<srcfiles> options control the installation of
their respective files of a package. By default both are enabled (1).
-This can be disabled (set to 0) if disk space is (very) limited.
+Either or both can be disabled (set to 0) if disk space is limited or
+for minimal testing installations, etc. When disabled, the respective
+files are not downloaded at all.
The options C<autobackup> and C<backupdir> determine the defaults for
the actions C<update>, C<backup> and C<restore>. These three actions
@@ -7212,7 +7246,7 @@ Otherwise, if neither I<pkg> nor I<rev> are given, list the available
backup revisions for all packages. With I<pkg> given but no I<rev>,
list all available backup revisions of I<pkg>.
-When listing available packages tlmgr shows the revision, and in
+When listing available packages, C<tlmgr> shows the revision, and in
parenthesis the creation time if available (in format yyyy-mm-dd hh:mm).
If (and only if) both I<pkg> and a valid revision number I<rev> are
@@ -7484,6 +7518,25 @@ fallback information, but if you don't like them accumulating (e.g.,
on each run C<mirror.ctan.org> might resolve to a new host, resulting in
a different hash), it's harmless to delete them.
+=head1 CRYPTOGRAPHIC VERIFICATION
+
+If a working GnuPG binary (C<gpg>) is found, by default verification of
+downloaded files is performed. This can be supressed by specifying
+C<--no-verify-downloads> on the command line, or adding an entry
+C<verify-downloads = 0> to a tlmgr config file.
+
+Verification is performed as follows: For each C<texlive.tlpdb> loaded
+for a repository, the respective checksum C<texlive.tlpdb.sha512> is
+always downloaded, too, and C<tlmgr> confirms whether the checksum
+of the download tlpdb file agrees with the download data. This is done
+in any case.
+
+If cryptographic verification is done, then a signature of the checksum
+file is downloaded and the signature verified. The signature is done with
+the TeX Live Distribution GPG key 0x06BAB6BC, which in turn is signed
+by Karl Berry's key 0x9DEB46C0 and Norbert Preining's key 0x6CACA448.
+All of these keys are obtainable from the standard key servers.
+
=head1 USER MODE
C<tlmgr> provides a restricted way, called ``user mode'', to manage
@@ -7585,12 +7638,13 @@ ignored. All other lines must look like
where the allowed keys are C<gui-expertmode> (value 0 or 1),
C<persistent-downloads> (value 0 or 1), C<auto-remove> (value 0 or 1),
+C<verify-downloads> (value 0 or 1),
and C<gui-lang> (value as with the command-line option).
-C<persistent-downloads>, C<gui-lang>, and C<auto-remove> correspond to
-the respective command line options of the same name. C<gui-expertmode>
-switches between the full GUI and a simplified GUI with only the
-important and mostly used settings.
+C<persistent-downloads>, C<gui-lang>, C<auto-remove>, and C<verify-downloads>
+correspond to the respective command line options of the same name.
+C<gui-expertmode> switches between the full GUI and a simplified GUI
+with only the important and mostly used settings.
In addition, the system-wide config file can contain the key
C<allowed-actions>. The value is a comma-separated list of actions that
diff --git a/Master/tlpkg/tlpsrc/luatex.tlpsrc b/Master/tlpkg/tlpsrc/luatex.tlpsrc
index 07d72ed5bb0..b7088f705ea 100644
--- a/Master/tlpkg/tlpsrc/luatex.tlpsrc
+++ b/Master/tlpkg/tlpsrc/luatex.tlpsrc
@@ -11,7 +11,7 @@ execute AddFormat name=dviluatex engine=luatex options="dviluatex.ini" \
fmttriggers=${fmtdeps}
#
# On platforms where there is no luajittex, it will be ignored
-# due to special options in fmtutil and TLConfig.pm.
+# due to special options in fmtutil, TLConfig.pm, tlmgr.
execute AddFormat name=luajittex engine=luajittex options="luatex.ini" \
patterns=language.def,language.dat.lua \
fmttriggers=${fmtdeps},pdftex
diff --git a/Master/tlpkg/tlpsrc/mflua.tlpsrc b/Master/tlpkg/tlpsrc/mflua.tlpsrc
index 5b183aac723..e474287580d 100644
--- a/Master/tlpkg/tlpsrc/mflua.tlpsrc
+++ b/Master/tlpkg/tlpsrc/mflua.tlpsrc
@@ -5,8 +5,9 @@ tlpsetvar fmtdeps luatex,metafont
# disabled just until rebuilds for start_of_mf.lua are done.
execute AddFormat name=mflua engine=mflua-nowin options="mf.ini" \
fmttriggers=${fmtdeps} mode=disabled
-#
-# (mfluajit not ready)
+
+# (mfluajit not worth the complications this year; see luatex.tlpsrc for
+# references.)
runpattern d texmf-dist/scripts/mflua
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-11 18:49:01 +0000