diff options
| -rwxr-xr-x | Master/texmf-dist/scripts/texlive/tlmgr.pl | 17 | ||||
| -rw-r--r-- | Master/tlpkg/TeXLive/TLPDB.pm | 26 | ||||
| -rw-r--r-- | Master/tlpkg/TeXLive/TLUtils.pm | 32 |
3 files changed, 54 insertions, 21 deletions
diff --git a/Master/texmf-dist/scripts/texlive/tlmgr.pl b/Master/texmf-dist/scripts/texlive/tlmgr.pl index 8c419844a45..0576c5d7767 100755 --- a/Master/texmf-dist/scripts/texlive/tlmgr.pl +++ b/Master/texmf-dist/scripts/texlive/tlmgr.pl @@ -5819,7 +5819,8 @@ sub init_tlmedia { # this "location-url" line should not be changed since GUI programs # depend on it: print "location-url\t$locstr\n" if $::machinereadable; - info("$prg: package repositories:\n"); + info("$prg: package repositories" . + ($::gpg ? " (all verified)" : "") . ":\n"); info("\tmain = " . $repos{'main'} . "\n"); for my $t (@tags) { if ($t ne 'main') { @@ -5858,7 +5859,8 @@ sub _init_tlmedia { # this "location-url" line should not be changed since GUI programs # depend on it: print "location-url\t$location\n" if $::machinereadable; - info("$prg: package repository $location\n"); + info("$prg: package repository $location" . + ($::gpg ? " (verified)" : "") . "\n"); return 1; } @@ -5917,12 +5919,19 @@ END_NO_INTERNET $remotetlpdb = TeXLive::TLPDB->new(root => $location, tlpdbfile => $loc_copy_of_remote_tlpdb); $local_copy_tlpdb_used = 1; - } elsif ($ret > 0) { + } elsif ($ret == 1) { # no problem, checksum is wrong, we need to get new tlpdb - } else { + } elsif ($ret == 2) { + # umpf, signature error + # TODO should we die here? Probably yes because one of + # checksum file or signature file has changed! + tldie("$0: verification of checksum for $location failed: $msg\n"); + } elsif ($ret == 0) { $remotetlpdb = TeXLive::TLPDB->new(root => $location, tlpdbfile => $loc_copy_of_remote_tlpdb); $local_copy_tlpdb_used = 1; + } else { + tldie("$0: unexpected return value from verify_checksum: $ret\n"); } } } diff --git a/Master/tlpkg/TeXLive/TLPDB.pm b/Master/tlpkg/TeXLive/TLPDB.pm index a3c22358000..65999bfc9a5 100644 --- a/Master/tlpkg/TeXLive/TLPDB.pm +++ b/Master/tlpkg/TeXLive/TLPDB.pm @@ -368,18 +368,32 @@ sub from_file { # before we open and proceed, verify the downloaded file if ($params{'verify'} && $media ne 'local_uncompressed') { my ($r, $m) = TeXLive::TLUtils::verify_checksum($tlpdbfile, "$path.$TeXLive::TLConfig::ChecksumExtension"); - # TODO here we could check for -1 as return value - # which would indicate that the checksum could not be downloaded! - if ($r != 0) { - tldie("$0: verification of $tlpdbfile from $path failed ($r): $m\n"); + if ($r == 1) { + tldie("$0: checksum error when downloading $tlpdbfile from $path: $m\n"); + } elsif ($r == 2) { + tldie("$0: signature verification error of $tlpdbfile from $path: $m\n"); + } elsif ($r == -1) { + tldie("$0: connection problems, cannot download: $m\n"); + } elsif ($r == 0) { + # all is fine, do nothing + } else { + tldie("$0: unexpected return value from verify_checksum: $r\n"); } } open($retfh, "<$tlpdbfile") || die "$0: open($tlpdbfile) failed: $!"; } else { if ($params{'verify'} && $media ne 'local_uncompressed') { my ($r, $m) = TeXLive::TLUtils::verify_checksum($path, "$path.$TeXLive::TLConfig::ChecksumExtension"); - if ($r != 0) { - tldie("$0: verification of $path failed ($r): $m\n"); + if ($r == 1) { + tldie("$0: checksum error when downloading $tlpdbfile from $path: $m\n"); + } elsif ($r == 2) { + tldie("$0: signature verification error of $tlpdbfile from $path: $m\n"); + } elsif ($r == -1) { + tldie("$0: connection problems, cannot download: $m\n"); + } elsif ($r == 0) { + # all is fine, do nothing + } else { + tldie("$0: unexpected return value from verify_checksum: $r\n"); } } open(TMP, "<$path") || die "$0: open($path) failed: $!"; diff --git a/Master/tlpkg/TeXLive/TLUtils.pm b/Master/tlpkg/TeXLive/TLUtils.pm index 8de05ee9d75..dc3c909df08 100644 --- a/Master/tlpkg/TeXLive/TLUtils.pm +++ b/Master/tlpkg/TeXLive/TLUtils.pm @@ -3750,9 +3750,11 @@ sub slurp_file { =item C<< verify_checksum($file, $checksum_url) >> -Verifies that C<$file> has checksum C<$checksum_url>. +Verifies that C<$file> has checksum C<$checksum_url>, and if gpg is +available also verifies that the checksum is signed. -Returns 0 on success, -1 on connection error, 1 on checksum error. +Returns 0 on success, -1 on connection error, 1 on checksum, and +2 on signature errors. In case of errors returns an informal message as second argument. =cut @@ -3829,7 +3831,7 @@ sub download_to_temp_or_file { Verifies a download of C<$url> into C<$file> by cheking the gpg signature in C<$url.asc>. -Returns 0 on success, -1 on connection error, 1 on checksum error. +Returns 0 on success, -1 on connection error, 2 on signature error. In case of errors returns an informal message as second argument. =cut @@ -3842,23 +3844,32 @@ sub verify_signature { if ($::gpg) { my $signature_file = download_to_temp_or_file($signature_url); if ($signature_file) { - if (TeXLive::TLUtils::gpg_verify_signature($file, $signature_file)) { - info("cryptographic signature of $url verified\n"); + my ($ret, $out) = gpg_verify_signature($file, $signature_file); + if ($ret) { + # no need to show the output + debug("cryptographic signature of $url verified\n"); + return(0); } else { - return(1, <<GPGERROR); -cryptograpic verification of + return(2, <<GPGERROR); +cryptographic signature verification of $file against $signature_url -failed. Please report to texlive\@tug.org +failed. Output was +$out +Please report to texlive\@tug.org GPGERROR } } else { debug("no access to cryptographic signature $signature_url\n"); + return(-1); } } else { debug("gpg prog not defined, no checking of signatures\n"); + # we return 0 (= success) if not gpg is available + return(0); } + # not reached return (0); } @@ -3874,10 +3885,9 @@ sub gpg_verify_signature { my ($out, $ret) = run_cmd("$::gpg --verify $sig_quote $file_quote 2>&1"); if ($ret == 0) { debug("verification succeeded, output:\n$out\n"); - return 1; + return (1, $out); } else { - tlwarn("verification failed, output:\n$out\n"); - return 0; + return (0, $out); } } |