diff options
Diffstat (limited to 'Master/tlpkg/bin/tl-sign-file')
-rwxr-xr-x | Master/tlpkg/bin/tl-sign-file | 72 |
1 files changed, 15 insertions, 57 deletions
diff --git a/Master/tlpkg/bin/tl-sign-file b/Master/tlpkg/bin/tl-sign-file index f79a2256dcc..05acf1a81e6 100755 --- a/Master/tlpkg/bin/tl-sign-file +++ b/Master/tlpkg/bin/tl-sign-file @@ -3,73 +3,31 @@ # Public domain. Originally written 2016, Norbert Preining. # Sign a file for release in TeX Live. Used in tl-update-images, # tl-update-tlnet, et al. See tlpkg/gpg/tl-key-extension.txt for some info. +# Perhaps someday we will rename this to tlgpg-sign at some point, +# to be more parallel with tlgpg-verify. if test $# -ne 1; then echo "$0: Exactly one argument must be given, the file to sign." >&2 exit 1 fi -# remove previous signature else gpg will bail out. -rm -f "$1.asc" - -gpg_prog=gpg -gpg_opts="--batch --homedir /home/texlive/.gnupg \ - --passphrase-file /home/texlive/.gnupg/passphrase \ - --local-user 0x06BAB6BC " -gpg_sign_opts="--armor --detach-sign" +mydir=`cd \`dirname $0\` && pwd` +PATH=$mydir:$PATH # for our tlgpg* commands -# use the environment variables if set. This is for testing; -# we don't define them in normal usage. -if test -n "$TL_GNUPG"; then - gpg_prog=$TL_GNUPG -fi -if test -n "$TL_GNUPGOPTS"; then - gpg_opts=$TL_GNUPGOPTS -fi -if test -n "$TL_GNUPG_SIGN_OPTS"; then - gpg_sign_opts=$TL_GNUPG_SIGN_OPTS -fi +# remove any previous signature, else gpg will bail out. +rm -f "$1.asc" -# sign, check that result is valid and doesn't use something expired. -# both --detach-sign and --verify exit 0 even when something is expired. -if $gpg_prog $gpg_sign_opts $gpg_opts "$1"; then - status_out=`mktemp` - verify_out=`mktemp` - verify_cmd="$gpg_prog $gpg_opts --status-file=$status_out --verify --verbose" - if $verify_cmd "$1".asc >$verify_out 2>&1; then - if grep EXPKEYSIG $status_out >/dev/null; then - err="expired key" - elif grep REVKEYSIG $status_out >/dev/null; then - err="revoked key" - else - err= # ok we hope - fi - else - err="other error ($?)" - fi - if test -n "$err"; then - echo "$0: gpg verification failed." >&2 - if test -r "$1".asc; then - echo "$0: moving $1.asc to $1.asc.badv." >&2 - mv "$1".asc "$1".asc.badv || exit 1 - else - echo "$0: no file $1.asc" >&2 - fi - echo "$0: gpg verify command was:" >&2 - echo "$0: $verify_cmd" "$1" >&2 - echo "$0: STATUS FILE OUTPUT:" >&2 - cat $status_out >&2 - echo "$0: -------------------" >&2 - echo "$0: STDOUT/STDERR:" >&2 - cat $verify_out >&2 - echo "$0: -------------------" >&2 - echo "$0: goodbye and good luck." >&2 - rm -f $status_out $verify_out +sign_cmd="tlgpg --detach-sign --armor" +if $sign_cmd "$1"; then + # signing will succeed even with expired keys and other problems, so + # do verification; our tlpgpg-verify script will report the errors, so + # just exit if it fails. + if tlgpg-verify "$1"; then :; else + echo "$0: gpg signing did not verify, exiting." >&2 exit 1 fi - rm -f $status_out $verify_out - -else # the original gpg run failed. + +else # original gpg signing failed. echo "$0: gpg signing failed." >&2 if test -r "$1".asc; then echo "$0: moving $1.asc to $1.asc.bads." >&2 |