summaryrefslogtreecommitdiff
path: root/Master/tlpkg/bin/tl-sign-file
diff options
context:
space:
mode:
Diffstat (limited to 'Master/tlpkg/bin/tl-sign-file')
-rwxr-xr-xMaster/tlpkg/bin/tl-sign-file72
1 files changed, 15 insertions, 57 deletions
diff --git a/Master/tlpkg/bin/tl-sign-file b/Master/tlpkg/bin/tl-sign-file
index f79a2256dcc..05acf1a81e6 100755
--- a/Master/tlpkg/bin/tl-sign-file
+++ b/Master/tlpkg/bin/tl-sign-file
@@ -3,73 +3,31 @@
# Public domain. Originally written 2016, Norbert Preining.
# Sign a file for release in TeX Live. Used in tl-update-images,
# tl-update-tlnet, et al. See tlpkg/gpg/tl-key-extension.txt for some info.
+# Perhaps someday we will rename this to tlgpg-sign at some point,
+# to be more parallel with tlgpg-verify.
if test $# -ne 1; then
echo "$0: Exactly one argument must be given, the file to sign." >&2
exit 1
fi
-# remove previous signature else gpg will bail out.
-rm -f "$1.asc"
-
-gpg_prog=gpg
-gpg_opts="--batch --homedir /home/texlive/.gnupg \
- --passphrase-file /home/texlive/.gnupg/passphrase \
- --local-user 0x06BAB6BC "
-gpg_sign_opts="--armor --detach-sign"
+mydir=`cd \`dirname $0\` && pwd`
+PATH=$mydir:$PATH # for our tlgpg* commands
-# use the environment variables if set. This is for testing;
-# we don't define them in normal usage.
-if test -n "$TL_GNUPG"; then
- gpg_prog=$TL_GNUPG
-fi
-if test -n "$TL_GNUPGOPTS"; then
- gpg_opts=$TL_GNUPGOPTS
-fi
-if test -n "$TL_GNUPG_SIGN_OPTS"; then
- gpg_sign_opts=$TL_GNUPG_SIGN_OPTS
-fi
+# remove any previous signature, else gpg will bail out.
+rm -f "$1.asc"
-# sign, check that result is valid and doesn't use something expired.
-# both --detach-sign and --verify exit 0 even when something is expired.
-if $gpg_prog $gpg_sign_opts $gpg_opts "$1"; then
- status_out=`mktemp`
- verify_out=`mktemp`
- verify_cmd="$gpg_prog $gpg_opts --status-file=$status_out --verify --verbose"
- if $verify_cmd "$1".asc >$verify_out 2>&1; then
- if grep EXPKEYSIG $status_out >/dev/null; then
- err="expired key"
- elif grep REVKEYSIG $status_out >/dev/null; then
- err="revoked key"
- else
- err= # ok we hope
- fi
- else
- err="other error ($?)"
- fi
- if test -n "$err"; then
- echo "$0: gpg verification failed." >&2
- if test -r "$1".asc; then
- echo "$0: moving $1.asc to $1.asc.badv." >&2
- mv "$1".asc "$1".asc.badv || exit 1
- else
- echo "$0: no file $1.asc" >&2
- fi
- echo "$0: gpg verify command was:" >&2
- echo "$0: $verify_cmd" "$1" >&2
- echo "$0: STATUS FILE OUTPUT:" >&2
- cat $status_out >&2
- echo "$0: -------------------" >&2
- echo "$0: STDOUT/STDERR:" >&2
- cat $verify_out >&2
- echo "$0: -------------------" >&2
- echo "$0: goodbye and good luck." >&2
- rm -f $status_out $verify_out
+sign_cmd="tlgpg --detach-sign --armor"
+if $sign_cmd "$1"; then
+ # signing will succeed even with expired keys and other problems, so
+ # do verification; our tlpgpg-verify script will report the errors, so
+ # just exit if it fails.
+ if tlgpg-verify "$1"; then :; else
+ echo "$0: gpg signing did not verify, exiting." >&2
exit 1
fi
- rm -f $status_out $verify_out
-
-else # the original gpg run failed.
+
+else # original gpg signing failed.
echo "$0: gpg signing failed." >&2
if test -r "$1".asc; then
echo "$0: moving $1.asc to $1.asc.bads." >&2