summaryrefslogtreecommitdiff
path: root/Master/tlpkg/bin/tl-sign-file
diff options
context:
space:
mode:
Diffstat (limited to 'Master/tlpkg/bin/tl-sign-file')
-rwxr-xr-xMaster/tlpkg/bin/tl-sign-file88
1 files changed, 61 insertions, 27 deletions
diff --git a/Master/tlpkg/bin/tl-sign-file b/Master/tlpkg/bin/tl-sign-file
index fbe71a41179..f79a2256dcc 100755
--- a/Master/tlpkg/bin/tl-sign-file
+++ b/Master/tlpkg/bin/tl-sign-file
@@ -1,51 +1,85 @@
#!/bin/sh
# $Id$
-# Public domain. Originally written 2016, Norbert Preining.
-# Sign a file for release in TeX Live. Used in tl-update-images, etc.
-# See tlpkg/gpg/tl-key-extension.txt for some info.
+# Public domain. Originally written 2016, Norbert Preining.
+# Sign a file for release in TeX Live. Used in tl-update-images,
+# tl-update-tlnet, et al. See tlpkg/gpg/tl-key-extension.txt for some info.
if test $# -ne 1; then
echo "$0: Exactly one argument must be given, the file to sign." >&2
exit 1
fi
-# remove previous signature
+# remove previous signature else gpg will bail out.
rm -f "$1.asc"
-prg=gpg
-gpgopts="--batch --homedir /home/texlive/.gnupg \
+gpg_prog=gpg
+gpg_opts="--batch --homedir /home/texlive/.gnupg \
--passphrase-file /home/texlive/.gnupg/passphrase \
--local-user 0x06BAB6BC "
-gpgmainopts="--armor --detach-sign"
+gpg_sign_opts="--armor --detach-sign"
-# use the environment variables if available
-if test -n "$TL_GNUPG" ; then
- prg=$TL_GNUPG
+# use the environment variables if set. This is for testing;
+# we don't define them in normal usage.
+if test -n "$TL_GNUPG"; then
+ gpg_prog=$TL_GNUPG
fi
-if test -n "$TL_GNUPGOPTS" ; then
- gpgopts=$TL_GNUPGOPTS
+if test -n "$TL_GNUPGOPTS"; then
+ gpg_opts=$TL_GNUPGOPTS
fi
-if test -n "$TL_GNUPGMAINOPTS" ; then
- gpgmainopts=$TL_GNUPGMAINOPTS
+if test -n "$TL_GNUPG_SIGN_OPTS"; then
+ gpg_sign_opts=$TL_GNUPG_SIGN_OPTS
fi
-# sign, check that result doesn't use something expired.
+# sign, check that result is valid and doesn't use something expired.
# both --detach-sign and --verify exit 0 even when something is expired.
-if "$prg" $gpgmainopts $gpgopts "$1"; then
- if "$prg" --verify "$1".asc 2>&1 | grep xpired >/dev/null; then
- echo "$0: expired key, output from $prg --verify $1.asc:" >&2
- "$prg" --verify "$1".asc
- echo "$0: expired key, moving $1.asc to $1.asc.xpir." >&2
- mv "$1".asc "$1".asc.xpir || exit 1
- echo "$0: gpg command was:" >&2
- echo "$0:" "$prg" $gpgmainopts $gpgopts "$1" >&2
- echo "$0: good luck and goodbye." >&2
+if $gpg_prog $gpg_sign_opts $gpg_opts "$1"; then
+ status_out=`mktemp`
+ verify_out=`mktemp`
+ verify_cmd="$gpg_prog $gpg_opts --status-file=$status_out --verify --verbose"
+ if $verify_cmd "$1".asc >$verify_out 2>&1; then
+ if grep EXPKEYSIG $status_out >/dev/null; then
+ err="expired key"
+ elif grep REVKEYSIG $status_out >/dev/null; then
+ err="revoked key"
+ else
+ err= # ok we hope
+ fi
+ else
+ err="other error ($?)"
+ fi
+ if test -n "$err"; then
+ echo "$0: gpg verification failed." >&2
+ if test -r "$1".asc; then
+ echo "$0: moving $1.asc to $1.asc.badv." >&2
+ mv "$1".asc "$1".asc.badv || exit 1
+ else
+ echo "$0: no file $1.asc" >&2
+ fi
+ echo "$0: gpg verify command was:" >&2
+ echo "$0: $verify_cmd" "$1" >&2
+ echo "$0: STATUS FILE OUTPUT:" >&2
+ cat $status_out >&2
+ echo "$0: -------------------" >&2
+ echo "$0: STDOUT/STDERR:" >&2
+ cat $verify_out >&2
+ echo "$0: -------------------" >&2
+ echo "$0: goodbye and good luck." >&2
+ rm -f $status_out $verify_out
exit 1
fi
-else
- echo "$0: gpg failed, exiting." >&2
+ rm -f $status_out $verify_out
+
+else # the original gpg run failed.
+ echo "$0: gpg signing failed." >&2
+ if test -r "$1".asc; then
+ echo "$0: moving $1.asc to $1.asc.bads." >&2
+ mv "$1".asc "$1".asc.bads || exit 1
+ else
+ echo "$0: no file $1.asc" >&2
+ fi
echo "$0: gpg command was:" >&2
- echo "$0:" "$prg" $gpgmainopts $gpgopts "$1" >&2
+ echo "$0: $gpg_prog $gpg_sign_opts $gpg_opts" "$1" >&2
+ echo "$0: goodbye and good luck." >&2
exit 1
fi