diff options
Diffstat (limited to 'Master/tlpkg/gpg')
| -rw-r--r-- | Master/tlpkg/gpg/tl-key-extension.txt | 28 |
1 files changed, 20 insertions, 8 deletions
diff --git a/Master/tlpkg/gpg/tl-key-extension.txt b/Master/tlpkg/gpg/tl-key-extension.txt index 6c4569a410f..4157e0fca4b 100644 --- a/Master/tlpkg/gpg/tl-key-extension.txt +++ b/Master/tlpkg/gpg/tl-key-extension.txt @@ -30,30 +30,42 @@ unset GNUPGHOME gpg --send-keys $KEYID - # update TeX Live repository -export GNUPGHOME=/path/to/texlive-svn/Master/tlpkg/gpg +export GNUPGHOME=/home/texlive/Master/tlpkg/gpg # wherever svn checkout # use gpg version 1 here!!! gpg1 --import texlive.asc -svn/git commit +svn commit # on the TUG server (needs the exported public key in # texlive.asc, see above how to export it) -gpg --homedir ~texlive/.gnupg --import texlive.asc +gpg --homedir /home/texlive/.gnupg --import texlive.asc # can view that .asc with: -gpg --show-keyring texlive.asc +gpg --homedir /home/texlive/.gnupg texlive.asc # update web-accessible public key, keeping old files but updating symlink: cp texlive.asc ~www/texlive/files/texlive`date +%Y`.asc ln -s texlive`date +%Y`.asc ~www/texlive/files/texlive.asc More info: -. we use tlpkg/bin/tl-sign-file to sign texlive.tlpdb.sha512. -. gpg --verify --verbose foo.asc for info on signature file. +. tlgpg runs a gpg command with the above TL .gnupg directory, etc. + +. tl-sign-file (uses tlgpg) is used to sign texlive.tlpdb.sha512. + +. tlgpg-verify foo[.asc] will check for expired key, per below. + tl-sign-file uses this to make sure it is not signing with an expired key. + +. (tl)gpg foo.asc will sometimes report expiration info. + +. given files updated in Master/tlpkg/gpg, can export into asc: +gpg --homedir ..../Master/tlpkg/gpg --export -a 0x0D5E5D9106BAB6BC >tl.asc + +. gpg --verify --verbose foo.asc reports some info. + . but exit status is zero even with expired keys; to check, use --status-file and inspect: gpg --verify --verbose --status-file=/tmp/st foo.asc -. see tl-sign-file or TLCrypto.pm for full implementation. + +. see tlgpg, tl-sign-file, TLCrypto.pm for full implementation. |