summaryrefslogtreecommitdiff
path: root/Master/tlpkg
diff options
context:
space:
mode:
Diffstat (limited to 'Master/tlpkg')
-rwxr-xr-xMaster/tlpkg/bin/tl-sign-file23
-rw-r--r--Master/tlpkg/gpg/tl-key-extension.txt7
2 files changed, 26 insertions, 4 deletions
diff --git a/Master/tlpkg/bin/tl-sign-file b/Master/tlpkg/bin/tl-sign-file
index bab1d5fdff0..fbe71a41179 100755
--- a/Master/tlpkg/bin/tl-sign-file
+++ b/Master/tlpkg/bin/tl-sign-file
@@ -29,5 +29,24 @@ if test -n "$TL_GNUPGMAINOPTS" ; then
gpgmainopts=$TL_GNUPGMAINOPTS
fi
-# sign
-"$prg" $gpgmainopts $gpgopts "$1"
+# sign, check that result doesn't use something expired.
+# both --detach-sign and --verify exit 0 even when something is expired.
+if "$prg" $gpgmainopts $gpgopts "$1"; then
+ if "$prg" --verify "$1".asc 2>&1 | grep xpired >/dev/null; then
+ echo "$0: expired key, output from $prg --verify $1.asc:" >&2
+ "$prg" --verify "$1".asc
+ echo "$0: expired key, moving $1.asc to $1.asc.xpir." >&2
+ mv "$1".asc "$1".asc.xpir || exit 1
+ echo "$0: gpg command was:" >&2
+ echo "$0:" "$prg" $gpgmainopts $gpgopts "$1" >&2
+ echo "$0: good luck and goodbye." >&2
+ exit 1
+ fi
+else
+ echo "$0: gpg failed, exiting." >&2
+ echo "$0: gpg command was:" >&2
+ echo "$0:" "$prg" $gpgmainopts $gpgopts "$1" >&2
+ exit 1
+fi
+
+exit 0
diff --git a/Master/tlpkg/gpg/tl-key-extension.txt b/Master/tlpkg/gpg/tl-key-extension.txt
index dcd14e279f0..0ceeab2c69d 100644
--- a/Master/tlpkg/gpg/tl-key-extension.txt
+++ b/Master/tlpkg/gpg/tl-key-extension.txt
@@ -4,13 +4,12 @@ $Id$
How to update TeX Live distribution signing key
===============================================
-this should be done every year during the pretest.
+This must be done every year! It's not optional.
shut down networking service
cp gpg directory from USB stick to computer
-
export GNUPGHOME=...<COPY OF USBSTICK gpg directory>
export KEYID=0xC78B82D8C79512F79CC0D7C80D5E5D9106BAB6BC
gpg --edit-key $KEYID
@@ -44,3 +43,7 @@ svn/git commit
# texlive.asc, see above how to export it)
gpg --homedir ~texlive/.gnupg --import texlive.asc
+
+More info:
+. we use tlpkg/bin/tl-sign-file to sign texlive.tlpdb.
+. gpg --verify --verbose foo.asc for info on signature of file.