1 files changed, 43 insertions, 13 deletions

diff --git a/Master/texmf-dist/scripts/texlive/tlmgr.pl b/Master/texmf-dist/scripts/texlive/tlmgr.pl
index e7060a3d1fa..c6218f3d6d9 100755
--- a/Master/texmf-dist/scripts/texlive/tlmgr.pl
+++ b/Master/texmf-dist/scripts/texlive/tlmgr.pl
@@ -623,20 +623,48 @@ for the full story.\n";
   }
 
   # setup gpg if available
-  # first line: --(no-)verify-downloads was passed in (opts defined)
-  # second line: not passed in but in config
-  if ((defined($opts{"verify-downloads"}) && $opts{"verify-downloads"})
-      ||
-      (!defined($opts{"verify-downloads"}) && $config{"verify-downloads"})) {
-    if (TeXLive::TLUtils::setup_gpg($Master)) {
-      log("will verify cryptographic signatures\n")
+  # by default we setup gpg
+  {
+    # default value
+    my $do_setup_gpg = 1;
+    # the value is set in the config file
+    if (defined($config{'verify-downloads'})) {
+      $do_setup_gpg = $config{'verify-downloads'};
+    }
+    # command line
+    if (defined($opts{'verify-downloads'})) {
+      $do_setup_gpg = $opts{'verify-downloads'};
+    }
+    # now we know whether we setup gpg or not
+    if ($do_setup_gpg) {
+      if (TeXLive::TLUtils::setup_gpg($Master)) {
+        log("will verify cryptographic signatures\n")
+      } else {
+        my $prefix = "$prg: No gpg found"; # just to shorten the strings
+        if ($opts{'verify-downloads'}) {
+          # verification was requested on the command line, but did not succeed, die
+          tldie("$prefix, verification explicitly requested on command line, quitting.\n");
+        }
+        if ($config{'verify-downloads'}) {
+          # verification explicitely requested in config file, but not gpg, die
+          tldie("$prefix, verification explicitly requested in config file, quitting.\n");
+        }
+        # it was requested via the default setting, so just warn
+        info ("$prefix, verification implicitly requested, "
+              . "continuing without verification\n");
+      }
     } else {
-      my $prefix = "$prg: No gpg found"; # just to shorten the strings
-      if ($opts{"verify-downloads"}) {
-        tldie ("$prefix, verification explicitly requested, quitting.\n");
+      # we do not setup gpg: when explicitly requested, be silent, otherwise info
+      my $prefix = "$prg: not setting up gpg";
+      if (defined($opts{'verify-downloads'})) {
+        # log normally is *NOT* logged to a file
+        # tlmgr does by default *NOT* set up a log file (cmd line option)
+        # user requested it, so don't bother with output
+        log("$prefix, requested on command line\n");
+      } elsif (defined($config{'verify-downloads'})) {
+        log("$prefix, requested in config file\n");
       } else {
-        log ("$prefix, verification implicitly requested, "
-             . "continuing without verification\n");
+        tldie("$prg: how could this happen? gpg setup.\n");
       }
     }
   }
@@ -6029,7 +6057,9 @@ sub load_config_file {
   # by default we remove packages
   $config{"auto-remove"} = 1;
   #
-  $config{"verify-downloads"} = 1;
+  # do NOT set this here, we distinguish between explicitly set in the config file
+  # or implicitly true
+  # $config{"verify-downloads"} = 1;
 
   # loads system config file, this cannot be changes with tlmgr
   chomp (my $TEXMFSYSCONFIG = `kpsewhich -var-value=TEXMFSYSCONFIG`);