From 5413e02cb51c0edb633e91c9d4392544deb8182a Mon Sep 17 00:00:00 2001 From: Norbert Preining Date: Thu, 5 May 2016 02:15:12 +0000 Subject: continue despite missing pubkey, report details for failed verification git-svn-id: svn://tug.org/texlive/trunk@40898 c570f23f-e606-0410-a88d-b1316a301751 --- Master/tlpkg/TeXLive/TLCrypto.pm | 22 +++++++++++++++++----- Master/tlpkg/TeXLive/TLPDB.pm | 31 +++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+), 5 deletions(-) (limited to 'Master/tlpkg') diff --git a/Master/tlpkg/TeXLive/TLCrypto.pm b/Master/tlpkg/TeXLive/TLCrypto.pm index ecfb7797dc7..f604b2b4f39 100644 --- a/Master/tlpkg/TeXLive/TLCrypto.pm +++ b/Master/tlpkg/TeXLive/TLCrypto.pm @@ -203,8 +203,8 @@ Verifies that C<$file> has checksum C<$checksum_url>, and if gpg is available also verifies that the checksum is signed. Returns 0 on success, -1 on connection error, -2 on missing signature -file, -3 if no gpg program is available, 1 on checksum, -and 2 on signature errors. +file, -3 if no gpg program is available, -4 if the pubkey is not +available, 1 on checksum errors, and 2 on signature errors. In case of errors returns an informal message as second argument. =cut @@ -363,7 +363,7 @@ Verifies a download of C<$url> into C<$file> by cheking the gpg signature in C<$url.asc>. Returns 0 on success, -2 on missing signature file, 2 on signature error, -and -3 if no gpg is available. +-3 if no gpg is available, and -4 if a pubkey is missing. In case of errors returns an informal message as second argument. =cut @@ -378,10 +378,12 @@ sub verify_signature { = TeXLive::TLUtils::download_to_temp_or_file($signature_url); if ($signature_file) { my ($ret, $out) = gpg_verify_signature($file, $signature_file); - if ($ret) { + if ($ret == 1) { # no need to show the output debug("cryptographic signature of $url verified\n"); return(0); + } elsif ($ret == -1) { + return(-4, $out); } else { return(2, < 1); + close($status_fh); my ($out, $ret) - = TeXLive::TLUtils::run_cmd("$::gpg --verify $sig_quote $file_quote 2>&1"); + = TeXLive::TLUtils::run_cmd("$::gpg --status-file \"$status_file\" --verify $sig_quote $file_quote 2>&1"); if ($ret == 0) { debug("verification succeeded, output:\n$out\n"); return (1, $out); } else { + open($status_fd, "<", $status_file) || die("Cannot open status file: $!"); + while (<$status_fd>) { + if (m/^\[GNUPG:\] NO_PUBKEY (.*)/) { + close($status_fd); + debug("missing pubkey $1\n"); + return (-1, "missing pubkey $1"); + } + } return (0, $out); } } diff --git a/Master/tlpkg/TeXLive/TLPDB.pm b/Master/tlpkg/TeXLive/TLPDB.pm index aa2c7f51040..b82d747c2bb 100644 --- a/Master/tlpkg/TeXLive/TLPDB.pm +++ b/Master/tlpkg/TeXLive/TLPDB.pm @@ -51,6 +51,7 @@ C -- A database of TeX Live Packages $tlpdb->location; $tlpdb->platform; $tlpdb->is_verified; + $tlpdb->verification_status; $tlpdb->config_src_container; $tlpdb->config_doc_container; $tlpdb->config_container_format; @@ -270,6 +271,7 @@ sub from_file { } else { $self->root($root_from_path); } + $self->verification_status("unknown"); my $retfh; my $tlpdbfile; my $is_verified = 0; @@ -373,10 +375,16 @@ sub from_file { tldie("$0: connection problems, cannot download: $m\n"); } elsif ($r == -2) { debug("$0: remote database checksum is not signed, continuing anyway!\n"); + $self->verification_status("not signed"); } elsif ($r == -3) { debug("$0: TLPDB: no gpg available, continuing anyway!\n"); + $self->verification_status("gnupg not available"); + } elsif ($r == -4) { + debug("$0: TLPDB: pubkey missing, continuing anyway!\n"); + $self->verification_status("pubkey missing"); } elsif ($r == 0) { $is_verified = 1; + $self->verification_status("verified"); } else { tldie("$0: unexpected return value from verify_checksum: $r\n"); } @@ -393,8 +401,13 @@ sub from_file { tldie("$0: connection problems, cannot download: $m\n"); } elsif ($r == -2) { debug("$0: remote database checksum is not signed, continuing anyway!\n"); + $self->verification_status("not signed"); } elsif ($r == -3) { debug("$0: TLPDB: no gpg available, continuing anyway!\n"); + $self->verification_status("gnupg not available"); + } elsif ($r == -4) { + debug("$0: TLPDB: pubkey missing, continuing anyway!\n"); + $self->verification_status("pubkey missing"); } elsif ($r == 0) { $is_verified = 1; } else { @@ -1160,6 +1173,24 @@ sub is_verified { if (@_) { $self->{'verified'} = shift } return $self->{'verified'}; } +=pod + +=item C<< $tlpdb->verification_status >> + +Returns a short textual explanation of the verification status. +In particular if the database is not verified, it returns the reason. + +=cut + +sub verification_status { + my $self = shift; + if ($self->is_virtual) { + tlwarn("TLPDB: cannot set/edit verification status of a virtual tlpdb\n"); + return 0; + } + if (@_) { $self->{'verification_status'} = shift } + return $self->{'verification_status'}; +} =pod -- cgit v1.2.3