From e719ab18f9340385da8271019ce9548d032a4c26 Mon Sep 17 00:00:00 2001 From: Norbert Preining Date: Mon, 1 Apr 2019 14:29:23 +0000 Subject: finish support of expired key warnings git-svn-id: svn://tug.org/texlive/trunk@50689 c570f23f-e606-0410-a88d-b1316a301751 --- Master/tlpkg/TeXLive/TLCrypto.pm | 30 ++++++++++++++++++------------ Master/tlpkg/TeXLive/TLPDB.pm | 3 +++ 2 files changed, 21 insertions(+), 12 deletions(-) (limited to 'Master/tlpkg') diff --git a/Master/tlpkg/TeXLive/TLCrypto.pm b/Master/tlpkg/TeXLive/TLCrypto.pm index fd52cc247cf..7c8848e5b15 100644 --- a/Master/tlpkg/TeXLive/TLCrypto.pm +++ b/Master/tlpkg/TeXLive/TLCrypto.pm @@ -57,11 +57,13 @@ BEGIN { %VerificationStatusDescription $VS_VERIFIED $VS_CHECKSUM_ERROR $VS_SIGNATURE_ERROR $VS_CONNECTION_ERROR $VS_UNSIGNED $VS_GPG_UNAVAILABLE $VS_PUBKEY_MISSING $VS_UNKNOWN + $VS_EXPKEYSIG ); @EXPORT = qw( %VerificationStatusDescription $VS_VERIFIED $VS_CHECKSUM_ERROR $VS_SIGNATURE_ERROR $VS_CONNECTION_ERROR $VS_UNSIGNED $VS_GPG_UNAVAILABLE $VS_PUBKEY_MISSING $VS_UNKNOWN + $VS_EXPKEYSIG ); } @@ -450,12 +452,14 @@ sub verify_signature { } } my ($ret, $out) = gpg_verify_signature($file, $signature_file); - if ($ret == 1) { + if ($ret == $VS_VERIFIED) { # no need to show the output debug("cryptographic signature of $url verified\n"); return($VS_VERIFIED); - } elsif ($ret == -1) { + } elsif ($ret == $VS_PUBKEY_MISSING) { return($VS_PUBKEY_MISSING, $out); + } elsif ($ret == $VS_EXPKEYSIG) { + return($VS_EXPKEYSIG, $out); } else { return($VS_SIGNATURE_ERROR, <; + close($status_fd); chomp(@status_lines); + debug(join("\n", "STATUS OUTPUT", @status_lines)); if ($ret == 0) { + # verification still might return success but key is expired! + if (grep(/KEYEXPIRED/, @status_lines)) { + return($VS_EXPKEYSIG, "expired key"); + } debug("verification succeeded, output:\n$out\n"); - debug(join("\n", "STATUS OUTPUT", @status_lines)); - return (1, $out); + return ($VS_VERIFIED, $out); } else { - open($status_fd, "<", $status_file) || die("Cannot open status file: $!"); - while (<$status_fd>) { - if (m/^\[GNUPG:\] NO_PUBKEY (.*)/) { - close($status_fd); - debug("missing pubkey $1\n"); - return (-1, "missing pubkey $1"); - } + if (grep(/^\[GNUPG:\] NO_PUBKEY (.*)/, @status_lines)) { + debug("missing pubkey $1\n"); + return ($VS_PUBKEY_MISSING, "missing pubkey $1"); } - return (0, $out); + # we could do more checks on what is the actual problem here! + return ($VS_SIGNATURE_ERROR, $out); } } diff --git a/Master/tlpkg/TeXLive/TLPDB.pm b/Master/tlpkg/TeXLive/TLPDB.pm index a18bdfe2a81..2d6acb1d9be 100644 --- a/Master/tlpkg/TeXLive/TLPDB.pm +++ b/Master/tlpkg/TeXLive/TLPDB.pm @@ -406,6 +406,9 @@ sub from_file { } elsif ($r == $VS_PUBKEY_MISSING) { debug("$0: TLPDB: pubkey missing, continuing anyway!\n"); $self->verification_status($r); + } elsif ($r == $VS_EXPKEYSIG) { + debug("$0: TLPDB: signature verified, but key expired, continuing anyway!\n"); + $self->verification_status($r); } elsif ($r == $VS_VERIFIED) { $is_verified = 1; $self->verification_status($r); -- cgit v1.2.3