From d9b3ee3d2e79bf68027bb8afee2418e23ec4aa0a Mon Sep 17 00:00:00 2001 From: Norbert Preining Date: Fri, 6 May 2016 10:04:46 +0000 Subject: tlmgr: --require-verification (cmd line and tlgmr option) git-svn-id: svn://tug.org/texlive/trunk@40914 c570f23f-e606-0410-a88d-b1316a301751 --- Master/texmf-dist/scripts/texlive/tlmgr.pl | 42 +++++++++++++++++++++++++++--- 1 file changed, 39 insertions(+), 3 deletions(-) (limited to 'Master') diff --git a/Master/texmf-dist/scripts/texlive/tlmgr.pl b/Master/texmf-dist/scripts/texlive/tlmgr.pl index 72d2da50d1d..3f2f3e394df 100755 --- a/Master/texmf-dist/scripts/texlive/tlmgr.pl +++ b/Master/texmf-dist/scripts/texlive/tlmgr.pl @@ -343,6 +343,7 @@ sub main { "usermode|user-mode" => 1, "usertree|user-tree" => "=s", "verify-downloads" => "!", + "require-verification" => "!", "version" => 1, ); @@ -5981,7 +5982,6 @@ sub _init_tlmedia { return(0, $errormsg); } - # this "location-url" line should not be changed since GUI programs # depend on it: if ($::machinereadable) { @@ -6087,6 +6087,10 @@ END_NO_INTERNET if (!defined($remotetlpdb)) { return(undef, $loadmediasrcerror . $location); } + if ($opts{"require-verification"} && !$remotetlpdb->is_verified) { + tldie("Remote TeX Live database ($location) is not verified, exiting.\n"); + } + # we allow a range of years to be specified by the remote tlpdb # for which it might work. # the lower limit is TLPDB->config_minrelease @@ -6216,6 +6220,9 @@ sub load_config_file { # by default we remove packages $config{"auto-remove"} = 1; # + # by default we do not require verification + $config{"require-verification"} = 0; + # # do NOT set this here, we distinguish between explicitly set in the config file # or implicitly true # $config{"verify-downloads"} = 1; @@ -6232,6 +6239,11 @@ sub load_config_file { $tlmgr_config_file = TeXLive::TLConfFile->new($fn, "#", "="); load_options_from_config($tlmgr_config_file) if $tlmgr_config_file; + # set $opts{"key"} from $config{"key"} if not passed in on cmd line + if (!defined($opts{"require-verification"})) { + $opts{"require-verification"} = $config{"require-verification"}; + } + # switched names for this one after initial release. if ($tlmgr_config_file->key_present("gui_expertmode")) { $tlmgr_config_file->rename_key("gui_expertmode", "gui-expertmode"); @@ -6271,6 +6283,15 @@ sub load_options_from_config { tlwarn("$prg: $fn: Unknown value for auto-remove: $val\n"); } + } elsif ($key eq "require-verification") { + if ($val eq "0") { + $config{"require-verification"} = 0; + } elsif ($val eq "1") { + $config{"require-verification"} = 1; + } else { + tlwarn("$prg: $fn: Unknown value for require-verification: $val\n"); + } + } elsif ($key eq "verify-downloads") { if ($val eq "0") { $config{"verify-downloads"} = 0; @@ -6643,6 +6664,15 @@ Change the pinning file location from C (see L below). Documented only for completeness, as this is only useful in debugging. +=item B<--require-verification> + +=item B<--no-require-verification> + +Instructs C to only accept signed and verified remotes. In any +other case C will quit operation. +See L below for details. + + =item B<--usermode> Activates user mode for this run of C; see L below. @@ -7783,6 +7813,9 @@ command-line option. =item C, value 0 or 1 (default 1), same as command-line option. +=item C, value 0 or 1 (default 1), same as +command-line option. + =item C, value 0 or 1 (default 1), same as command-line option. @@ -7804,7 +7837,7 @@ make sense to set this. =back -The key needs more explanation. By default, package +The C key needs more explanation. By default, package checksums computed and stored on the server (in the TLPDB) are compared to checksums computed locally after downloading. C disables this. @@ -7825,7 +7858,10 @@ If a working GnuPG binary (C) is found (see below for the search method), by default verification of downloaded files is performed. This can be suppressed by specifying C<--no-verify-downloads> on the command line, or adding an entry C to a tlmgr config file -(described in L). +(described in L). On the other hand, +it is possible to B verification by either specifying +C<--require-verification> on the command line, or adding an entry +C to a tlmgr config file. Verification is performed as follows: For each C loaded for a repository, the respective checksum C is -- cgit v1.2.3