blob: bebd53f38918ae74f5631aeb617c15ca4efc69dc (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
#!/bin/sh
# $Id$
# Public domain. Originally written 2020, Norbert Preining.
# gpg --verify ARG.asc. If verification fails, show all output.
# Adapted from TeXLive/TLCrypto.pm.
if test $# -ne 1; then
echo "$0: Exactly one argument must be given, the file to verify," >&2
echo "$0: with or without the .asc." >&2
exit 1
fi
if echo "$1" | grep '\.asc$' >/dev/null; then
data_file=`echo "$1" | sed 's/\.asc$//'`
asc_file=$1
else
data_file=$1
asc_file=$1.asc
fi
if test ! -s "$asc_file"; then
echo "$0: $asc_file nonexistent or empty, goodbye." >&2
exit 1
fi
mydir=`cd \`dirname $0\` && pwd`
PATH=$mydir:$PATH # for our tlgpg command
status_out=`mktemp`
verify_out=`mktemp`
verify_cmd="tlgpg --status-file=$status_out --verify --verbose"
# gpg exit status is zero with expired keys,
# but we want to fail in that case.
# As of gpg 2.2, apparently both asc and data files must be given.
if $verify_cmd "$asc_file" "$data_file" >$verify_out 2>&1; then
if grep EXPKEYSIG $status_out >/dev/null; then
err="expired key"
elif grep REVKEYSIG $status_out >/dev/null; then
err="revoked key"
else
err= # ok we hope
fi
else
err="other error ($?)"
fi
if test -n "$err"; then
echo "$0: gpg verification failed for: $asc_file" >&2
echo "$0: moving $asc_file to $asc_file.badv." >&2
mv "$asc_file" "$asc_file".badv || exit 1
echo "$0: gpg verify command was:" >&2
echo "$0: $verify_cmd" "$asc_file" "$data_file" >&2
echo "$0: GPG STATUS FILE OUTPUT:" >&2
cat $status_out >&2
echo "$0: GPG STDOUT/STDERR:" >&2
cat $verify_out >&2
echo "$0: goodbye and good luck." >&2
rm -f $status_out $verify_out
exit 1
fi
rm -f $status_out $verify_out
exit 0
|
