3

Recently it appears to me that the TeX Live repository is no longer signed with the release PGP key. When using the tlmgr update command, it always reports tlmgr: package repository [mirrored repo url] (not verified: not signed)

Is this a temporary (or local) issue or a permanent change in the infrastructure?

  • this is temporary, an unintended error. there was a note with an explanation just a short while ago on the tex-live list. – barbara beeton Sep 13 '17 at 1:46
  • Thank you, @barbarabeeton. I hope a resolution is coming soon. – Cong Ma Sep 13 '17 at 2:09
  • @barbarabeeton Do you know why it bothers checking the signature when it goes ahead and installs regardless? I've never understood the point. – cfr Sep 13 '17 at 2:19
  • 1
    @cfr I guess that it is often because if users do not have the right tolls installed to verify the download, tl would be very complicated to install for many users. (having to install first tl and then figuring out where to get go or what ever is used). Last time I checked it will use pgp to verify if present, but go forth if it is not present. – daleif Sep 13 '17 at 6:11
  • 1
    a message came through the tex-live list at about 03:45 eastern u.s. time confirming that the problem has been fixed. – barbara beeton Sep 13 '17 at 12:44
3

As stated by Barbara, this was a temporary error, and since yesterday the files are signed again. This was due to the required expiry extension of the signing sub key.

We are taking/have taken the following measures:

  • (already done) tlmgr will require the main repository to be signed, and will refuse working if the main repository isn't. This change is in tlcritical and will be pushed out after testing.
  • (in progress) make sure that a signing error on the build server will prohibit the push-out to the CTAN servers

Concerning the comments about security by default: We thought about requiring signature in case GPG is installed, but initial testing brought a huge opposition against this move. Now that verification was running smoothly for one year we feel reasonably save to require at least a signed main repository.

Concerning sub-repositories we are not decided by now: First of all we cannot and don't want all repositories to be signed, this should be optional. The question is what to do with signed repositories if the user has not imported the public key to allow for verification. At the moment we accept such repositories, in the same spirit as Debian does.

Hope that clarifies the situation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.