Managing TeX Live GPG Keys Using 'tlmgr key' (with examples)

The TeX Live Manager (tlmgr) is an essential tool for those who work with TeX Live distributions. It provides various commands to manage the TeX installation, including package updates, installations, and removal. The tlmgr key command specifically helps manage GPG keys, which are crucial for verifying the authenticity and integrity of TeX Live databases and packages. Ensuring that the keys are properly managed helps maintain the security of your TeX Live environment.

Use case 1: List all keys for TeX Live

Code:

tlmgr key list

Motivation:

If you’re managing a TeX Live distribution, it’s crucial to know which GPG keys are currently installed and being used to verify your packages. Listing all keys allows you to review the existing public keys and ensure they’re current and valid. Regularly reviewing your keys can help you identify any unnecessary or expired keys that may need to be removed to maintain system security.

Explanation:

• tlmgr: This is the main command for the TeX Live Manager.
• key: This subcommand specifies that the operation involves GPG key management.
• list: This argument tells tlmgr to display all the GPG keys currently installed and used in your TeX Live setup.

Example output:

Key Fingerprint: ABC123...XYZ
                 Issuer: TeX Live
                 Validity: 01-01-2020 to 31-12-2025

Key Fingerprint: DEF456...UVW
                 Issuer: TeX Live
                 Validity: 01-01-2021 to 31-12-2026

Use case 2: Add a key from a specific file

Code:

sudo tlmgr key add path/to/key.gpg

Motivation:

Sometimes it becomes necessary to add a new GPG key, especially after a key rotation or when you want to start verifying packages from a new source. Adding a key from a file allows you to easily integrate a key obtained in a secure manner, ensuring that future installations and updates are verified correctly.

Explanation:

• sudo: Running this command with superuser privileges is often necessary because modifying key management settings typically requires administrative rights.
• tlmgr: The TeX Live Manager tool.
• key: Indicates the operation pertains to GPG key functions.
• add: Adds a new GPG key to the list of keys used by TeX Live.
• path/to/key.gpg: This is the path to the file that contains the new GPG key you want to add.

Example output:

Key added successfully: ABC123...XYZ

Use case 3: Add a key from stdin

Code:

cat path/to/key.gpg | sudo tlmgr key add -

Motivation:

In situations where the key needs to be read directly from an input stream, such as when keys are being automatically distributed or scripted, adding a key from stdin is convenient. This method is particularly useful in automation scripts or continuous integration systems where file paths might be dynamically generated or managed.

Explanation:

• cat: This command reads the contents of the specified file.
• path/to/key.gpg: The file containing the GPG key.
• |: The pipe operator directs the output of cat as input to the following command.
• sudo tlmgr key add -: The - argument tells tlmgr to read the key from standard input, integrating it seamlessly into the key management system.

Example output:

Key added from stdin successfully: ABC123...XYZ

Use case 4: Remove a specific key by its ID

Code:

sudo tlmgr key remove key_id

Motivation:

Over time, GPG keys may become outdated or compromised. Removing an old or unnecessary GPG key is an essential task to keep your TeX Live setup secure. Using the key’s ID provides a precise way to target and remove a specific key without affecting other keys.

Explanation:

• sudo: Ensures that you have the necessary permissions to alter GPG key settings.
• tlmgr: Here refers to the TeX Live Manager.
• key: Indicates the GPG key-related operation.
• remove: This operation tells tlmgr to delete an existing GPG key.
• key_id: The unique identifier of the GPG key you wish to remove, which you would get from tlmgr key list.

Example output:

Key removed successfully: ABC123...XYZ

Conclusion:

The tlmgr key command is vital for maintaining the integrity and security of your TeX Live installation. Managing GPG keys by listing, adding, and removing them ensures that you only trust verified sources, safeguarding your setup against unauthorized or insecure packages. By following the examples provided, users can confidently manage their TeX Live GPG keys and ensure a secure document preparation environment.