Add GPG check to verify signature file

Dockerfile.base

@@ -18,7 +18,7 @@ ENV LANG=C.UTF-8 \
 
 RUN apt-get update && \ 
   # basic utilities for TeX Live installation
-  apt-get install -y wget rsync unzip git tar xorriso \ 
+  apt-get install -y wget rsync unzip git gpg tar xorriso \ 
   # miscellaneous dependencies for TeX Live tools
   make fontconfig perl default-jre libgetopt-long-descriptive-perl \
   libdigest-perl-md5-perl libncurses5 libncurses6 \ 

Dockerfile.latest

@@ -5,15 +5,22 @@ FROM registry.gitlab.com/islandoftex/images/texlive:base
 ARG DOCFILES=no
 ARG SRCFILES=no
 
-# install Vanilla TeX Live
+# verify vanilla TeX Live installer
 RUN echo "Building with documentation: $DOCFILES" && \
   echo "Building with sources: $SRCFILES" && \
   wget $TLMIRRORURL/install-tl-unx.tar.gz && \ 
   wget $TLMIRRORURL/install-tl-unx.tar.gz.sha512 && \ 
+  wget $TLMIRRORURL/install-tl-unx.tar.gz.sha512.asc && \ 
+  wget https://tug.org/texlive/files/texlive.asc && \ 
+  gpg --import texlive.asc && \ 
+  gpg --verify install-tl-unx.tar.gz.sha512.asc install-tl-unx.tar.gz.sha512 && \ 
   sha512sum -c install-tl-unx.tar.gz.sha512 && \ 
-  rm install-tl-unx.tar.gz.sha512 && \ 
-  tar xzf install-tl-unx.tar.gz && rm install-tl-unx.tar.gz && \ 
-  cd install-tl* && \ 
+  rm install-tl-unx.tar.gz.sha512* && \ 
+  rm texlive.asc && \ 
+  tar xzf install-tl-unx.tar.gz && rm install-tl-unx.tar.gz
+
+# actually install TeX Live
+RUN cd install-tl* && \ 
   # choose complete installation
   echo "selected_scheme scheme-full" > install.profile && \ 
   # … but disable documentation and source files when asked to stay slim