[apt.git] / test / integration / test-apt-update-nofallback

#!/bin/sh
#
# ensure we never fallback from a signed to a unsigned repo
# 
# hash checks are done in 
# 
set -e

simulate_mitm_and_inject_evil_package()
{
    redatereleasefiles '+1 hour'
    rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
    inject_evil_package
}

inject_evil_package()
{
    cat > "$APTARCHIVE/dists/unstable/main/binary-i386/Packages" <<EOF
Package: evil
Installed-Size: 29
Maintainer: Joe Sixpack <joe@example.org>
Architecture: all
Version: 1.0
Filename: pool/evil_1.0_all.deb
Size: 1270
Description: an autogenerated evil package
EOF
    # avoid ims hit
    touch -d '+1hour' aptarchive/dists/unstable/main/binary-i386/Packages
    compressfile aptarchive/dists/unstable/main/binary-i386/Packages
}

assert_update_is_refused_and_last_good_state_used()
{
    testfailuremsg "E: The repository 'file:${APTARCHIVE} unstable Release' is no longer signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details." aptget update

    assert_repo_is_intact
}

assert_repo_is_intact()
{
    testsuccessequal "foo/unstable 2.0 all" apt list -qq
    testsuccess aptget install -y -s foo
    testfailure aptget install -y evil
    testsuccess aptget source foo --print-uris

    LISTDIR=rootdir/var/lib/apt/lists
    testempty find "$LISTDIR" -name 'InRelease' -o -name 'Release.gpg'
}

setupaptarchive_with_lists_clean()
{
    setupaptarchive --no-update
    rm -rf rootdir/var/lib/apt/lists
}

test_from_inrelease_to_unsigned()
{
    export APT_DONT_SIGN='Release.gpg'
    setupaptarchive_with_lists_clean
    testsuccess aptget update
    listcurrentlistsdirectory > lists.before

    simulate_mitm_and_inject_evil_package
    assert_update_is_refused_and_last_good_state_used
    testfileequal lists.before "$(listcurrentlistsdirectory)"
}

test_from_release_gpg_to_unsigned()
{
    export APT_DONT_SIGN='InRelease'
    setupaptarchive_with_lists_clean
    testsuccess aptget update
    listcurrentlistsdirectory > lists.before

    simulate_mitm_and_inject_evil_package
    assert_update_is_refused_and_last_good_state_used
    testfileequal lists.before "$(listcurrentlistsdirectory)"
}

test_from_inrelease_to_unsigned_with_override()
{
    export APT_DONT_SIGN='Release.gpg'
    # setup archive with InRelease file
    setupaptarchive_with_lists_clean
    testsuccess aptget update

    # simulate moving to a unsigned but otherwise valid repo
    simulate_mitm_and_inject_evil_package
    generatereleasefiles '+2 hours'
    find "$APTARCHIVE" -name '*Packages*' -exec touch -d '+2 hours' {} \;

    # and ensure we can update to it (with enough force) 
    testfailure apt update
    testfailure aptget update
    testfailure aptget update --allow-insecure-repositories
    testfailure aptget update --no-allow-insecure-repositories
    sed -i 's#^deb\(-src\)\? #deb\1 [allow-downgrade-to-insecure=yes] #' rootdir/etc/apt/sources.list.d/*
    testfailure aptget update --no-allow-insecure-repositories
    testfailure apt update
    testwarning apt update --allow-insecure-repositories \
        -o Debug::pkgAcquire::Worker=1 -o Debug::pkgAcquire::Auth=1
    sed -i 's#^deb\(-src\)\? \[allow-downgrade-to-insecure=yes\] #deb\1 #' rootdir/etc/apt/sources.list.d/*
    # but that the individual packages are still considered untrusted
    testfailureequal "WARNING: The following packages cannot be authenticated!
  evil
E: There were unauthenticated packages and -y was used without --allow-unauthenticated" aptget install -qq -y evil
}

test_from_inrelease_to_norelease_with_override()
{
    # setup archive with InRelease file
    setupaptarchive_with_lists_clean
    testsuccess aptget update

    # simulate moving to a unsigned but otherwise valid repo
    simulate_mitm_and_inject_evil_package
    find "$APTARCHIVE" -name '*Release*' -delete
    find "$APTARCHIVE" -name '*Packages*' -exec touch -d '+2 hours' {} \;

    # and ensure we can update to it (with enough force) 
    testfailure aptget update
    testfailure aptget update --allow-insecure-repositories
    testwarning aptget update --allow-insecure-repositories \
        -o Acquire::AllowDowngradeToInsecureRepositories=1 -o Debug::pkgAcquire::Worker=1 -o Debug::pkgAcquire::Auth=1
    # but that the individual packages are still considered untrusted
    testfailureequal "WARNING: The following packages cannot be authenticated!
  evil
E: There were unauthenticated packages and -y was used without --allow-unauthenticated" aptget install -qq -y evil
}

test_cve_2012_0214()
{
    # see https://bugs.launchpad.net/ubuntu/+source/apt/+bug/947108
    #
    # it was possible to MITM the download so that InRelease/Release.gpg
    # are not delivered (404) and a altered Release file was send
    #
    # apt left the old InRelease file in /var/lib/apt/lists and downloaded
    # the unauthenticated Release file too giving the false impression that
    # Release was authenticated
    #
    # Note that this is pretty much impossible nowadays because:
    # a) InRelease is left as is, not split to InRelease/Release as it was 
    #    in the old days
    # b) we refuse to go from signed->unsigned
    #
    # Still worth having a regression test the simulates the condition

    export APT_DONT_SIGN='Release.gpg'
    setupaptarchive_with_lists_clean
    testsuccess aptget update
    listcurrentlistsdirectory > lists.before

    # do what CVE-2012-0214 did
    rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
    inject_evil_package
    # build valid Release file
    aptftparchive -qq release ./aptarchive > aptarchive/dists/unstable/Release

    assert_update_is_refused_and_last_good_state_used
    testfileequal lists.before "$(listcurrentlistsdirectory)"

    # ensure there is no _Release file downloaded
    testfailure ls rootdir/var/lib/apt/lists/*_Release
}

test_subvert_inrelease()
{
    export APT_DONT_SIGN='Release.gpg'
    setupaptarchive_with_lists_clean
    testsuccess aptget update
    listcurrentlistsdirectory > lists.before

    # replace InRelease with something else
    mv "$APTARCHIVE/dists/unstable/Release" "$APTARCHIVE/dists/unstable/InRelease"

    testfailuremsg "E: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease  Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?)
E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update

    # ensure we keep the repo
    testfileequal lists.before "$(listcurrentlistsdirectory)"
    assert_repo_is_intact
}

test_inrelease_to_invalid_inrelease()
{
    export APT_DONT_SIGN='Release.gpg'
    setupaptarchive_with_lists_clean
    testsuccess aptget update
    listcurrentlistsdirectory > lists.before

    # now remove InRelease and subvert Release do no longer verify
    sed -i 's/^Codename:.*/Codename: evil!/' "$APTARCHIVE/dists/unstable/InRelease"
    inject_evil_package

    testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file:${APTARCHIVE} unstable InRelease: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease  The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq

    # ensure we keep the repo
    testfailure grep 'evil' rootdir/var/lib/apt/lists/*InRelease
    testfileequal lists.before "$(listcurrentlistsdirectory)"
    assert_repo_is_intact
}

test_release_gpg_to_invalid_release_release_gpg()
{
    export APT_DONT_SIGN='InRelease'
    setupaptarchive_with_lists_clean
    testsuccess aptget update
    listcurrentlistsdirectory > lists.before

    # now subvert Release do no longer verify
    echo "Some evil data" >> "$APTARCHIVE/dists/unstable/Release"
    inject_evil_package

    testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file:${APTARCHIVE} unstable Release: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
W: Failed to fetch file:${APTARCHIVE}/dists/unstable/Release.gpg  The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq

    testfailure grep 'evil' rootdir/var/lib/apt/lists/*Release
    testfileequal lists.before "$(listcurrentlistsdirectory)"
    assert_repo_is_intact
}


TESTDIR="$(readlink -f "$(dirname "$0")")"
. "$TESTDIR/framework"

setupenvironment
configarchitecture "i386"

# a "normal" package with source and binary
buildsimplenativepackage 'foo' 'all' '2.0'

# setup the archive and ensure we have a single package that installs fine
setupaptarchive
APTARCHIVE="$(readlink -f ./aptarchive)"
assert_repo_is_intact

# test the various cases where a repo may go from signed->unsigned
msgmsg "test_from_inrelease_to_unsigned"
test_from_inrelease_to_unsigned

msgmsg "test_from_release_gpg_to_unsigned"
test_from_release_gpg_to_unsigned

# ensure we do not regress on CVE-2012-0214
msgmsg "test_cve_2012_0214"
test_cve_2012_0214

# ensure InRelease can not be subverted
msgmsg "test_subvert_inrelease"
test_subvert_inrelease

# ensure we revert to last good state if InRelease does not verify
msgmsg "test_inrelease_to_invalid_inrelease"
test_inrelease_to_invalid_inrelease

# ensure we revert to last good state if Release/Release.gpg does not verify
msgmsg "test_release_gpg_to_invalid_release_release_gpg"
test_release_gpg_to_invalid_release_release_gpg

# ensure we can override the downgrade error
msgmsg "test_from_inrelease_to_unsigned_with_override"
test_from_inrelease_to_unsigned_with_override
msgmsg "test_from_inrelease_to_norelease_with_override"
test_from_inrelease_to_norelease_with_override
Commit	Line	Data
631a7dc7 MV	1	#!/bin/sh
	2	#
	3	# ensure we never fallback from a signed to a unsigned repo
	4	#
	5	# hash checks are done in
	6	#
	7	set -e
	8
	9	simulate_mitm_and_inject_evil_package()
	10	{
6bf93605	11	redatereleasefiles '+1 hour'
761a5ad2	12	rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
631a7dc7 MV	13	inject_evil_package
	14	}
	15
	16	inject_evil_package()
	17	{
63c71412	18	cat > "$APTARCHIVE/dists/unstable/main/binary-i386/Packages" <<EOF
631a7dc7 MV	19	Package: evil
	20	Installed-Size: 29
	21	Maintainer: Joe Sixpack <joe@example.org>
	22	Architecture: all
	23	Version: 1.0
	24	Filename: pool/evil_1.0_all.deb
	25	Size: 1270
	26	Description: an autogenerated evil package
	27	EOF
	28	# avoid ims hit
	29	touch -d '+1hour' aptarchive/dists/unstable/main/binary-i386/Packages
448c38bd	30	compressfile aptarchive/dists/unstable/main/binary-i386/Packages
631a7dc7 MV	31	}
	32
	33	assert_update_is_refused_and_last_good_state_used()
	34	{
002b1bc4	35	testfailuremsg "E: The repository 'file:${APTARCHIVE} unstable Release' is no longer signed.
83960341	36	N: Updating from such a repository can't be done securely, and is therefore disabled by default.
87d6947d	37	N: See apt-secure(8) manpage for repository creation and user configuration details." aptget update
631a7dc7 MV	38
	39	assert_repo_is_intact
	40	}
	41
	42	assert_repo_is_intact()
	43	{
2b0660b5	44	testsuccessequal "foo/unstable 2.0 all" apt list -qq
846bc058 DK	45	testsuccess aptget install -y -s foo
	46	testfailure aptget install -y evil
	47	testsuccess aptget source foo --print-uris
631a7dc7 MV	48
631a7dc7 MV	49	LISTDIR=rootdir/var/lib/apt/lists
63c71412	50	testempty find "$LISTDIR" -name 'InRelease' -o -name 'Release.gpg'
631a7dc7 MV	51	}
	52
	53	setupaptarchive_with_lists_clean()
	54	{
	55	setupaptarchive --no-update
4fa34122	56	rm -rf rootdir/var/lib/apt/lists
631a7dc7 MV	57	}
	58
	59	test_from_inrelease_to_unsigned()
	60	{
5a23c56d	61	export APT_DONT_SIGN='Release.gpg'
631a7dc7 MV	62	setupaptarchive_with_lists_clean
631a7dc7 MV	63	testsuccess aptget update
846bc058	64	listcurrentlistsdirectory > lists.before
631a7dc7 MV	65
	66	simulate_mitm_and_inject_evil_package
	67	assert_update_is_refused_and_last_good_state_used
846bc058	68	testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7 MV	69	}
	70
	71	test_from_release_gpg_to_unsigned()
	72	{
5a23c56d	73	export APT_DONT_SIGN='InRelease'
631a7dc7	74	setupaptarchive_with_lists_clean
631a7dc7	75	testsuccess aptget update
846bc058	76	listcurrentlistsdirectory > lists.before
631a7dc7 MV	77
	78	simulate_mitm_and_inject_evil_package
	79	assert_update_is_refused_and_last_good_state_used
846bc058	80	testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7 MV	81	}
631a7dc7 MV	82
c99fe2e1 MV	83	test_from_inrelease_to_unsigned_with_override()
c99fe2e1 MV	84	{
5a23c56d	85	export APT_DONT_SIGN='Release.gpg'
c99fe2e1 MV	86	# setup archive with InRelease file
c99fe2e1 MV	87	setupaptarchive_with_lists_clean
448c38bd	88	testsuccess aptget update
c99fe2e1 MV	89
	90	# simulate moving to a unsigned but otherwise valid repo
	91	simulate_mitm_and_inject_evil_package
448c38bd	92	generatereleasefiles '+2 hours'
63c71412	93	find "$APTARCHIVE" -name 'Packages' -exec touch -d '+2 hours' {} \;
c99fe2e1 MV	94
c99fe2e1 MV	95	# and ensure we can update to it (with enough force)
d03b947b	96	testfailure apt update
b1bdfe68 DK	97	testfailure aptget update
b1bdfe68 DK	98	testfailure aptget update --allow-insecure-repositories
d03b947b DK	99	testfailure aptget update --no-allow-insecure-repositories
	100	sed -i 's#^deb\(-src\)\? #deb\1 [allow-downgrade-to-insecure=yes] #' rootdir/etc/apt/sources.list.d/*
	101	testfailure aptget update --no-allow-insecure-repositories
	102	testfailure apt update
	103	testwarning apt update --allow-insecure-repositories \
	104	-o Debug::pkgAcquire::Worker=1 -o Debug::pkgAcquire::Auth=1
	105	sed -i 's#^deb\(-src\)\? \[allow-downgrade-to-insecure=yes\] #deb\1 #' rootdir/etc/apt/sources.list.d/*
b1bdfe68 DK	106	# but that the individual packages are still considered untrusted
	107	testfailureequal "WARNING: The following packages cannot be authenticated!
	108	evil
	109	E: There were unauthenticated packages and -y was used without --allow-unauthenticated" aptget install -qq -y evil
	110	}
	111
	112	test_from_inrelease_to_norelease_with_override()
	113	{
	114	# setup archive with InRelease file
	115	setupaptarchive_with_lists_clean
	116	testsuccess aptget update
	117
	118	# simulate moving to a unsigned but otherwise valid repo
	119	simulate_mitm_and_inject_evil_package
	120	find "$APTARCHIVE" -name 'Release' -delete
	121	find "$APTARCHIVE" -name 'Packages' -exec touch -d '+2 hours' {} \;
	122
	123	# and ensure we can update to it (with enough force)
	124	testfailure aptget update
	125	testfailure aptget update --allow-insecure-repositories
4fa34122	126	testwarning aptget update --allow-insecure-repositories \
448c38bd	127	-o Acquire::AllowDowngradeToInsecureRepositories=1 -o Debug::pkgAcquire::Worker=1 -o Debug::pkgAcquire::Auth=1
c99fe2e1	128	# but that the individual packages are still considered untrusted
25b86db1	129	testfailureequal "WARNING: The following packages cannot be authenticated!
c99fe2e1	130	evil
b381a482	131	E: There were unauthenticated packages and -y was used without --allow-unauthenticated" aptget install -qq -y evil
c99fe2e1 MV	132	}
c99fe2e1 MV	133
631a7dc7 MV	134	test_cve_2012_0214()
	135	{
	136	# see https://bugs.launchpad.net/ubuntu/+source/apt/+bug/947108
	137	#
	138	# it was possible to MITM the download so that InRelease/Release.gpg
	139	# are not delivered (404) and a altered Release file was send
	140	#
	141	# apt left the old InRelease file in /var/lib/apt/lists and downloaded
	142	# the unauthenticated Release file too giving the false impression that
	143	# Release was authenticated
	144	#
3a8776a3	145	# Note that this is pretty much impossible nowadays because:
631a7dc7 MV	146	# a) InRelease is left as is, not split to InRelease/Release as it was
	147	# in the old days
	148	# b) we refuse to go from signed->unsigned
	149	#
	150	# Still worth having a regression test the simulates the condition
	151
5a23c56d	152	export APT_DONT_SIGN='Release.gpg'
631a7dc7 MV	153	setupaptarchive_with_lists_clean
631a7dc7 MV	154	testsuccess aptget update
846bc058	155	listcurrentlistsdirectory > lists.before
631a7dc7 MV	156
631a7dc7 MV	157	# do what CVE-2012-0214 did
5a23c56d	158	rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
631a7dc7 MV	159	inject_evil_package
631a7dc7 MV	160	# build valid Release file
761a5ad2	161	aptftparchive -qq release ./aptarchive > aptarchive/dists/unstable/Release
631a7dc7 MV	162
631a7dc7 MV	163	assert_update_is_refused_and_last_good_state_used
846bc058	164	testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7 MV	165
	166	# ensure there is no _Release file downloaded
	167	testfailure ls rootdir/var/lib/apt/lists/*_Release
	168	}
	169
	170	test_subvert_inrelease()
	171	{
5a23c56d	172	export APT_DONT_SIGN='Release.gpg'
631a7dc7 MV	173	setupaptarchive_with_lists_clean
631a7dc7 MV	174	testsuccess aptget update
846bc058	175	listcurrentlistsdirectory > lists.before
631a7dc7 MV	176
631a7dc7 MV	177	# replace InRelease with something else
63c71412	178	mv "$APTARCHIVE/dists/unstable/Release" "$APTARCHIVE/dists/unstable/InRelease"
631a7dc7	179
f695e761	180	testfailuremsg "E: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?)
dd676dc7	181	E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update
631a7dc7 MV	182
631a7dc7 MV	183	# ensure we keep the repo
846bc058	184	testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7 MV	185	assert_repo_is_intact
	186	}
	187
	188	test_inrelease_to_invalid_inrelease()
	189	{
5a23c56d	190	export APT_DONT_SIGN='Release.gpg'
631a7dc7 MV	191	setupaptarchive_with_lists_clean
631a7dc7 MV	192	testsuccess aptget update
846bc058	193	listcurrentlistsdirectory > lists.before
631a7dc7 MV	194
631a7dc7 MV	195	# now remove InRelease and subvert Release do no longer verify
63c71412	196	sed -i 's/^Codename:.*/Codename: evil!/' "$APTARCHIVE/dists/unstable/InRelease"
631a7dc7 MV	197	inject_evil_package
631a7dc7 MV	198
1da3b7b8	199	testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file:${APTARCHIVE} unstable InRelease: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
4dbfe436	200	W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
631a7dc7 MV	201	W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
	202
	203	# ensure we keep the repo
846bc058 DK	204	testfailure grep 'evil' rootdir/var/lib/apt/lists/*InRelease
846bc058 DK	205	testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7	206	assert_repo_is_intact
631a7dc7 MV	207	}
	208
	209	test_release_gpg_to_invalid_release_release_gpg()
	210	{
5a23c56d	211	export APT_DONT_SIGN='InRelease'
631a7dc7	212	setupaptarchive_with_lists_clean
631a7dc7	213	testsuccess aptget update
846bc058	214	listcurrentlistsdirectory > lists.before
631a7dc7 MV	215
631a7dc7 MV	216	# now subvert Release do no longer verify
63c71412	217	echo "Some evil data" >> "$APTARCHIVE/dists/unstable/Release"
631a7dc7 MV	218	inject_evil_package
631a7dc7 MV	219
1da3b7b8	220	testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file:${APTARCHIVE} unstable Release: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
03aa0847	221	W: Failed to fetch file:${APTARCHIVE}/dists/unstable/Release.gpg The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
8beef749	222	W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
631a7dc7	223
846bc058 DK	224	testfailure grep 'evil' rootdir/var/lib/apt/lists/*Release
846bc058 DK	225	testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7	226	assert_repo_is_intact
631a7dc7 MV	227	}
	228
	229
3abb6a6a DK	230	TESTDIR="$(readlink -f "$(dirname "$0")")"
3abb6a6a DK	231	. "$TESTDIR/framework"
631a7dc7 MV	232
	233	setupenvironment
	234	configarchitecture "i386"
	235
	236	# a "normal" package with source and binary
	237	buildsimplenativepackage 'foo' 'all' '2.0'
	238
	239	# setup the archive and ensure we have a single package that installs fine
	240	setupaptarchive
63c71412	241	APTARCHIVE="$(readlink -f ./aptarchive)"
631a7dc7 MV	242	assert_repo_is_intact
	243
	244	# test the various cases where a repo may go from signed->unsigned
	245	msgmsg "test_from_inrelease_to_unsigned"
	246	test_from_inrelease_to_unsigned
	247
	248	msgmsg "test_from_release_gpg_to_unsigned"
	249	test_from_release_gpg_to_unsigned
	250
	251	# ensure we do not regress on CVE-2012-0214
	252	msgmsg "test_cve_2012_0214"
	253	test_cve_2012_0214
	254
8d89cda7	255	# ensure InRelease can not be subverted
631a7dc7 MV	256	msgmsg "test_subvert_inrelease"
	257	test_subvert_inrelease
	258
	259	# ensure we revert to last good state if InRelease does not verify
	260	msgmsg "test_inrelease_to_invalid_inrelease"
	261	test_inrelease_to_invalid_inrelease
	262
	263	# ensure we revert to last good state if Release/Release.gpg does not verify
	264	msgmsg "test_release_gpg_to_invalid_release_release_gpg"
	265	test_release_gpg_to_invalid_release_release_gpg
c99fe2e1	266
846bc058 DK	267	# ensure we can override the downgrade error
846bc058 DK	268	msgmsg "test_from_inrelease_to_unsigned_with_override"
c99fe2e1	269	test_from_inrelease_to_unsigned_with_override
b1bdfe68 DK	270	msgmsg "test_from_inrelease_to_norelease_with_override"
b1bdfe68 DK	271	test_from_inrelease_to_norelease_with_override