[apt.git] / test / integration / test-apt-update-nofallback

#!/bin/sh
#
# ensure we never fallback from a signed to a unsigned repo
# 
# hash checks are done in 
# 
set -e

simulate_mitm_and_inject_evil_package()
{
    redatereleasefiles '+1 hour'
    rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
    inject_evil_package
}

inject_evil_package()
{
    cat > "$APTARCHIVE/dists/unstable/main/binary-i386/Packages" <<EOF
Package: evil
Installed-Size: 29
Maintainer: Joe Sixpack <joe@example.org>
Architecture: all
Version: 1.0
Filename: pool/evil_1.0_all.deb
Size: 1270
Description: an autogenerated evil package
EOF
    # avoid ims hit
    touch -d '+1hour' aptarchive/dists/unstable/main/binary-i386/Packages
    compressfile aptarchive/dists/unstable/main/binary-i386/Packages
}

assert_update_is_refused_and_last_good_state_used()
{
    testfailuremsg "E: The repository 'file:${APTARCHIVE} unstable Release' is no longer signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details." aptget update

    assert_repo_is_intact
}

assert_repo_is_intact()
{
    testsuccessequal "dpkg/now 1.16.2+fake all [installed,local]
foo/unstable 2.0 all" apt list -qq
    testsuccess aptget install -y -s foo
    testfailure aptget install -y evil
    testsuccess aptget source foo --print-uris

    LISTDIR=rootdir/var/lib/apt/lists
    testempty find "$LISTDIR" -name 'InRelease' -o -name 'Release.gpg'
}

setupaptarchive_with_lists_clean()
{
    setupaptarchive --no-update
    rm -rf rootdir/var/lib/apt/lists
}

test_from_inrelease_to_unsigned()
{
    export APT_DONT_SIGN='Release.gpg'
    setupaptarchive_with_lists_clean
    testsuccess aptget update
    listcurrentlistsdirectory > lists.before

    simulate_mitm_and_inject_evil_package
    assert_update_is_refused_and_last_good_state_used
    testfileequal lists.before "$(listcurrentlistsdirectory)"
}

test_from_release_gpg_to_unsigned()
{
    export APT_DONT_SIGN='InRelease'
    setupaptarchive_with_lists_clean
    testsuccess aptget update
    listcurrentlistsdirectory > lists.before

    simulate_mitm_and_inject_evil_package
    assert_update_is_refused_and_last_good_state_used
    testfileequal lists.before "$(listcurrentlistsdirectory)"
}

test_from_inrelease_to_unsigned_with_override()
{
    export APT_DONT_SIGN='Release.gpg'
    # setup archive with InRelease file
    setupaptarchive_with_lists_clean
    testsuccess aptget update

    # simulate moving to a unsigned but otherwise valid repo
    simulate_mitm_and_inject_evil_package
    generatereleasefiles '+2 hours'
    find "$APTARCHIVE" -name '*Packages*' -exec touch -d '+2 hours' {} \;

    # and ensure we can update to it (with enough force) 
    testfailure apt update
    testfailure aptget update
    testfailure aptget update --allow-insecure-repositories
    testfailure aptget update --no-allow-insecure-repositories
    sed -i 's#^deb\(-src\)\? #deb\1 [allow-downgrade-to-insecure=yes] #' rootdir/etc/apt/sources.list.d/*
    testfailure aptget update --no-allow-insecure-repositories
    testfailure apt update
    testwarning apt update --allow-insecure-repositories \
        -o Debug::pkgAcquire::Worker=1 -o Debug::pkgAcquire::Auth=1
    sed -i 's#^deb\(-src\)\? \[allow-downgrade-to-insecure=yes\] #deb\1 #' rootdir/etc/apt/sources.list.d/*
    # but that the individual packages are still considered untrusted
    testfailureequal "WARNING: The following packages cannot be authenticated!
  evil
E: There were unauthenticated packages and -y was used without --allow-unauthenticated" aptget install -qq -y evil
}

test_from_inrelease_to_norelease_with_override()
{
    # setup archive with InRelease file
    setupaptarchive_with_lists_clean
    testsuccess aptget update

    # simulate moving to a unsigned but otherwise valid repo
    simulate_mitm_and_inject_evil_package
    find "$APTARCHIVE" -name '*Release*' -delete
    find "$APTARCHIVE" -name '*Packages*' -exec touch -d '+2 hours' {} \;

    # and ensure we can update to it (with enough force) 
    testfailure aptget update
    testfailure aptget update --allow-insecure-repositories
    testwarning aptget update --allow-insecure-repositories \
        -o Acquire::AllowDowngradeToInsecureRepositories=1 -o Debug::pkgAcquire::Worker=1 -o Debug::pkgAcquire::Auth=1
    # but that the individual packages are still considered untrusted
    testfailureequal "WARNING: The following packages cannot be authenticated!
  evil
E: There were unauthenticated packages and -y was used without --allow-unauthenticated" aptget install -qq -y evil
}

test_cve_2012_0214()
{
    # see https://bugs.launchpad.net/ubuntu/+source/apt/+bug/947108
    #
    # it was possible to MITM the download so that InRelease/Release.gpg
    # are not delivered (404) and a altered Release file was send
    #
    # apt left the old InRelease file in /var/lib/apt/lists and downloaded
    # the unauthenticated Release file too giving the false impression that
    # Release was authenticated
    #
    # Note that this is pretty much impossible nowadays because:
    # a) InRelease is left as is, not split to InRelease/Release as it was 
    #    in the old days
    # b) we refuse to go from signed->unsigned
    #
    # Still worth having a regression test the simulates the condition

    export APT_DONT_SIGN='Release.gpg'
    setupaptarchive_with_lists_clean
    testsuccess aptget update
    listcurrentlistsdirectory > lists.before

    # do what CVE-2012-0214 did
    rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
    inject_evil_package
    # build valid Release file
    aptftparchive -qq release ./aptarchive > aptarchive/dists/unstable/Release

    assert_update_is_refused_and_last_good_state_used
    testfileequal lists.before "$(listcurrentlistsdirectory)"

    # ensure there is no _Release file downloaded
    testfailure ls rootdir/var/lib/apt/lists/*_Release
}

test_subvert_inrelease()
{
    export APT_DONT_SIGN='Release.gpg'
    setupaptarchive_with_lists_clean
    testsuccess aptget update
    listcurrentlistsdirectory > lists.before

    # replace InRelease with something else
    mv "$APTARCHIVE/dists/unstable/Release" "$APTARCHIVE/dists/unstable/InRelease"

    testfailuremsg "E: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease  Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?)
E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update

    # ensure we keep the repo
    testfileequal lists.before "$(listcurrentlistsdirectory)"
    assert_repo_is_intact
}

test_inrelease_to_invalid_inrelease()
{
    export APT_DONT_SIGN='Release.gpg'
    setupaptarchive_with_lists_clean
    testsuccess aptget update
    listcurrentlistsdirectory > lists.before

    # now remove InRelease and subvert Release do no longer verify
    sed -i 's/^Codename:.*/Codename: evil!/' "$APTARCHIVE/dists/unstable/InRelease"
    inject_evil_package

    testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file:${APTARCHIVE} unstable InRelease: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease  The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq

    # ensure we keep the repo
    testfailure grep 'evil' rootdir/var/lib/apt/lists/*InRelease
    testfileequal lists.before "$(listcurrentlistsdirectory)"
    assert_repo_is_intact
}

test_release_gpg_to_invalid_release_release_gpg()
{
    export APT_DONT_SIGN='InRelease'
    setupaptarchive_with_lists_clean
    testsuccess aptget update
    listcurrentlistsdirectory > lists.before

    # now subvert Release do no longer verify
    echo "Some evil data" >> "$APTARCHIVE/dists/unstable/Release"
    inject_evil_package

    testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file:${APTARCHIVE} unstable Release: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
W: Failed to fetch file:${APTARCHIVE}/dists/unstable/Release.gpg  The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq

    testfailure grep 'evil' rootdir/var/lib/apt/lists/*Release
    testfileequal lists.before "$(listcurrentlistsdirectory)"
    assert_repo_is_intact
}


TESTDIR="$(readlink -f "$(dirname "$0")")"
. "$TESTDIR/framework"

setupenvironment
configarchitecture "i386"

# a "normal" package with source and binary
buildsimplenativepackage 'foo' 'all' '2.0'

# setup the archive and ensure we have a single package that installs fine
setupaptarchive
APTARCHIVE="$(readlink -f ./aptarchive)"
assert_repo_is_intact

# test the various cases where a repo may go from signed->unsigned
msgmsg "test_from_inrelease_to_unsigned"
test_from_inrelease_to_unsigned

msgmsg "test_from_release_gpg_to_unsigned"
test_from_release_gpg_to_unsigned

# ensure we do not regress on CVE-2012-0214
msgmsg "test_cve_2012_0214"
test_cve_2012_0214

# ensure InRelease can not be subverted
msgmsg "test_subvert_inrelease"
test_subvert_inrelease

# ensure we revert to last good state if InRelease does not verify
msgmsg "test_inrelease_to_invalid_inrelease"
test_inrelease_to_invalid_inrelease

# ensure we revert to last good state if Release/Release.gpg does not verify
msgmsg "test_release_gpg_to_invalid_release_release_gpg"
test_release_gpg_to_invalid_release_release_gpg

# ensure we can override the downgrade error
msgmsg "test_from_inrelease_to_unsigned_with_override"
test_from_inrelease_to_unsigned_with_override
msgmsg "test_from_inrelease_to_norelease_with_override"
test_from_inrelease_to_norelease_with_override
Commit	Line	Data
631a7dc7 MV	1	#!/bin/sh
	2	#
	3	# ensure we never fallback from a signed to a unsigned repo
	4	#
	5	# hash checks are done in
	6	#
	7	set -e
	8
	9	simulate_mitm_and_inject_evil_package()
	10	{
6bf93605	11	redatereleasefiles '+1 hour'
761a5ad2	12	rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
631a7dc7 MV	13	inject_evil_package
	14	}
	15
	16	inject_evil_package()
	17	{
63c71412	18	cat > "$APTARCHIVE/dists/unstable/main/binary-i386/Packages" <<EOF
631a7dc7 MV	19	Package: evil
	20	Installed-Size: 29
	21	Maintainer: Joe Sixpack <joe@example.org>
	22	Architecture: all
	23	Version: 1.0
	24	Filename: pool/evil_1.0_all.deb
	25	Size: 1270
	26	Description: an autogenerated evil package
	27	EOF
	28	# avoid ims hit
	29	touch -d '+1hour' aptarchive/dists/unstable/main/binary-i386/Packages
448c38bd	30	compressfile aptarchive/dists/unstable/main/binary-i386/Packages
631a7dc7 MV	31	}
	32
	33	assert_update_is_refused_and_last_good_state_used()
	34	{
002b1bc4	35	testfailuremsg "E: The repository 'file:${APTARCHIVE} unstable Release' is no longer signed.
83960341	36	N: Updating from such a repository can't be done securely, and is therefore disabled by default.
87d6947d	37	N: See apt-secure(8) manpage for repository creation and user configuration details." aptget update
631a7dc7 MV	38
	39	assert_repo_is_intact
	40	}
	41
	42	assert_repo_is_intact()
	43	{
561a3557 JAK	44	testsuccessequal "dpkg/now 1.16.2+fake all [installed,local]
561a3557 JAK	45	foo/unstable 2.0 all" apt list -qq
846bc058 DK	46	testsuccess aptget install -y -s foo
	47	testfailure aptget install -y evil
	48	testsuccess aptget source foo --print-uris
631a7dc7 MV	49
631a7dc7 MV	50	LISTDIR=rootdir/var/lib/apt/lists
63c71412	51	testempty find "$LISTDIR" -name 'InRelease' -o -name 'Release.gpg'
631a7dc7 MV	52	}
	53
	54	setupaptarchive_with_lists_clean()
	55	{
	56	setupaptarchive --no-update
4fa34122	57	rm -rf rootdir/var/lib/apt/lists
631a7dc7 MV	58	}
	59
	60	test_from_inrelease_to_unsigned()
	61	{
5a23c56d	62	export APT_DONT_SIGN='Release.gpg'
631a7dc7 MV	63	setupaptarchive_with_lists_clean
631a7dc7 MV	64	testsuccess aptget update
846bc058	65	listcurrentlistsdirectory > lists.before
631a7dc7 MV	66
	67	simulate_mitm_and_inject_evil_package
	68	assert_update_is_refused_and_last_good_state_used
846bc058	69	testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7 MV	70	}
	71
	72	test_from_release_gpg_to_unsigned()
	73	{
5a23c56d	74	export APT_DONT_SIGN='InRelease'
631a7dc7	75	setupaptarchive_with_lists_clean
631a7dc7	76	testsuccess aptget update
846bc058	77	listcurrentlistsdirectory > lists.before
631a7dc7 MV	78
	79	simulate_mitm_and_inject_evil_package
	80	assert_update_is_refused_and_last_good_state_used
846bc058	81	testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7 MV	82	}
631a7dc7 MV	83
c99fe2e1 MV	84	test_from_inrelease_to_unsigned_with_override()
c99fe2e1 MV	85	{
5a23c56d	86	export APT_DONT_SIGN='Release.gpg'
c99fe2e1 MV	87	# setup archive with InRelease file
c99fe2e1 MV	88	setupaptarchive_with_lists_clean
448c38bd	89	testsuccess aptget update
c99fe2e1 MV	90
	91	# simulate moving to a unsigned but otherwise valid repo
	92	simulate_mitm_and_inject_evil_package
448c38bd	93	generatereleasefiles '+2 hours'
63c71412	94	find "$APTARCHIVE" -name 'Packages' -exec touch -d '+2 hours' {} \;
c99fe2e1 MV	95
c99fe2e1 MV	96	# and ensure we can update to it (with enough force)
d03b947b	97	testfailure apt update
b1bdfe68 DK	98	testfailure aptget update
b1bdfe68 DK	99	testfailure aptget update --allow-insecure-repositories
d03b947b DK	100	testfailure aptget update --no-allow-insecure-repositories
	101	sed -i 's#^deb\(-src\)\? #deb\1 [allow-downgrade-to-insecure=yes] #' rootdir/etc/apt/sources.list.d/*
	102	testfailure aptget update --no-allow-insecure-repositories
	103	testfailure apt update
	104	testwarning apt update --allow-insecure-repositories \
	105	-o Debug::pkgAcquire::Worker=1 -o Debug::pkgAcquire::Auth=1
	106	sed -i 's#^deb\(-src\)\? \[allow-downgrade-to-insecure=yes\] #deb\1 #' rootdir/etc/apt/sources.list.d/*
b1bdfe68 DK	107	# but that the individual packages are still considered untrusted
	108	testfailureequal "WARNING: The following packages cannot be authenticated!
	109	evil
	110	E: There were unauthenticated packages and -y was used without --allow-unauthenticated" aptget install -qq -y evil
	111	}
	112
	113	test_from_inrelease_to_norelease_with_override()
	114	{
	115	# setup archive with InRelease file
	116	setupaptarchive_with_lists_clean
	117	testsuccess aptget update
	118
	119	# simulate moving to a unsigned but otherwise valid repo
	120	simulate_mitm_and_inject_evil_package
	121	find "$APTARCHIVE" -name 'Release' -delete
	122	find "$APTARCHIVE" -name 'Packages' -exec touch -d '+2 hours' {} \;
	123
	124	# and ensure we can update to it (with enough force)
	125	testfailure aptget update
	126	testfailure aptget update --allow-insecure-repositories
4fa34122	127	testwarning aptget update --allow-insecure-repositories \
448c38bd	128	-o Acquire::AllowDowngradeToInsecureRepositories=1 -o Debug::pkgAcquire::Worker=1 -o Debug::pkgAcquire::Auth=1
c99fe2e1	129	# but that the individual packages are still considered untrusted
25b86db1	130	testfailureequal "WARNING: The following packages cannot be authenticated!
c99fe2e1	131	evil
b381a482	132	E: There were unauthenticated packages and -y was used without --allow-unauthenticated" aptget install -qq -y evil
c99fe2e1 MV	133	}
c99fe2e1 MV	134
631a7dc7 MV	135	test_cve_2012_0214()
	136	{
	137	# see https://bugs.launchpad.net/ubuntu/+source/apt/+bug/947108
	138	#
	139	# it was possible to MITM the download so that InRelease/Release.gpg
	140	# are not delivered (404) and a altered Release file was send
	141	#
	142	# apt left the old InRelease file in /var/lib/apt/lists and downloaded
	143	# the unauthenticated Release file too giving the false impression that
	144	# Release was authenticated
	145	#
3a8776a3	146	# Note that this is pretty much impossible nowadays because:
631a7dc7 MV	147	# a) InRelease is left as is, not split to InRelease/Release as it was
	148	# in the old days
	149	# b) we refuse to go from signed->unsigned
	150	#
	151	# Still worth having a regression test the simulates the condition
	152
5a23c56d	153	export APT_DONT_SIGN='Release.gpg'
631a7dc7 MV	154	setupaptarchive_with_lists_clean
631a7dc7 MV	155	testsuccess aptget update
846bc058	156	listcurrentlistsdirectory > lists.before
631a7dc7 MV	157
631a7dc7 MV	158	# do what CVE-2012-0214 did
5a23c56d	159	rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
631a7dc7 MV	160	inject_evil_package
631a7dc7 MV	161	# build valid Release file
761a5ad2	162	aptftparchive -qq release ./aptarchive > aptarchive/dists/unstable/Release
631a7dc7 MV	163
631a7dc7 MV	164	assert_update_is_refused_and_last_good_state_used
846bc058	165	testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7 MV	166
	167	# ensure there is no _Release file downloaded
	168	testfailure ls rootdir/var/lib/apt/lists/*_Release
	169	}
	170
	171	test_subvert_inrelease()
	172	{
5a23c56d	173	export APT_DONT_SIGN='Release.gpg'
631a7dc7 MV	174	setupaptarchive_with_lists_clean
631a7dc7 MV	175	testsuccess aptget update
846bc058	176	listcurrentlistsdirectory > lists.before
631a7dc7 MV	177
631a7dc7 MV	178	# replace InRelease with something else
63c71412	179	mv "$APTARCHIVE/dists/unstable/Release" "$APTARCHIVE/dists/unstable/InRelease"
631a7dc7	180
f695e761	181	testfailuremsg "E: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?)
dd676dc7	182	E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update
631a7dc7 MV	183
631a7dc7 MV	184	# ensure we keep the repo
846bc058	185	testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7 MV	186	assert_repo_is_intact
	187	}
	188
	189	test_inrelease_to_invalid_inrelease()
	190	{
5a23c56d	191	export APT_DONT_SIGN='Release.gpg'
631a7dc7 MV	192	setupaptarchive_with_lists_clean
631a7dc7 MV	193	testsuccess aptget update
846bc058	194	listcurrentlistsdirectory > lists.before
631a7dc7 MV	195
631a7dc7 MV	196	# now remove InRelease and subvert Release do no longer verify
63c71412	197	sed -i 's/^Codename:.*/Codename: evil!/' "$APTARCHIVE/dists/unstable/InRelease"
631a7dc7 MV	198	inject_evil_package
631a7dc7 MV	199
1da3b7b8	200	testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file:${APTARCHIVE} unstable InRelease: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
4dbfe436	201	W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
631a7dc7 MV	202	W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
	203
	204	# ensure we keep the repo
846bc058 DK	205	testfailure grep 'evil' rootdir/var/lib/apt/lists/*InRelease
846bc058 DK	206	testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7	207	assert_repo_is_intact
631a7dc7 MV	208	}
	209
	210	test_release_gpg_to_invalid_release_release_gpg()
	211	{
5a23c56d	212	export APT_DONT_SIGN='InRelease'
631a7dc7	213	setupaptarchive_with_lists_clean
631a7dc7	214	testsuccess aptget update
846bc058	215	listcurrentlistsdirectory > lists.before
631a7dc7 MV	216
631a7dc7 MV	217	# now subvert Release do no longer verify
63c71412	218	echo "Some evil data" >> "$APTARCHIVE/dists/unstable/Release"
631a7dc7 MV	219	inject_evil_package
631a7dc7 MV	220
1da3b7b8	221	testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file:${APTARCHIVE} unstable Release: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
03aa0847	222	W: Failed to fetch file:${APTARCHIVE}/dists/unstable/Release.gpg The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
8beef749	223	W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
631a7dc7	224
846bc058 DK	225	testfailure grep 'evil' rootdir/var/lib/apt/lists/*Release
846bc058 DK	226	testfileequal lists.before "$(listcurrentlistsdirectory)"
631a7dc7	227	assert_repo_is_intact
631a7dc7 MV	228	}
	229
	230
3abb6a6a DK	231	TESTDIR="$(readlink -f "$(dirname "$0")")"
3abb6a6a DK	232	. "$TESTDIR/framework"
631a7dc7 MV	233
	234	setupenvironment
	235	configarchitecture "i386"
	236
	237	# a "normal" package with source and binary
	238	buildsimplenativepackage 'foo' 'all' '2.0'
	239
	240	# setup the archive and ensure we have a single package that installs fine
	241	setupaptarchive
63c71412	242	APTARCHIVE="$(readlink -f ./aptarchive)"
631a7dc7 MV	243	assert_repo_is_intact
	244
	245	# test the various cases where a repo may go from signed->unsigned
	246	msgmsg "test_from_inrelease_to_unsigned"
	247	test_from_inrelease_to_unsigned
	248
	249	msgmsg "test_from_release_gpg_to_unsigned"
	250	test_from_release_gpg_to_unsigned
	251
	252	# ensure we do not regress on CVE-2012-0214
	253	msgmsg "test_cve_2012_0214"
	254	test_cve_2012_0214
	255
8d89cda7	256	# ensure InRelease can not be subverted
631a7dc7 MV	257	msgmsg "test_subvert_inrelease"
	258	test_subvert_inrelease
	259
	260	# ensure we revert to last good state if InRelease does not verify
	261	msgmsg "test_inrelease_to_invalid_inrelease"
	262	test_inrelease_to_invalid_inrelease
	263
	264	# ensure we revert to last good state if Release/Release.gpg does not verify
	265	msgmsg "test_release_gpg_to_invalid_release_release_gpg"
	266	test_release_gpg_to_invalid_release_release_gpg
c99fe2e1	267
846bc058 DK	268	# ensure we can override the downgrade error
846bc058 DK	269	msgmsg "test_from_inrelease_to_unsigned_with_override"
c99fe2e1	270	test_from_inrelease_to_unsigned_with_override
b1bdfe68 DK	271	msgmsg "test_from_inrelease_to_norelease_with_override"
b1bdfe68 DK	272	test_from_inrelease_to_norelease_with_override