test/integration/test-apt-update-file

   1 #!/bin/sh
   2 #
   3 # Ensure that we do not modify file:/// uris (regression test for
   4 # CVE-2014-0487
   5 #
   6 set -e
   7
   8 TESTDIR=$(readlink -f $(dirname $0))
   9 . $TESTDIR/framework
  10
  11 setupenvironment
  12 configarchitecture "amd64"
  13 configcompression 'bz2' 'gz'
  14 confighashes 'SHA512'
  15
  16 insertpackage 'unstable' 'foo' 'all' '1'
  17 insertsource 'unstable' 'foo' 'all' '1'
  18
  19 setupaptarchive --no-update
  20
  21 # ensure the archive is not writable
  22 addtrap 'prefix' 'chmod 755 aptarchive/dists/unstable/main/binary-all;'
  23 if [ "$(id -u)" = '0' ]; then
  24         chmod 550 aptarchive/dists/unstable/main/binary-all
  25         testfailure aptget update
  26 fi
  27 chmod 555 aptarchive/dists/unstable/main/binary-all
  28 testsuccess aptget update
  29
  30 # the release files aren't an IMS-hit, but the indexes are
  31 redatereleasefiles '+1 hour'
  32
  33 # we don't download the index if it isn't updated
  34 testsuccess aptget update -o Debug::pkgAcquire::Auth=1
  35 # file:/ isn't shown in the log, so see if it was downloaded anyhow
  36 cp -a rootdir/tmp/testsuccess.output rootdir/tmp/update.output
  37 canary="SHA512:$(bzcat aptarchive/dists/unstable/main/binary-all/Packages.bz2 | sha512sum |cut -f1 -d' ')"
  38 testfailure grep -- "$canary" rootdir/tmp/update.output
  39
  40 testfoo() {
  41         # foo is still available
  42         testsuccess aptget install -s foo
  43         testsuccess aptcache showsrc foo
  44         testsuccess aptget source foo --print-uris
  45 }
  46 testfoo
  47
  48 # the release file is new again, the index still isn't, but it is somehow gone now from disk
  49 redatereleasefiles '+2 hour'
  50 find rootdir/var/lib/apt/lists -name '*_Packages*' -delete
  51
  52 testsuccess aptget update -o Debug::pkgAcquire::Auth=1
  53 # file:/ isn't shown in the log, so see if it was downloaded anyhow
  54 cp -a rootdir/tmp/testsuccess.output rootdir/tmp/update.output
  55 canary="SHA512:$(bzcat aptarchive/dists/unstable/main/binary-all/Packages.bz2 | sha512sum |cut -f1 -d' ')"
  56 testsuccess grep -- "$canary" rootdir/tmp/update.output
  57
  58 testfoo