test/integration/test-releasefile-verification

   1 #!/bin/sh
   2 set -e
   3
   4 TESTDIR=$(readlink -f $(dirname $0))
   5 . $TESTDIR/framework
   6
   7 setupenvironment
   8 configarchitecture "i386"
   9
  10 buildaptarchive
  11 setupflataptarchive
  12 changetowebserver
  13
  14 webserverconfig 'aptwebserver::support::range' 'false'
  15
  16 prepare() {
  17         local DATE="${2:-now}"
  18         if [ "$DATE" = 'now' ]; then
  19                 if [ "$1" = "${PKGFILE}-new" ]; then
  20                         DATE='now - 1 day'
  21                 else
  22                         DATE='now - 7 day'
  23                 fi
  24         fi
  25         for release in $(find rootdir/var/lib/apt/lists 2> /dev/null); do
  26                 touch -d 'now - 1 year' $release
  27         done
  28         aptget clean
  29         cp $1 aptarchive/Packages
  30         find aptarchive -name 'Release' -delete
  31         compressfile 'aptarchive/Packages' "$DATE"
  32         generatereleasefiles "$DATE"
  33 }
  34
  35 installaptold() {
  36         testsuccessequal 'Reading package lists...
  37 Building dependency tree...
  38 Suggested packages:
  39   aptitude synaptic wajig dpkg-dev apt-doc bzip2 lzma python-apt
  40 The following NEW packages will be installed:
  41   apt
  42 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
  43 After this operation, 5370 kB of additional disk space will be used.
  44 Get:1 http://localhost:8080/  apt 0.7.25.3
  45 Download complete and in download only mode' aptget install apt -dy
  46 }
  47
  48 installaptnew() {
  49         testsuccessequal 'Reading package lists...
  50 Building dependency tree...
  51 Suggested packages:
  52   aptitude synaptic wajig dpkg-dev apt-doc bzip2 lzma python-apt
  53 The following NEW packages will be installed:
  54   apt
  55 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
  56 After this operation, 5808 kB of additional disk space will be used.
  57 Get:1 http://localhost:8080/  apt 0.8.0~pre1
  58 Download complete and in download only mode' aptget install apt -dy
  59 }
  60
  61 failaptold() {
  62         testfailureequal 'Reading package lists...
  63 Building dependency tree...
  64 Suggested packages:
  65   aptitude synaptic wajig dpkg-dev apt-doc bzip2 lzma python-apt
  66 The following NEW packages will be installed:
  67   apt
  68 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
  69 After this operation, 5370 kB of additional disk space will be used.
  70 WARNING: The following packages cannot be authenticated!
  71   apt
  72 E: There are problems and -y was used without --force-yes' aptget install apt -dy
  73 }
  74
  75 failaptnew() {
  76         testfailureequal 'Reading package lists...
  77 Building dependency tree...
  78 Suggested packages:
  79   aptitude synaptic wajig dpkg-dev apt-doc bzip2 lzma python-apt
  80 The following NEW packages will be installed:
  81   apt
  82 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
  83 After this operation, 5808 kB of additional disk space will be used.
  84 WARNING: The following packages cannot be authenticated!
  85   apt
  86 E: There are problems and -y was used without --force-yes' aptget install apt -dy
  87 }
  88
  89 # fake our downloadable file
  90 touch aptarchive/apt.deb
  91
  92 PKGFILE="${TESTDIR}/$(echo "$(basename $0)" | sed 's#^test-#Packages-#')"
  93
  94 updatewithwarnings() {
  95         testwarning aptget update
  96         testsuccess grep -E "$1" rootdir/tmp/testwarning.output
  97 }
  98
  99 runtest() {
 100         prepare ${PKGFILE}
 101         rm -rf rootdir/var/lib/apt/lists
 102         signreleasefiles 'Joe Sixpack'
 103         find aptarchive/ -name "$DELETEFILE" -delete
 104         msgmsg 'Cold archive signed by' 'Joe Sixpack'
 105         testsuccess aptget update
 106         testsuccessequal "$(cat ${PKGFILE})
 107 " aptcache show apt
 108         installaptold
 109
 110         prepare ${PKGFILE}-new
 111         signreleasefiles 'Joe Sixpack'
 112         find aptarchive/ -name "$DELETEFILE" -delete
 113         msgmsg 'Good warm archive signed by' 'Joe Sixpack'
 114         testsuccess aptget update
 115         testsuccessequal "$(cat ${PKGFILE}-new)
 116 " aptcache show apt
 117         installaptnew
 118
 119         prepare ${PKGFILE}
 120         rm -rf rootdir/var/lib/apt/lists
 121         cp keys/rexexpired.pub rootdir/etc/apt/trusted.gpg.d/rexexpired.gpg
 122         signreleasefiles 'Rex Expired'
 123         find aptarchive/ -name "$DELETEFILE" -delete
 124         msgmsg 'Cold archive signed by' 'Rex Expired'
 125         updatewithwarnings '^W: .* KEYEXPIRED'
 126         testsuccessequal "$(cat ${PKGFILE})
 127 " aptcache show apt
 128         failaptold
 129         rm rootdir/etc/apt/trusted.gpg.d/rexexpired.gpg
 130
 131         prepare ${PKGFILE}
 132         rm -rf rootdir/var/lib/apt/lists
 133         signreleasefiles 'Marvin Paranoid'
 134         find aptarchive/ -name "$DELETEFILE" -delete
 135         msgmsg 'Cold archive signed by' 'Marvin Paranoid'
 136         updatewithwarnings '^W: .* NO_PUBKEY'
 137         testsuccessequal "$(cat ${PKGFILE})
 138 " aptcache show apt
 139         failaptold
 140
 141         prepare ${PKGFILE}-new
 142         # weborf doesn't support If-Range
 143         for release in $(find rootdir/var/lib/apt/lists/partial/ -name '*Release'); do
 144                 rm $release
 145                 touch $release
 146         done
 147         signreleasefiles 'Joe Sixpack'
 148         find aptarchive/ -name "$DELETEFILE" -delete
 149         msgmsg 'Bad warm archive signed by' 'Joe Sixpack'
 150         testsuccess aptget update
 151         testsuccessequal "$(cat ${PKGFILE}-new)
 152 " aptcache show apt
 153         installaptnew
 154
 155
 156         prepare ${PKGFILE}
 157         rm -rf rootdir/var/lib/apt/lists
 158         signreleasefiles 'Joe Sixpack'
 159         find aptarchive/ -name "$DELETEFILE" -delete
 160         msgmsg 'Cold archive signed by' 'Joe Sixpack'
 161         testsuccess aptget update
 162         testsuccessequal "$(cat ${PKGFILE})
 163 " aptcache show apt
 164         installaptold
 165
 166         prepare ${PKGFILE}-new
 167         signreleasefiles 'Marvin Paranoid'
 168         find aptarchive/ -name "$DELETEFILE" -delete
 169         msgmsg 'Good warm archive signed by' 'Marvin Paranoid'
 170         updatewithwarnings '^W: .* NO_PUBKEY'
 171         testsuccessequal "$(cat ${PKGFILE})
 172 " aptcache show apt
 173         installaptold
 174
 175         prepare ${PKGFILE}-new
 176         cp keys/rexexpired.pub rootdir/etc/apt/trusted.gpg.d/rexexpired.gpg
 177         signreleasefiles 'Rex Expired'
 178         find aptarchive/ -name "$DELETEFILE" -delete
 179         msgmsg 'Good warm archive signed by' 'Rex Expired'
 180         updatewithwarnings '^W: .* KEYEXPIRED'
 181         testsuccessequal "$(cat ${PKGFILE})
 182 " aptcache show apt
 183         installaptold
 184         rm rootdir/etc/apt/trusted.gpg.d/rexexpired.gpg
 185
 186         prepare ${PKGFILE}-new
 187         signreleasefiles
 188         find aptarchive/ -name "$DELETEFILE" -delete
 189         msgmsg 'Good warm archive signed by' 'Joe Sixpack'
 190         testsuccess aptget update
 191         testsuccessequal "$(cat ${PKGFILE}-new)
 192 " aptcache show apt
 193         installaptnew
 194 }
 195
 196 runtest2() {
 197         prepare ${PKGFILE}
 198         rm -rf rootdir/var/lib/apt/lists
 199         signreleasefiles 'Joe Sixpack'
 200         msgmsg 'Cold archive signed by' 'Joe Sixpack'
 201         testsuccess aptget update
 202
 203         # New .deb but now an unsigned archive. For example MITM to circumvent
 204         # package verification.
 205         prepare ${PKGFILE}-new
 206         find aptarchive/ -name InRelease -delete
 207         find aptarchive/ -name Release.gpg -delete
 208         msgmsg 'Warm archive signed by' 'nobody'
 209         updatewithwarnings 'W: .* no longer signed.'
 210         testsuccessequal "$(cat ${PKGFILE}-new)
 211 " aptcache show apt
 212         failaptnew
 213
 214         # Unsigned archive from the beginning must also be detected.
 215         rm -rf rootdir/var/lib/apt/lists
 216         msgmsg 'Cold archive signed by' 'nobody'
 217         updatewithwarnings 'W: .* is not signed.'
 218         testsuccessequal "$(cat ${PKGFILE}-new)
 219 " aptcache show apt
 220         failaptnew
 221 }
 222
 223 # diable some protection by default and ensure we still do the verification
 224 # correctly
 225 cat > rootdir/etc/apt/apt.conf.d/weaken-security <<EOF
 226 Acquire::AllowInsecureRepositories "1";
 227 Acquire::AllowDowngradeToInsecureRepositories "1";
 228 EOF
 229
 230 msgmsg "Runing base test"
 231 runtest2
 232
 233 DELETEFILE="InRelease"
 234 msgmsg "Running test with deletion of $DELETEFILE"
 235 runtest
 236
 237 DELETEFILE="Release.gpg"
 238 msgmsg "Running test with deletion of $DELETEFILE"
 239 runtest