]> git.saurik.com Git - apt.git/blob - test/integration/test-apt-key
keep Release.gpg on untrusted to trusted IMS-Hit
[apt.git] / test / integration / test-apt-key
1 #!/bin/sh
2 set -e
3
4 # apt-key is a shell script, so relatively prune to be effected by 'crazy' things:
5 # confuses config parser as there exists no way of escaping " currently.
6 #TMPDIR="$(mktemp -d)/This is \"fü\$\$ing cràzy\", \$(man man | head -n1 | cut -d' ' -f 1)\$!"
7 # gpg doesn't like | in path names – documented e.g. in the man gpg2 --agent-program
8 #TMPDIR="$(mktemp -d)/This is fü\$\$ing cràzy, \$(man man | head -n1 | cut -d' ' -f 1)\$!"
9 TMPDIR_ADD="This is fü\$\$ing cràzy, \$(apt -v)\$!"
10
11 TESTDIR="$(readlink -f "$(dirname "$0")")"
12 . "$TESTDIR/framework"
13
14 setupenvironment
15 configarchitecture 'amd64'
16
17 # start from a clean plate again
18 cleanplate() {
19 rm -rf "${ROOTDIR}/etc/apt/trusted.gpg.d/" "${ROOTDIR}/etc/apt/trusted.gpg"
20 mkdir "${ROOTDIR}/etc/apt/trusted.gpg.d/"
21 }
22 testmultigpg() {
23 testfailure --nomsg aptkey --quiet --readonly "$@"
24 testsuccess grep "^gpgv: Can't check signature" "${ROOTDIR}/tmp/testfailure.output"
25 testsuccess grep '^gpgv: Good signature from' "${ROOTDIR}/tmp/testfailure.output"
26 }
27
28 testrun() {
29 echo "APT::Key::ArchiveKeyring \"${KEYDIR}/joesixpack.pub\";
30 APT::Key::RemovedKeys \"${KEYDIR}/rexexpired.pub\";" > "${ROOTDIR}/etc/apt/apt.conf.d/aptkey.conf"
31
32 cleanplate
33 ln -sf "$(readlink -f "${KEYDIR}/joesixpack.pub")" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
34 testaptkeys 'Joe Sixpack'
35
36 testsuccess aptkey list
37 msgtest 'Check that paths in list output are not' 'double-slashed'
38 testfailure --nomsg grep '//' "${ROOTDIR}/tmp/testsuccess.output"
39
40 testsuccess aptkey finger
41 msgtest 'Check that paths in finger output are not' 'double-slashed'
42 testfailure --nomsg grep '//' "${ROOTDIR}/tmp/testsuccess.output"
43
44 testequalor2 'gpg: key DBAC8DAE: "Joe Sixpack (APT Testcases Dummy) <joe@example.org>" not changed
45 gpg: Total number processed: 1
46 gpg: unchanged: 1' 'gpg: key 5A90D141DBAC8DAE: "Joe Sixpack (APT Testcases Dummy) <joe@example.org>" not changed
47 gpg: Total number processed: 1
48 gpg: unchanged: 1' aptkey --fakeroot update
49
50 testaptkeys 'Joe Sixpack'
51 testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg"
52
53 testsuccess aptkey --fakeroot add "${KEYDIR}/rexexpired.pub"
54 testfilestats "${ROOTDIR}/etc/apt/trusted.gpg" '%a' '=' '644'
55
56 testaptkeys 'Rex Expired' 'Joe Sixpack'
57
58 msgtest 'Check that Sixpack key can be' 'exported'
59 aptkey export 'Sixpack' > "${TMPWORKINGDIRECTORY}/aptkey.export"
60 aptkey --keyring "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg" exportall > "${TMPWORKINGDIRECTORY}/aptkey.exportall"
61 testsuccess --nomsg cmp "${TMPWORKINGDIRECTORY}/aptkey.export" "${TMPWORKINGDIRECTORY}/aptkey.exportall"
62 testsuccess test -s "${TMPWORKINGDIRECTORY}/aptkey.export"
63 testsuccess test -s "${TMPWORKINGDIRECTORY}/aptkey.exportall"
64
65 msgtest 'Execute update again to trigger removal of' 'Rex Expired key'
66 testsuccess --nomsg aptkey --fakeroot update
67
68 testaptkeys 'Joe Sixpack'
69
70 msgtest "Try to remove a key which exists, but isn't in the" 'forced keyring'
71 testsuccess --nomsg aptkey --fakeroot --keyring "${ROOTDIR}/etc/apt/trusted.gpg" del DBAC8DAE
72
73 testaptkeys 'Joe Sixpack'
74
75 testsuccess aptkey --fakeroot del DBAC8DAE
76 testempty aptkey list
77
78 msgtest 'Test key removal with' 'lowercase key ID' #keylength somewhere between 8byte and short
79 cleanplate
80 cp -a "${KEYDIR}/joesixpack.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
81 testsuccess --nomsg aptkey --fakeroot del d141dbac8dae
82 testempty aptkey list
83
84 if [ "$(id -u)" != '0' ]; then
85 msgtest 'Test key removal with' 'unreadable key'
86 cleanplate
87 cp -a "${KEYDIR}/joesixpack.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
88 echo 'foobar' > "${ROOTDIR}/etc/apt/trusted.gpg.d/unreadablekey.gpg"
89 chmod 000 "${ROOTDIR}/etc/apt/trusted.gpg.d/unreadablekey.gpg"
90 testwarning --nomsg aptkey --fakeroot del d141dbac8dae
91 testwarning aptkey list
92 chmod 644 "${ROOTDIR}/etc/apt/trusted.gpg.d/unreadablekey.gpg"
93 rm -f "${ROOTDIR}/etc/apt/trusted.gpg.d/unreadablekey.gpg"
94 grep -v '^W: ' "${ROOTDIR}/tmp/testwarning.output" > "${ROOTDIR}/aptkeylist.output" || true
95 testempty cat "${ROOTDIR}/aptkeylist.output"
96 fi
97
98 msgtest 'Test key removal with' 'single key in real file'
99 cleanplate
100 cp -a "${KEYDIR}/joesixpack.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
101 testsuccess --nomsg aptkey --fakeroot del DBAC8DAE
102 testempty aptkey list
103 testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
104 testsuccess cmp "${KEYDIR}/joesixpack.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg~"
105
106 msgtest 'Test key removal with' 'different key specs'
107 cleanplate
108 cp -a "${KEYDIR}/joesixpack.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
109 cp -a "${KEYDIR}/marvinparanoid.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/marvinparanoid.gpg"
110 testsuccess --nomsg aptkey --fakeroot del 0xDBAC8DAE 528144E2
111 testempty aptkey list
112 testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
113 testsuccess cmp "${KEYDIR}/joesixpack.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg~"
114 testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg.d/marvinparanoid.gpg"
115 testsuccess cmp "${KEYDIR}/marvinparanoid.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/marvinparanoid.gpg~"
116
117 msgtest 'Test key removal with' 'long key ID'
118 cleanplate
119 cp -a "${KEYDIR}/joesixpack.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
120 testsuccess --nomsg aptkey --fakeroot del 5A90D141DBAC8DAE
121 testempty aptkey list
122 testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
123 testsuccess cmp "${KEYDIR}/joesixpack.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg~"
124
125 msgtest 'Test key removal with' 'fingerprint'
126 cleanplate
127 cp -a "${KEYDIR}/joesixpack.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
128 testsuccess --nomsg aptkey --fakeroot del 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE
129 testempty aptkey list
130 testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
131 testsuccess cmp "${KEYDIR}/joesixpack.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg~"
132
133 msgtest 'Test key removal with' 'spaced fingerprint'
134 cleanplate
135 cp -a "${KEYDIR}/joesixpack.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
136 testsuccess --nomsg aptkey --fakeroot del '34A8 E9D1 8DB3 20F3 67E8 EAA0 5A90 D141 DBAC 8DAE'
137 testempty aptkey list
138 testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
139 testsuccess cmp "${KEYDIR}/joesixpack.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg~"
140
141 msgtest 'Test key removal with' 'single key in softlink'
142 cleanplate
143 ln -s "$(readlink -f "${KEYDIR}/joesixpack.pub")" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
144 testsuccess --nomsg aptkey --fakeroot del DBAC8DAE
145 testempty aptkey list
146 testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
147 testsuccess test -L "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg~"
148
149 cleanplate
150 testsuccess aptkey --fakeroot add "${KEYDIR}/joesixpack.pub"
151 ln -sf "$(readlink -f "${KEYDIR}/marvinparanoid.pub")" "${KEYDIR}/marvin paránöid.pub"
152 testsuccess aptkey --fakeroot add "${KEYDIR}/marvin paránöid.pub"
153 testaptkeys 'Joe Sixpack' 'Marvin Paranoid'
154 cp -a "${ROOTDIR}/etc/apt/trusted.gpg" "${KEYDIR}/testcase-multikey.pub" # store for reuse
155
156 msgtest 'Test key removal with' 'multi key in real file'
157 cleanplate
158 cp -a "${KEYDIR}/testcase-multikey.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.gpg"
159 testsuccess --nomsg aptkey --fakeroot del DBAC8DAE
160 testaptkeys 'Marvin Paranoid'
161 testsuccess cmp "${KEYDIR}/testcase-multikey.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.gpg~"
162
163 msgtest 'Test key removal with' 'multi key in softlink'
164 cleanplate
165 ln -s "$(readlink -f "${KEYDIR}/testcase-multikey.pub")" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.gpg"
166 testsuccess --nomsg aptkey --fakeroot del DBAC8DAE
167 testaptkeys 'Marvin Paranoid'
168 testsuccess cmp "${KEYDIR}/testcase-multikey.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.gpg~"
169 testfailure test -L "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.gpg"
170 testsuccess test -L "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.gpg~"
171
172 msgtest 'Test key removal with' 'multiple files including key'
173 cleanplate
174 cp -a "${KEYDIR}/joesixpack.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
175 cp -a "${KEYDIR}/testcase-multikey.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.gpg"
176 testsuccess --nomsg aptkey --fakeroot del DBAC8DAE
177 testaptkeys 'Marvin Paranoid'
178 testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
179 testsuccess cmp "${KEYDIR}/joesixpack.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg~"
180 testsuccess cmp "${KEYDIR}/testcase-multikey.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.gpg~"
181
182 cleanplate
183 cp -a "${KEYDIR}/joesixpack.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
184 cp -a "${KEYDIR}/testcase-multikey.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.gpg"
185 testaptkeys 'Joe Sixpack' 'Joe Sixpack' 'Marvin Paranoid'
186 msgtest 'Test merge-back of' 'added keys'
187 testsuccess --nomsg aptkey adv --batch --yes --import "${KEYDIR}/rexexpired.pub"
188 testaptkeys 'Rex Expired' 'Joe Sixpack' 'Joe Sixpack' 'Marvin Paranoid'
189
190 msgtest 'Test merge-back of' 'removed keys'
191 testsuccess --nomsg aptkey adv --batch --yes --delete-keys 27CE74F9
192 testaptkeys 'Joe Sixpack' 'Joe Sixpack' 'Marvin Paranoid'
193
194 msgtest 'Test merge-back of' 'removed duplicate keys'
195 testsuccess --nomsg aptkey adv --batch --yes --delete-keys DBAC8DAE
196 testaptkeys 'Marvin Paranoid'
197
198 cleanplate
199 cp -a "${KEYDIR}/joesixpack.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.gpg"
200 cp -a "${KEYDIR}/testcase-multikey.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.gpg"
201 local SIGNATURE="${TMPWORKINGDIRECTORY}/signature"
202 msgtest 'Test signing a file' 'with a key'
203 echo 'Verify me. This is my signature.' > "$SIGNATURE"
204 echo 'lalalalala' > "${SIGNATURE}2"
205 testsuccess --nomsg aptkey --quiet --keyring "${KEYDIR}/marvinparanoid.pub" --secret-keyring "${KEYDIR}/marvinparanoid.sec" --readonly \
206 adv --batch --yes --default-key 'Marvin' --armor --detach-sign --sign --output "${SIGNATURE}.gpg" "${SIGNATURE}"
207 testsuccess test -s "${SIGNATURE}.gpg" -a -s "${SIGNATURE}"
208
209 msgtest 'Test verify a file' 'with no sig'
210 testfailure --nomsg aptkey --quiet --readonly --keyring "${KEYDIR}/testcase-multikey.pub" verify "${SIGNATURE}" "${SIGNATURE}2"
211
212 for GPGV in '' 'gpgv' 'gpgv1' 'gpgv2'; do
213 echo "APT::Key::GPGVCommand \"$GPGV\";" > "${ROOTDIR}/etc/apt/apt.conf.d/00gpgvcmd"
214 if [ -n "$GPGV" ] && ! command dpkg -l gnupg1 2>&1 | grep -q '^ii'; then continue; fi
215
216 msgtest 'Test verify a file' 'with all keys'
217 testsuccess --nomsg aptkey --quiet --readonly verify "${SIGNATURE}.gpg" "${SIGNATURE}"
218
219 if [ "$(id -u)" != '0' ]; then
220 msgtest 'Test verify a file' 'with unreadable key'
221 echo 'foobar' > "${ROOTDIR}/etc/apt/trusted.gpg.d/unreadablekey.gpg"
222 chmod 000 "${ROOTDIR}/etc/apt/trusted.gpg.d/unreadablekey.gpg"
223 testwarning --nomsg aptkey --quiet --readonly verify "${SIGNATURE}.gpg" "${SIGNATURE}"
224 testwarning aptkey list
225 chmod 644 "${ROOTDIR}/etc/apt/trusted.gpg.d/unreadablekey.gpg"
226 rm -f "${ROOTDIR}/etc/apt/trusted.gpg.d/unreadablekey.gpg"
227 fi
228
229 msgtest 'Test verify a file' 'with good keyring'
230 testsuccess --nomsg aptkey --quiet --readonly --keyring "${KEYDIR}/testcase-multikey.pub" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
231
232 msgtest 'Test fail verify a file' 'with bad keyring'
233 testfailure --nomsg aptkey --quiet --readonly --keyring "${KEYDIR}/joesixpack.pub" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
234
235 msgtest 'Test fail verify a file' 'with non-existing keyring'
236 testfailure --nomsg aptkey --quiet --readonly --keyring "${KEYDIR}/does-not-exist.pub" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
237 testfailure test -e "${KEYDIR}/does-not-exist.pub"
238
239 # note: this isn't how apts gpgv method implements keyid for verify
240 msgtest 'Test verify a file' 'with good keyid'
241 testsuccess --nomsg aptkey --quiet --readonly --keyid 'Paranoid' verify "${SIGNATURE}.gpg" "${SIGNATURE}"
242
243 msgtest 'Test fail verify a file' 'with bad keyid'
244 testfailure --nomsg aptkey --quiet --readonly --keyid 'Sixpack' verify "${SIGNATURE}.gpg" "${SIGNATURE}"
245
246 msgtest 'Test fail verify a file' 'with non-existing keyid'
247 testfailure --nomsg aptkey --quiet --readonly --keyid 'Kalnischkies' verify "${SIGNATURE}.gpg" "${SIGNATURE}"
248
249 msgtest 'Test verify fails on' 'bad file'
250 testfailure --nomsg aptkey --quiet --readonly verify "${SIGNATURE}.gpg" "${SIGNATURE}2"
251 done
252 rm -f "${ROOTDIR}/etc/apt/apt.conf.d/00gpgvcmd"
253
254 msgtest 'Test verify a file' 'with good keyring'
255 testsuccess --nomsg aptkey --quiet --readonly --keyring "${KEYDIR}/testcase-multikey.pub" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
256
257 cleanplate
258 cat "${KEYDIR}/joesixpack.pub" "${KEYDIR}/marvinparanoid.pub" > "${KEYDIR}/double.pub"
259 cat "${KEYDIR}/joesixpack.sec" "${KEYDIR}/marvinparanoid.sec" > "${KEYDIR}/double.sec"
260 cp -a "${KEYDIR}/double.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/double.gpg"
261 cp -a "${KEYDIR}/testcase-multikey.pub" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.gpg"
262 rm -f "${SIGNATURE}.gpg"
263 testsuccess aptkey --quiet --keyring "${KEYDIR}/double.pub" --secret-keyring "${KEYDIR}/double.sec" --readonly \
264 adv --batch --yes -u 'Marvin' -u 'Joe' --armor --detach-sign --sign --output "${SIGNATURE}.gpg" "${SIGNATURE}"
265 testsuccess test -s "${SIGNATURE}.gpg" -a -s "${SIGNATURE}"
266
267 for GPGV in '' 'gpgv' 'gpgv1' 'gpgv2'; do
268 echo "APT::Key::GPGVCommand \"$GPGV\";" > "${ROOTDIR}/etc/apt/apt.conf.d/00gpgvcmd"
269 if [ -n "$GPGV" ] && ! command dpkg -l gnupg1 2>&1 | grep -q '^ii'; then continue; fi
270
271 msgtest 'Test verify a doublesigned file' 'with all keys'
272 testsuccess --nomsg aptkey --quiet --readonly verify "${SIGNATURE}.gpg" "${SIGNATURE}"
273
274 msgtest 'Test verify a doublesigned file' 'with good keyring joe'
275 testmultigpg --keyring "${KEYDIR}/joesixpack.pub" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
276
277 msgtest 'Test verify a doublesigned file' 'with good keyring marvin'
278 testmultigpg --keyring "${KEYDIR}/marvinparanoid.pub" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
279
280 msgtest 'Test fail verify a doublesigned file' 'with bad keyring'
281 testfailure --nomsg aptkey --quiet --readonly --keyring "${KEYDIR}/rexexpired.pub" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
282
283 msgtest 'Test fail verify a doublesigned file' 'with non-existing keyring'
284 testfailure --nomsg aptkey --quiet --readonly --keyring "${KEYDIR}/does-not-exist.pub" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
285 testfailure test -e "${KEYDIR}/does-not-exist.pub"
286
287 # note: this isn't how apts gpgv method implements keyid for verify
288 msgtest 'Test verify a doublesigned file' 'with good keyid'
289 testmultigpg --keyid 'Paranoid' verify "${SIGNATURE}.gpg" "${SIGNATURE}"
290
291 msgtest 'Test fail verify a doublesigned file' 'with bad keyid'
292 testfailure --nomsg aptkey --quiet --readonly --keyid 'Rex' verify "${SIGNATURE}.gpg" "${SIGNATURE}"
293
294 msgtest 'Test fail verify a doublesigned file' 'with non-existing keyid'
295 testfailure --nomsg aptkey --quiet --readonly --keyid 'Kalnischkies' verify "${SIGNATURE}.gpg" "${SIGNATURE}"
296
297 msgtest 'Test verify fails on' 'bad doublesigned file'
298 testfailure --nomsg aptkey --quiet --readonly verify "${SIGNATURE}.gpg" "${SIGNATURE}2"
299 done
300 rm -f "${ROOTDIR}/etc/apt/apt.conf.d/00gpgvcmd"
301 }
302
303 setupgpgcommand() {
304 local GPGEXE;
305 if command dpkg -l gnupg1 2>&1 | grep -q '^ii'; then
306 if [ "$1" = '1' ]; then
307 GPGEXE='gpg1'
308 else
309 GPGEXE='gpg'
310 fi
311 else
312 if [ "$1" = '1' ]; then
313 GPGEXE='gpg'
314 else
315 GPGEXE='gpg2'
316 fi
317 fi
318 msgmsg 'Force tests to be run with' "$GPGEXE"
319 echo "APT::Key::GPGCommand \"$GPGEXE\";" > "${ROOTDIR}/etc/apt/apt.conf.d/00gpgcmd"
320 testsuccess aptkey --readonly adv --version
321 cp "${ROOTDIR}/tmp/testsuccess.output" "${TMPWORKINGDIRECTORY}/aptkey.version"
322 testsuccess grep "^gpg (GnuPG) $1\." "${TMPWORKINGDIRECTORY}/aptkey.version"
323 }
324
325 # run with default (whatever this is) in current CWD with relative paths
326 ROOTDIR="./rootdir"
327 KEYDIR="./keys"
328 testrun
329
330 # run with … and up the game with a strange CWD & absolute paths
331 ROOTDIR="${TMPWORKINGDIRECTORY}/rootdir"
332 KEYDIR="${TMPWORKINGDIRECTORY}/keys"
333 mkdir inaccessible
334 cd inaccessible
335 chmod 600 ../inaccessible
336 testfilestats "${TMPWORKINGDIRECTORY}/inaccessible" '%a' '=' '600'
337
338 setupgpgcommand '1'
339 testrun
340 setupgpgcommand '2'
341 testrun