support Signed-By in Release files as a sort of HPKP

[apt.git] / test / integration / test-releasefile-verification

diff --git a/test/integration/test-releasefile-verification b/test/integration/test-releasefile-verification
index 5da0a829254fdc6cf89c354fe3211c62e24253a9..24e7830aab82bcdd4c3f1de7aee7bb1194b40333 100755 (executable)
--- a/test/integration/test-releasefile-verification
+++ b/test/integration/test-releasefile-verification
@@ -29,10 +29,11 @@ prepare() {
        cp "$1" aptarchive/Packages
        find aptarchive -name 'Release' -delete
        compressfile 'aptarchive/Packages' "$DATE"
-       generatereleasefiles "$DATE"
+       generatereleasefiles "$DATE" 'now + 1 month'
 }
 
 installaptold() {
+       rm -rf rootdir/var/cache/apt/archives
        testsuccessequal "Reading package lists...
 Building dependency tree...
 Suggested packages:
@@ -46,6 +47,7 @@ Download complete and in download only mode" aptget install apt -dy
 }
 
 installaptnew() {
+       rm -rf rootdir/var/cache/apt/archives
        testsuccessequal "Reading package lists...
 Building dependency tree...
 Suggested packages:
@@ -249,30 +251,106 @@ runtest() {
        signreleasefiles 'Joe Sixpack'
        find aptarchive/ -name "$DELETEFILE" -delete
        updatewithwarnings '^W: .* NO_PUBKEY'
-
        sed -i "s#^\(deb\(-src\)\?\) \[signed-by=$MARVIN\] #\1 #" rootdir/etc/apt/sources.list.d/*
+
        local MARVIN="$(aptkey --keyring $MARVIN finger | grep 'Key fingerprint' | cut -d'=' -f 2 | tr -d ' ')"
+       msgmsg 'Cold archive signed by bad keyid' 'Joe Sixpack'
+       rm -rf rootdir/var/lib/apt/lists
+       signreleasefiles 'Joe Sixpack'
+       find aptarchive/ -name "$DELETEFILE" -delete
+       sed -i "s#^\(deb\(-src\)\?\) #\1 [signed-by=$MARVIN] #" rootdir/etc/apt/sources.list.d/*
+       updatewithwarnings '^W: .* be verified because the public key is not available: .*'
 
        msgmsg 'Cold archive signed by good keyid' 'Marvin Paranoid'
-       prepare "${PKGFILE}"
        rm -rf rootdir/var/lib/apt/lists
        signreleasefiles 'Marvin Paranoid'
        find aptarchive/ -name "$DELETEFILE" -delete
-       sed -i "s#^\(deb\(-src\)\?\) #\1 [signed-by=$MARVIN] #" rootdir/etc/apt/sources.list.d/*
        cp keys/marvinparanoid.pub rootdir/etc/apt/trusted.gpg.d/marvinparanoid.gpg
        successfulaptgetupdate
        testsuccessequal "$(cat "${PKGFILE}")
 " aptcache show apt
        installaptold
-       rm -f rootdir/etc/apt/trusted.gpg.d/marvinparanoid.gpg
 
-       msgmsg 'Cold archive signed by bad keyid' 'Joe Sixpack'
+       msgmsg 'Cold archive signed by good keyid' 'Marvin Paranoid,Joe Sixpack'
+       rm -rf rootdir/var/lib/apt/lists
+       signreleasefiles 'Marvin Paranoid,Joe Sixpack'
+       find aptarchive/ -name "$DELETEFILE" -delete
+       successfulaptgetupdate 'NoPubKey: GOODSIG'
+       testsuccessequal "$(cat "${PKGFILE}")
+" aptcache show apt
+       installaptold
+
+       local SIXPACK="$(aptkey --keyring keys/joesixpack.pub finger | grep 'Key fingerprint' | cut -d'=' -f 2 | tr -d ' ')"
+       msgmsg 'Cold archive signed by good keyids' 'Joe Sixpack'
        rm -rf rootdir/var/lib/apt/lists
        signreleasefiles 'Joe Sixpack'
        find aptarchive/ -name "$DELETEFILE" -delete
-       updatewithwarnings '^W: .* be verified because the public key is not available: .*'
+       sed -i "s#^\(deb\(-src\)\?\) \[signed-by=$MARVIN\] #\1 [signed-by=${SIXPACK},${MARVIN}] #" rootdir/etc/apt/sources.list.d/*
+       successfulaptgetupdate
+       testsuccessequal "$(cat "${PKGFILE}")
+" aptcache show apt
+       installaptold
 
-       sed -i "s#^\(deb\(-src\)\?\) \[signed-by=$MARVIN\] #\1 #" rootdir/etc/apt/sources.list.d/*
+       local SIXPACK="$(aptkey --keyring keys/joesixpack.pub finger | grep 'Key fingerprint' | cut -d'=' -f 2 | tr -d ' ')"
+       msgmsg 'Cold archive signed by good keyids' 'Joe Sixpack'
+       rm -rf rootdir/var/lib/apt/lists
+       sed -i "s#^\(deb\(-src\)\?\) \[signed-by=${SIXPACK},${MARVIN}\] #\1 [signed-by=${MARVIN},${SIXPACK}] #" rootdir/etc/apt/sources.list.d/*
+       successfulaptgetupdate
+       testsuccessequal "$(cat "${PKGFILE}")
+" aptcache show apt
+       installaptold
+       rm -f rootdir/etc/apt/trusted.gpg.d/marvinparanoid.gpg
+       sed -i "s#^\(deb\(-src\)\?\) \[signed-by=${MARVIN},${SIXPACK}\] #\1 #" rootdir/etc/apt/sources.list.d/*
+
+       rm -rf rootdir/var/lib/apt/lists-bak
+       cp -a rootdir/var/lib/apt/lists rootdir/var/lib/apt/lists-bak
+       prepare "${PKGFILE}-new"
+       signreleasefiles 'Joe Sixpack'
+       find aptarchive/ -name "$DELETEFILE" -delete
+
+       msgmsg 'Warm archive with signed-by' 'Joe Sixpack'
+       sed -i "/^Valid-Until: / a\
+Signed-By: ${SIXPACK}" rootdir/var/lib/apt/lists/*Release
+       touch -d 'now - 1 year' rootdir/var/lib/apt/lists/*Release
+       successfulaptgetupdate
+       testsuccessequal "$(cat "${PKGFILE}-new")
+" aptcache show apt
+       installaptnew
+
+       msgmsg 'Warm archive with signed-by' 'Marvin Paranoid'
+       rm -rf rootdir/var/lib/apt/lists
+       cp -a rootdir/var/lib/apt/lists-bak rootdir/var/lib/apt/lists
+       sed -i "/^Valid-Until: / a\
+Signed-By: ${MARVIN}" rootdir/var/lib/apt/lists/*Release
+       touch -d 'now - 1 year' rootdir/var/lib/apt/lists/*Release
+       updatewithwarnings 'W: .* public key is not available: GOODSIG'
+       testsuccessequal "$(cat "${PKGFILE}")
+" aptcache show apt
+       installaptold
+
+       msgmsg 'Warm archive with outdated signed-by' 'Marvin Paranoid'
+       rm -rf rootdir/var/lib/apt/lists
+       cp -a rootdir/var/lib/apt/lists-bak rootdir/var/lib/apt/lists
+       sed -i "/^Valid-Until: / a\
+Valid-Until: $(date -u -d "now - 2min" '+%a, %d %b %Y %H:%M:%S %Z') \\
+Signed-By: ${MARVIN}" rootdir/var/lib/apt/lists/*Release
+       touch -d 'now - 1 year' rootdir/var/lib/apt/lists/*Release
+       successfulaptgetupdate
+       testsuccessequal "$(cat "${PKGFILE}-new")
+" aptcache show apt
+       installaptnew
+
+       msgmsg 'Warm archive with two signed-bys' 'Joe Sixpack'
+       rm -rf rootdir/var/lib/apt/lists
+       cp -a rootdir/var/lib/apt/lists-bak rootdir/var/lib/apt/lists
+       sed -i "/^Valid-Until: / a\
+Signed-By: ${MARVIN} ${MARVIN}, \\
+ ${SIXPACK}" rootdir/var/lib/apt/lists/*Release
+       touch -d 'now - 1 year' rootdir/var/lib/apt/lists/*Release
+       successfulaptgetupdate
+       testsuccessequal "$(cat "${PKGFILE}-new")
+" aptcache show apt
+       installaptnew
 }
 
 runtest2() {