echo 'Acquire::gpgv::Options { "--weak-digest"; "sha1"; };' > rootdir/etc/apt/apt.conf.d/no-sha1
fi
+ # most tests just need one signed Release file, not both
+ export APT_DONT_SIGN='Release.gpg'
+
msgdone "info"
}
insertpackage 'unstable' 'apt' 'i386' '1.0'
+export APT_DONT_SIGN=''
setupaptarchive --no-update
cp -a aptarchive/dists aptarchive/dists.good
insertpackage 'unstable' 'unrelated2' 'amd64' '0.5~squeeze1'
insertsource 'unstable' 'unrelated' 'all' '0.5~squeeze1'
+export APT_DONT_SIGN=""
setupaptarchive --no-update
changetowebserver
test_from_inrelease_to_unsigned()
{
- # setup archive with InRelease file
+ export APT_DONT_SIGN='Release.gpg'
setupaptarchive_with_lists_clean
testsuccess aptget update
listcurrentlistsdirectory > lists.before
test_from_release_gpg_to_unsigned()
{
- # setup archive with Release/Release.gpg (but no InRelease)
+ export APT_DONT_SIGN='InRelease'
setupaptarchive_with_lists_clean
- rm "$APTARCHIVE/dists/unstable/InRelease"
testsuccess aptget update
listcurrentlistsdirectory > lists.before
test_from_inrelease_to_unsigned_with_override()
{
+ export APT_DONT_SIGN='Release.gpg'
# setup archive with InRelease file
setupaptarchive_with_lists_clean
testsuccess aptget update
#
# Still worth having a regression test the simulates the condition
- # setup archive with InRelease
+ export APT_DONT_SIGN='Release.gpg'
setupaptarchive_with_lists_clean
testsuccess aptget update
listcurrentlistsdirectory > lists.before
# do what CVE-2012-0214 did
- rm "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
+ rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
inject_evil_package
# build valid Release file
aptftparchive -qq release ./aptarchive > aptarchive/dists/unstable/Release
test_subvert_inrelease()
{
- # setup archive with InRelease
+ export APT_DONT_SIGN='Release.gpg'
setupaptarchive_with_lists_clean
testsuccess aptget update
listcurrentlistsdirectory > lists.before
test_inrelease_to_invalid_inrelease()
{
- # setup archive with InRelease
+ export APT_DONT_SIGN='Release.gpg'
setupaptarchive_with_lists_clean
testsuccess aptget update
listcurrentlistsdirectory > lists.before
test_release_gpg_to_invalid_release_release_gpg()
{
- # setup archive with InRelease
+ export APT_DONT_SIGN='InRelease'
setupaptarchive_with_lists_clean
- rm "$APTARCHIVE/dists/unstable/InRelease"
testsuccess aptget update
listcurrentlistsdirectory > lists.before
insertpackage 'unstable' 'apt' 'amd64,i386' '1.0'
+export APT_DONT_SIGN=''
setupaptarchive --no-update
methodtest() {
add_new_package '+1hour'
# switch to a unsigned repo now
- rm "$APTARCHIVE/dists/unstable/InRelease"
- rm "$APTARCHIVE/dists/unstable/Release.gpg"
+ rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
# update fails
testfailureequal "E: The repository 'file:${APTARCHIVE} unstable Release' is no longer signed." aptget update -qq
# switch to a unsigned repo now
add_new_package '+1hour'
- rm "$APTARCHIVE/dists/unstable/InRelease"
- rm "$APTARCHIVE/dists/unstable/Release.gpg"
+ rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
# break it
break_repository_sources_index '+1hour'
test_unauthenticated_to_invalid_inrelease() {
msgmsg 'Test UnAuthenticated to invalid InRelease reverts everything'
create_fresh_archive
- rm "$APTARCHIVE/dists/unstable/InRelease"
- rm "$APTARCHIVE/dists/unstable/Release.gpg"
+ rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
testwarning aptget update --allow-insecure-repositories
listcurrentlistsdirectory > lists.before
setupenvironment
configarchitecture "i386"
+export APT_DONT_SIGN='Release.gpg'
-# setup the archive and ensure we have a single package that installs fine
-setupaptarchive
APTARCHIVE="$(readlink -f ./aptarchive)"
ROOTDIR="${TMPWORKINGDIRECTORY}/rootdir"
APTARCHIVE_LISTS="$(echo "$APTARCHIVE" | tr "/" "_" )"
insertpackage 'unstable' 'cool' 'amd64' '1.0'
+export APT_DONT_SIGN='InRelease'
setupaptarchive --no-update
echo 'NotAutomatic: yes' >> aptarchive/dists/unstable/Release
-
signreleasefiles
-find aptarchive/dists -name 'InRelease' -delete
-
-rm -rf rootdir/var/lib/apt/lists
-
-OUTPUT="$(aptget update 2>&1)"
-msgtest 'Check that parsing happens without warnings' 'with missing newline'
-if echo "${OUTPUT}" | grep '^W:' > /dev/null; then
- msgfail
- echo "${OUTPUT}"
-else
- msgpass
-fi
+testsuccess aptget update
EOF
}
-# fake our downloadable file
-touch aptarchive/apt.deb
-
PKGFILE="${TESTDIR}/$(echo "$(basename $0)" | sed 's#^test-#Packages-#')"
runtest() {
msgtest 'No package from the source available'
testfailureequal --nomsg 'N: Unable to locate package apt
E: No packages found' aptcache show apt
- msgtest 'No Packages file in /var/lib/apt/lists'
- [ "$(ls rootdir/var/lib/apt/lists/*Package* 2>/dev/null | grep -v FAILED 2>/dev/null)" = "" ] && msgpass || msgfail
-
+ msgtest 'No Packages file in /var/lib/apt/lists'
+ testempty find rootdir/var/lib/apt/lists -maxdepth 1 -name '*Package*'
+
# now with the unsigned Release file
rm -rf rootdir/var/lib/apt/lists
- rm aptarchive/InRelease aptarchive/Release.gpg
+ rm -f aptarchive/InRelease aptarchive/Release.gpg
msgtest 'unsigned apt-get update gets the expected hashsum mismatch'
testfailure --nomsg aptget update --allow-insecure-repositories
testsuccess grep "Hash Sum mismatch" rootdir/tmp/testfailure.output
else
msgmsg 'Run tests with GzipIndexes disabled'
fi
-
runtest
done
setupenvironment
configarchitecture "i386"
+export APT_DONT_SIGN='Release.gpg'
buildaptarchive
setupflataptarchive
changetowebserver
export APT_DONT_SIGN="$DELETEFILE"
msgmsg "Running test with deletion of $DELETEFILE and $1 digest"
runtest
- unset APT_DONT_SIGN
+ export APT_DONT_SIGN='Release.gpg'
done
}
testsuccessequal "$(cat "${PKGFILE}")
" aptcache show apt
failaptold
- unset APT_DONT_SIGN
+ export APT_DONT_SIGN='Release.gpg'
done
}
runfailure