warn if apt-key is run unconditionally in maintainerscript

We want to stop hard-depending on gnupg and for this it is essential
that apt-key isn't used in any critical execution path, which
maintainerscript are. Especially as it is likely that these script call
apt-key either only for (potentially now outdated cleanup) or still not
use the much simpler trusted.gpg.d infrastructure.

diff --git a/cmdline/apt-key.in b/cmdline/apt-key.in
index 3ed2a70cec9f62a4f35202619bc8ea1febaf0199..3f9f016279747a275c5be158374ae6077b4f2165 100644 (file)
--- a/cmdline/apt-key.in
+++ b/cmdline/apt-key.in
@@ -493,8 +493,21 @@ create_gpg_home() {
 }
 
 prepare_gpg_home() {
+    # crude detection if we are called from a maintainerscript where the
+    # package depends on gnupg or not. We accept recommends here as
+    # well as the script hopefully uses apt-key optionally then like e.g.
+    # debian-archive-keyring for (upgrade) cleanup did
+    if [ -n "$DPKG_MAINTSCRIPT_PACKAGE" ]; then
+       if ! dpkg-query --show --showformat '${Pre-Depends}${Depends}${Recommends}' "$DPKG_MAINTSCRIPT_PACKAGE" 2>/dev/null | grep -q gnupg; then
+           cat >&2 <<EOF
+Warning: The $DPKG_MAINTSCRIPT_NAME maintainerscript of the package $DPKG_MAINTSCRIPT_PACKAGE
+Warning: seems to use apt-key (provided by apt) without depending on gnupg or gnupg2.
+Warning: This will BREAK in the future and should be fixed by the package maintainer(s).
+Note: Check first if apt-key functionality is needed at all - it probably isn't!
+EOF
+       fi
+    fi
     eval "$(apt-config shell GPG_EXE Apt::Key::gpgcommand)"
-
     if [ -n "$GPG_EXE" ] && command_available "$GPG_EXE"; then
        true
     elif command_available 'gpg'; then

diff --git a/test/integration/test-apt-key-used-in-maintainerscript b/test/integration/test-apt-key-used-in-maintainerscript
new file mode 100755 (executable)
index 0000000..e5e9696
--- /dev/null
+++ b/test/integration/test-apt-key-used-in-maintainerscript
@@ -0,0 +1,34 @@
+#!/bin/sh
+set -e
+
+TESTDIR="$(readlink -f "$(dirname "$0")")"
+. "$TESTDIR/framework"
+
+setupenvironment
+configarchitecture 'native'
+configdpkgnoopchroot
+
+buildingpkg() {
+       local PKG="$1"
+       shift
+       setupsimplenativepackage "$PKG" 'native' '1' 'unstable' "$@"
+       BUILDDIR="incoming/${PKG}-1"
+       echo '#!/bin/sh
+apt-key list' > "${BUILDDIR}/debian/postinst"
+       buildpackage "$BUILDDIR" 'unstable' 'main' 'native'
+       rm -rf "$BUILDDIR"
+}
+buildingpkg 'aptkeyuser-nodepends' 'Depends: unrelated'
+buildingpkg 'aptkeyuser-depends' 'Depends: gnupg'
+
+setupaptarchive
+
+insertinstalledpackage 'unrelated' 'native' '1'
+insertinstalledpackage 'gnupg' 'native' '1'
+
+testsuccess apt install aptkeyuser-depends -y
+testfailure grep '^Warning: This will BREAK' rootdir/tmp/testsuccess.output
+
+testsuccess apt install aptkeyuser-nodepends -y
+cp rootdir/tmp/testsuccess.output apt.output
+testsuccess grep '^Warning: This will BREAK' apt.output