* test/integration/test-hashsum-verification:

  - add regression test for hashsum verification
* apt-pkg/acquire-item.cc:
  - if no Release.gpg file is found, still load the hashes for
    verification (closes: #636314) and add test

diff --combined apt-pkg/acquire-item.cc
index 215615bdddc27ff89642b20a65e2d8316674e614,ebd8d5a12344ade6a4e980b6fd833bccf6c15c15..7eb5920e0c1d4935f0c8a70862d195595f5e1e63
--- 1/apt-pkg/acquire-item.cc
--- 2/apt-pkg/acquire-item.cc
+++ b/apt-pkg/acquire-item.cc
@@@ -1258,8 -1258,9 +1258,9 @@@ void pkgAcqMetaIndex::Done(string Messa
        if (SigFile == "")
        {
           // There was no signature file, so we are finished.  Download
-          // the indexes without verification.
-          QueueIndexes(false);
 -         // the indexes and do hashsum verification
++         // the indexes and do only hashsum verification
+          MetaIndexParser->Load(DestFile);
+          QueueIndexes(true);
        }
        else
        {

diff --combined debian/changelog
index 75ac0832821f6b91474bf9a58d90ee28c86943c7,f162e20f47341dccf6462ec471f3bb1b10f7614f..489960912fc3e04416ed6dcb8e0f0e776783009c
--- 1/debian/changelog
--- 2/debian/changelog
+++ b/debian/changelog
@@@ -1,4 -1,4 +1,4 @@@
 -apt (0.8.15.6) unstable; urgency=low
 +apt (0.8.15.5.6) UNRELEASED; urgency=low
  
    * apt-pkg/contrib/fileutl.{cc,h}:
      - add GetModificationTime() helper
@@@ -11,7 -11,11 +11,12 @@@
      - use ref-to-ptr semantic in NewDepends() to ensure that the   
        libapt does not segfault if the cache is remapped in between
        (LP: #812862)
 +    - fix crash when P.Arch() was used but the cache got remapped
+   * test/integration/test-hashsum-verification:
+     - add regression test for hashsum verification
+   * apt-pkg/acquire-item.cc:
+     - if no Release.gpg file is found, still load the hashes for
+       verification (closes: #636314) and add test
  
   -- Michael Vogt <mvo@debian.org>  Tue, 12 Jul 2011 11:54:47 +0200