"support" unsigned Release files without hashes again

This 'ignores' the component Release files you can find in Debian
alongside the binary-* directories, which isn't exactly a common
usecase, but it worked before, so lets support it again as this isn't
worse than a valid Release file which is unsigned.

Git-Dch: Ignore

diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc
index 9d1c2cc61616f8a9c76d614718c2e36ebd667fa1..2c081261dd335fd81141f3da386fddd09dcb3ea5 100644 (file)
--- a/apt-pkg/acquire-item.cc
+++ b/apt-pkg/acquire-item.cc
@@ -213,7 +213,7 @@ APT_CONST bool pkgAcqTransactionItem::HashesRequired() const
       Only repositories without a Release file can (obviously) not have
       hashes – and they are very uncommon and strongly discouraged */
    return TransactionManager->MetaIndexParser != NULL &&
-      TransactionManager->MetaIndexParser->GetLoadedSuccessfully() != metaIndex::TRI_UNSET;
+      TransactionManager->MetaIndexParser->GetLoadedSuccessfully() == metaIndex::TRI_YES;
 }
 HashStringList pkgAcqTransactionItem::GetExpectedHashes() const
 {
@@ -1669,10 +1669,11 @@ void pkgAcqMetaSig::Failed(string const &Message,pkgAcquire::MethodConfig const
 
       // we parse the indexes here because at this point the user wanted
       // a repository that may potentially harm him
-      if (TransactionManager->MetaIndexParser->Load(MetaIndex->DestFile, &ErrorText) == false || MetaIndex->VerifyVendor(Message) == false)
+      bool const GoodLoad = TransactionManager->MetaIndexParser->Load(MetaIndex->DestFile, &ErrorText);
+      if (MetaIndex->VerifyVendor(Message) == false)
         /* expired Release files are still a problem you need extra force for */;
       else
-        MetaIndex->QueueIndexes(true);
+        MetaIndex->QueueIndexes(GoodLoad);
 
       TransactionManager->TransactionStageCopy(MetaIndex, MetaIndex->DestFile, MetaIndex->GetFinalFilename());
    }

diff --git a/test/integration/test-apt-get-update-unauth-warning b/test/integration/test-apt-get-update-unauth-warning
index b247c1ba9b9b68914b4ddb2b6651bcb7da88d6cb..d71569827f31b30d0ee39c88cf57944df857b551 100755 (executable)
--- a/test/integration/test-apt-get-update-unauth-warning
+++ b/test/integration/test-apt-get-update-unauth-warning
@@ -11,16 +11,21 @@ setupenvironment
 configarchitecture "i386"
 configcompression '.' 'gz'
 
+echo 'Acquire::Progress::Ignore::ShowErrorText "false";' > rootdir/etc/apt/apt.conf.d/99show-no-ignore-errors.conf
+
 # a "normal" package with source and binary
 buildsimplenativepackage 'foo' 'all' '2.0'
 
 setupaptarchive --no-update
 
 APTARCHIVE="$(readlink -f ./aptarchive)"
-find "$APTARCHIVE/dists/unstable" -name '*Release*' -delete
+find "$APTARCHIVE/dists/unstable" \( -name 'InRelease' -o -name 'Release.gpg' \) -delete
+sed -i -n '/^SHA1:$/q;p' "${APTARCHIVE}/dists/unstable/Release"
+testwarning aptget update
 
-echo 'Acquire::Progress::Ignore::ShowErrorText "false";' > rootdir/etc/apt/apt.conf.d/99show-no-ignore-errors.conf
 
+rm -rf rootdir/var/lib/apt/lists
+find "$APTARCHIVE/dists/unstable" -name '*Release*' -delete
 # update without authenticated files leads to warning
 testfailureequal "Get:1 file:$APTARCHIVE unstable InRelease
 Ign:1 file:$APTARCHIVE unstable InRelease