* test/integration/test-hashsum-verification:

  - add regression test for hashsum verification
* apt-pkg/acquire-item.cc:
  - if no Release.gpg file is found, still load the hashes for
    verification (closes: #636314) and add test
* apt-pkg/pkgcachegen.cc:
  - fix incorrect comparision when checking sources.list freshness

2 files changed, 5 insertions, 3 deletions

diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc
index df83d1481..152a1e2ea 100644
--- a/apt-pkg/acquire-item.cc
+++ b/apt-pkg/acquire-item.cc
@@ -1258,8 +1258,9 @@ void pkgAcqMetaIndex::Done(string Message,unsigned long long Size,string Hash,	/
       if (SigFile == "")
       {
          // There was no signature file, so we are finished.  Download
-         // the indexes without verification.
-         QueueIndexes(false);
+         // the indexes and do only hashsum verification
+         MetaIndexParser->Load(DestFile);
+         QueueIndexes(true);
       }
       else
       {
@@ -1396,6 +1397,7 @@ void pkgAcqMetaIndex::QueueIndexes(bool verify)				/*{{{*/
 	    {
 	       std::cerr << "Queueing: " << (*Target)->URI << std::endl;
 	       std::cerr << "Expected Hash: " << ExpectedIndexHash.toStr() << std::endl;
+	       std::cerr << "For: " << Record->MetaKeyFilename << std::endl;
 	    }
 	    if (ExpectedIndexHash.empty() == true && (*Target)->IsOptional() == false)
 	    {
diff --git a/apt-pkg/pkgcachegen.cc b/apt-pkg/pkgcachegen.cc
index 3c21b2442..49a7f7adc 100644
--- a/apt-pkg/pkgcachegen.cc
+++ b/apt-pkg/pkgcachegen.cc
@@ -936,7 +936,7 @@ static bool CheckValidity(const string &CacheFile,
       return false;
    }
 
-   if (List.GetLastModifiedTime() < GetModificationTime(CacheFile))
+   if (List.GetLastModifiedTime() > GetModificationTime(CacheFile))
    {
       if (Debug == true)
 	 std::clog << "sources.list is newer than the cache" << std::endl;