pkg from only trusted sources keeps being trusted

--allow-unauthenticated switches the download to a pre-0.6 system in
which a package can come from any source, rather than that trusted
packages can only come from trusted sources.

To allow this the flag used to set all packages as untrusted, which is a
bit much, so we check now if the package can be acquired via an
untrusted source and only if this is the case set it as untrusted.

As APT nowadays supports setting sources as trusted via a flag in the
sources.list this mode shouldn't be used that much anymore though.

[Note that this is not the patch from the BTS]

Closes: 617690

1 files changed, 52 insertions, 0 deletions

diff --git a/test/integration/test-bug-617690-allow-unauthenticated-makes-all-untrusted b/test/integration/test-bug-617690-allow-unauthenticated-makes-all-untrusted
new file mode 100755
index 000000000..1c2514938
--- /dev/null
+++ b/test/integration/test-bug-617690-allow-unauthenticated-makes-all-untrusted
@@ -0,0 +1,52 @@
+#!/bin/sh
+set -e
+
+TESTDIR=$(readlink -f $(dirname $0))
+. $TESTDIR/framework
+setupenvironment
+configarchitecture 'i386'
+
+buildsimplenativepackage 'cool' 'i386' '1.0' 'unstable'
+
+setupaptarchive --no-update
+
+testfileexists() {
+	msgtest 'Test for existance of file' "$1"
+	test -e "$1" && msgpass || msgfail
+	rm -f "$1"
+}
+
+testfilemissing() {
+	msgtest 'Test for non-existance of file' "$1"
+	test -e "$1" && msgfail || msgpass
+	rm -f "$1"
+}
+
+testrun() {
+	rm -rf rootdir/var/lib/apt
+	testsuccess aptget update
+
+	testsuccess aptget download cool
+	testfileexists 'cool_1.0_i386.deb'
+
+	mv aptarchive/pool/cool_1.0_i386.deb aptarchive/pool/cool_1.0_i386.deb.bak
+	echo 'this is not a good package' > aptarchive/pool/cool_1.0_i386.deb
+	# FIXME: apt-get download should exit non-zero if download fails
+	aptget download cool
+	testfilemissing cool_1.0_i386.deb
+
+	# FIXME: apt-get download should exit non-zero if download fails
+	aptget download cool --allow-unauthenticated  # unauthenticated doesn't mean unchecked
+	testfilemissing cool_1.0_i386.deb
+
+	rm -f aptarchive/pool/cool_1.0_i386.deb
+	mv aptarchive/pool/cool_1.0_i386.deb.bak aptarchive/pool/cool_1.0_i386.deb
+	testsuccess aptget download cool --allow-unauthenticated
+	testfileexists 'cool_1.0_i386.deb'
+}
+
+testrun
+
+find aptarchive/ \( -name 'Release.gpg' -o -name 'InRelease' \) -delete
+# FIXME: apt-get download should warn about untrusted downloads
+testrun