summaryrefslogtreecommitdiff
path: root/test/integration/test-releasefile-verification
diff options
context:
space:
mode:
authorMichael Vogt <mvo@debian.org>2015-08-18 11:54:05 +0200
committerMichael Vogt <mvo@debian.org>2015-08-18 11:54:05 +0200
commit21248c0f00ee71412dbadc6ebf84011cf974346d (patch)
tree7dc1f5904399482d2128765b5b86d57a4ac5b3e1 /test/integration/test-releasefile-verification
parente5f34ad3b043abf033c1626eb8449b75955d6760 (diff)
parent4fc6b7570c3e97b65c118b58cdf6729fa94c9b03 (diff)
Merge branch 'debian/experimental' into feature/srv-records
Conflicts: cmdline/apt-helper.cc cmdline/makefile
Diffstat (limited to 'test/integration/test-releasefile-verification')
-rwxr-xr-xtest/integration/test-releasefile-verification113
1 files changed, 54 insertions, 59 deletions
diff --git a/test/integration/test-releasefile-verification b/test/integration/test-releasefile-verification
index e558b83e8..469ed34d2 100755
--- a/test/integration/test-releasefile-verification
+++ b/test/integration/test-releasefile-verification
@@ -33,7 +33,7 @@ prepare() {
}
installaptold() {
- testequal 'Reading package lists...
+ testsuccessequal 'Reading package lists...
Building dependency tree...
Suggested packages:
aptitude synaptic wajig dpkg-dev apt-doc bzip2 lzma python-apt
@@ -46,7 +46,7 @@ Download complete and in download only mode' aptget install apt -dy
}
installaptnew() {
- testequal 'Reading package lists...
+ testsuccessequal 'Reading package lists...
Building dependency tree...
Suggested packages:
aptitude synaptic wajig dpkg-dev apt-doc bzip2 lzma python-apt
@@ -59,7 +59,7 @@ Download complete and in download only mode' aptget install apt -dy
}
failaptold() {
- testequal 'Reading package lists...
+ testfailureequal 'Reading package lists...
Building dependency tree...
Suggested packages:
aptitude synaptic wajig dpkg-dev apt-doc bzip2 lzma python-apt
@@ -73,7 +73,7 @@ E: There are problems and -y was used without --force-yes' aptget install apt -d
}
failaptnew() {
- testequal 'Reading package lists...
+ testfailureequal 'Reading package lists...
Building dependency tree...
Suggested packages:
aptitude synaptic wajig dpkg-dev apt-doc bzip2 lzma python-apt
@@ -91,25 +91,9 @@ touch aptarchive/apt.deb
PKGFILE="${TESTDIR}/$(echo "$(basename $0)" | sed 's#^test-#Packages-#')"
-updatesuccess() {
- local LOG='update.log'
- if aptget update >$LOG 2>&1 || grep -q -E '^(W|E): ' $LOG; then
- msgpass
- else
- cat $LOG
- msgfail
- fi
-}
-
-updatefailure() {
- local LOG='update.log'
- aptget update >$LOG 2>&1 || true
- if grep -q -E "$1" $LOG; then
- msgpass
- else
- cat $LOG
- msgfail
- fi
+updatewithwarnings() {
+ testwarning aptget update
+ testsuccess grep -E "$1" rootdir/tmp/testwarning.output
}
runtest() {
@@ -117,18 +101,18 @@ runtest() {
rm -rf rootdir/var/lib/apt/lists
signreleasefiles 'Joe Sixpack'
find aptarchive/ -name "$DELETEFILE" -delete
- msgtest 'Cold archive signed by' 'Joe Sixpack'
- updatesuccess
- testequal "$(cat ${PKGFILE})
+ msgmsg 'Cold archive signed by' 'Joe Sixpack'
+ testsuccess aptget update
+ testsuccessequal "$(cat ${PKGFILE})
" aptcache show apt
installaptold
prepare ${PKGFILE}-new
signreleasefiles 'Joe Sixpack'
find aptarchive/ -name "$DELETEFILE" -delete
- msgtest 'Good warm archive signed by' 'Joe Sixpack'
- updatesuccess
- testequal "$(cat ${PKGFILE}-new)
+ msgmsg 'Good warm archive signed by' 'Joe Sixpack'
+ testsuccess aptget update
+ testsuccessequal "$(cat ${PKGFILE}-new)
" aptcache show apt
installaptnew
@@ -137,9 +121,9 @@ runtest() {
cp keys/rexexpired.pub rootdir/etc/apt/trusted.gpg.d/rexexpired.gpg
signreleasefiles 'Rex Expired'
find aptarchive/ -name "$DELETEFILE" -delete
- msgtest 'Cold archive signed by' 'Rex Expired'
- updatefailure '^W: .* KEYEXPIRED'
- testequal "$(cat ${PKGFILE})
+ msgmsg 'Cold archive signed by' 'Rex Expired'
+ updatewithwarnings '^W: .* KEYEXPIRED'
+ testsuccessequal "$(cat ${PKGFILE})
" aptcache show apt
failaptold
rm rootdir/etc/apt/trusted.gpg.d/rexexpired.gpg
@@ -148,9 +132,9 @@ runtest() {
rm -rf rootdir/var/lib/apt/lists
signreleasefiles 'Marvin Paranoid'
find aptarchive/ -name "$DELETEFILE" -delete
- msgtest 'Cold archive signed by' 'Marvin Paranoid'
- updatefailure '^W: .* NO_PUBKEY'
- testequal "$(cat ${PKGFILE})
+ msgmsg 'Cold archive signed by' 'Marvin Paranoid'
+ updatewithwarnings '^W: .* NO_PUBKEY'
+ testsuccessequal "$(cat ${PKGFILE})
" aptcache show apt
failaptold
@@ -162,9 +146,9 @@ runtest() {
done
signreleasefiles 'Joe Sixpack'
find aptarchive/ -name "$DELETEFILE" -delete
- msgtest 'Bad warm archive signed by' 'Joe Sixpack'
- updatesuccess
- testequal "$(cat ${PKGFILE}-new)
+ msgmsg 'Bad warm archive signed by' 'Joe Sixpack'
+ testsuccess aptget update
+ testsuccessequal "$(cat ${PKGFILE}-new)
" aptcache show apt
installaptnew
@@ -173,18 +157,18 @@ runtest() {
rm -rf rootdir/var/lib/apt/lists
signreleasefiles 'Joe Sixpack'
find aptarchive/ -name "$DELETEFILE" -delete
- msgtest 'Cold archive signed by' 'Joe Sixpack'
- updatesuccess
- testequal "$(cat ${PKGFILE})
+ msgmsg 'Cold archive signed by' 'Joe Sixpack'
+ testsuccess aptget update
+ testsuccessequal "$(cat ${PKGFILE})
" aptcache show apt
installaptold
prepare ${PKGFILE}-new
signreleasefiles 'Marvin Paranoid'
find aptarchive/ -name "$DELETEFILE" -delete
- msgtest 'Good warm archive signed by' 'Marvin Paranoid'
- updatefailure '^W: .* NO_PUBKEY'
- testequal "$(cat ${PKGFILE})
+ msgmsg 'Good warm archive signed by' 'Marvin Paranoid'
+ updatewithwarnings '^W: .* NO_PUBKEY'
+ testsuccessequal "$(cat ${PKGFILE})
" aptcache show apt
installaptold
@@ -192,9 +176,9 @@ runtest() {
cp keys/rexexpired.pub rootdir/etc/apt/trusted.gpg.d/rexexpired.gpg
signreleasefiles 'Rex Expired'
find aptarchive/ -name "$DELETEFILE" -delete
- msgtest 'Good warm archive signed by' 'Rex Expired'
- updatefailure '^W: .* KEYEXPIRED'
- testequal "$(cat ${PKGFILE})
+ msgmsg 'Good warm archive signed by' 'Rex Expired'
+ updatewithwarnings '^W: .* KEYEXPIRED'
+ testsuccessequal "$(cat ${PKGFILE})
" aptcache show apt
installaptold
rm rootdir/etc/apt/trusted.gpg.d/rexexpired.gpg
@@ -202,9 +186,9 @@ runtest() {
prepare ${PKGFILE}-new
signreleasefiles
find aptarchive/ -name "$DELETEFILE" -delete
- msgtest 'Good warm archive signed by' 'Joe Sixpack'
- updatesuccess
- testequal "$(cat ${PKGFILE}-new)
+ msgmsg 'Good warm archive signed by' 'Joe Sixpack'
+ testsuccess aptget update
+ testsuccessequal "$(cat ${PKGFILE}-new)
" aptcache show apt
installaptnew
}
@@ -213,32 +197,43 @@ runtest2() {
prepare ${PKGFILE}
rm -rf rootdir/var/lib/apt/lists
signreleasefiles 'Joe Sixpack'
- msgtest 'Cold archive signed by' 'Joe Sixpack'
- updatesuccess
+ msgmsg 'Cold archive signed by' 'Joe Sixpack'
+ testsuccess aptget update
# New .deb but now an unsigned archive. For example MITM to circumvent
# package verification.
prepare ${PKGFILE}-new
find aptarchive/ -name InRelease -delete
find aptarchive/ -name Release.gpg -delete
- msgtest 'Warm archive signed by' 'nobody'
- updatesuccess
- testequal "$(cat ${PKGFILE}-new)
+ msgmsg 'Warm archive signed by' 'nobody'
+ updatewithwarnings 'W: .* no longer signed.'
+ testsuccessequal "$(cat ${PKGFILE}-new)
" aptcache show apt
failaptnew
# Unsigned archive from the beginning must also be detected.
rm -rf rootdir/var/lib/apt/lists
- msgtest 'Cold archive signed by' 'nobody'
- updatesuccess
- testequal "$(cat ${PKGFILE}-new)
+ msgmsg 'Cold archive signed by' 'nobody'
+ updatewithwarnings 'W: .* is not signed.'
+ testsuccessequal "$(cat ${PKGFILE}-new)
" aptcache show apt
failaptnew
}
-runtest2
+# diable some protection by default and ensure we still do the verification
+# correctly
+cat > rootdir/etc/apt/apt.conf.d/weaken-security <<EOF
+Acquire::AllowInsecureRepositories "1";
+Acquire::AllowDowngradeToInsecureRepositories "1";
+EOF
+
+msgmsg "Runing base test"
+runtest2
DELETEFILE="InRelease"
+msgmsg "Running test with deletion of $DELETEFILE"
runtest
+
DELETEFILE="Release.gpg"
+msgmsg "Running test with deletion of $DELETEFILE"
runtest