* apt-pkg/acquire-item.cc:

  - if no Release.gpg file is found, still load the hashes for
    verification (closes: #636314) and add test

1 files changed, 7 insertions, 0 deletions

diff --git a/test/integration/test-hashsum-verification b/test/integration/test-hashsum-verification
index 29420c098..033096ee8 100755
--- a/test/integration/test-hashsum-verification
+++ b/test/integration/test-hashsum-verification
@@ -70,6 +70,13 @@ runtest() {
         msgtest 'No Packages file in /var/lib/apt/lists'
         [ "$(ls rootdir/var/lib/apt/lists/*Package* 2>/dev/null)" = "" ] && msgpass || msgfail 
         
+        # now with the unsigned Release file
+        rm -rf rootdir/var/lib/apt/lists
+        rm aptarchive/InRelease aptarchive/Release.gpg
+        msgtest 'unsigned apt-get update gets the expected hashsum mismatch'
+	aptget update 2>&1 | grep "Hash Sum mismatch" > /dev/null && msgpass || msgfail
+
+
 }
 
 runtest