From 515d18c9b271e4188dd4c59939c3c3cfeaf575a8 Mon Sep 17 00:00:00 2001 From: Michael Vogt Date: Fri, 5 Aug 2011 11:49:59 +0200 Subject: * test/integration/test-hashsum-verification: - add regression test for hashsum verification --- debian/changelog | 2 + test/integration/test-hashsum-verification | 76 ++++++++++++++++++++++++++++++ 2 files changed, 78 insertions(+) create mode 100755 test/integration/test-hashsum-verification diff --git a/debian/changelog b/debian/changelog index e17b1abd0..1dec5dce0 100644 --- a/debian/changelog +++ b/debian/changelog @@ -11,6 +11,8 @@ apt (0.8.15.6) unstable; urgency=low - use ref-to-ptr semantic in NewDepends() to ensure that the libapt does not segfault if the cache is remapped in between (LP: #812862) + * test/integration/test-hashsum-verification: + - add regression test for hashsum verification -- Michael Vogt Tue, 12 Jul 2011 11:54:47 +0200 diff --git a/test/integration/test-hashsum-verification b/test/integration/test-hashsum-verification new file mode 100755 index 000000000..29420c098 --- /dev/null +++ b/test/integration/test-hashsum-verification @@ -0,0 +1,76 @@ +#!/bin/sh +set -e + +TESTDIR=$(readlink -f $(dirname $0)) +. $TESTDIR/framework + +setupenvironment +configarchitecture "i386" + +buildaptarchive +setupflataptarchive +changetowebserver + +prepare() { + local DATE="${2:-now}" + if [ "$DATE" = 'now' -a "$1" = "${PKGFILE}-new" ]; then + DATE='now + 6 days' + fi + for release in $(find rootdir/var/lib/apt/lists 2> /dev/null); do + touch -d 'now - 6 hours' $release + done + rm -rf rootdir/var/cache/apt/archives + rm -f rootdir/var/cache/apt/*.bin + cp $1 aptarchive/Packages + find aptarchive -name 'Release' -delete + cat aptarchive/Packages | gzip > aptarchive/Packages.gz + cat aptarchive/Packages | bzip2 > aptarchive/Packages.bz2 + cat aptarchive/Packages | lzma > aptarchive/Packages.lzma + # create Release file with incorret checksums + cat > aptarchive/Release <&1 | grep "Hash Sum mismatch" > /dev/null && msgpass || msgfail + msgtest 'No package from the source available' + [ "$(aptcache show apt 2>&1)" = "E: No packages found" ] && msgpass || msgfail + msgtest 'No Packages file in /var/lib/apt/lists' + [ "$(ls rootdir/var/lib/apt/lists/*Package* 2>/dev/null)" = "" ] && msgpass || msgfail + +} + +runtest + -- cgit v1.2.3 From 3568a640bd363409cdeb1cb69eaa3261c79f2ff2 Mon Sep 17 00:00:00 2001 From: Michael Vogt Date: Fri, 5 Aug 2011 12:26:35 +0200 Subject: * apt-pkg/acquire-item.cc: - if no Release.gpg file is found, still load the hashes for verification (closes: #636314) and add test --- apt-pkg/acquire-item.cc | 5 +++-- debian/changelog | 3 +++ test/integration/test-hashsum-verification | 7 +++++++ 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc index 215615bdd..ebd8d5a12 100644 --- a/apt-pkg/acquire-item.cc +++ b/apt-pkg/acquire-item.cc @@ -1258,8 +1258,9 @@ void pkgAcqMetaIndex::Done(string Message,unsigned long Size,string Hash, /*{{{* if (SigFile == "") { // There was no signature file, so we are finished. Download - // the indexes without verification. - QueueIndexes(false); + // the indexes and do hashsum verification + MetaIndexParser->Load(DestFile); + QueueIndexes(true); } else { diff --git a/debian/changelog b/debian/changelog index 1dec5dce0..f162e20f4 100644 --- a/debian/changelog +++ b/debian/changelog @@ -13,6 +13,9 @@ apt (0.8.15.6) unstable; urgency=low (LP: #812862) * test/integration/test-hashsum-verification: - add regression test for hashsum verification + * apt-pkg/acquire-item.cc: + - if no Release.gpg file is found, still load the hashes for + verification (closes: #636314) and add test -- Michael Vogt Tue, 12 Jul 2011 11:54:47 +0200 diff --git a/test/integration/test-hashsum-verification b/test/integration/test-hashsum-verification index 29420c098..033096ee8 100755 --- a/test/integration/test-hashsum-verification +++ b/test/integration/test-hashsum-verification @@ -70,6 +70,13 @@ runtest() { msgtest 'No Packages file in /var/lib/apt/lists' [ "$(ls rootdir/var/lib/apt/lists/*Package* 2>/dev/null)" = "" ] && msgpass || msgfail + # now with the unsigned Release file + rm -rf rootdir/var/lib/apt/lists + rm aptarchive/InRelease aptarchive/Release.gpg + msgtest 'unsigned apt-get update gets the expected hashsum mismatch' + aptget update 2>&1 | grep "Hash Sum mismatch" > /dev/null && msgpass || msgfail + + } runtest -- cgit v1.2.3