From 47aca3cfc17ee23c37693b4e53c675a74b38decd Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Fri, 18 Jul 2014 23:41:29 +0200
Subject: add pkgAcquire::TransactionHasError()

---
 test/integration/test-apt-update-transactions | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100755 test/integration/test-apt-update-transactions

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-transactions b/test/integration/test-apt-update-transactions
new file mode 100755
index 000000000..ee8d20dbf
--- /dev/null
+++ b/test/integration/test-apt-update-transactions
@@ -0,0 +1,23 @@
+#!/bin/sh
+set -e
+
+TESTDIR=$(readlink -f $(dirname $0))
+. $TESTDIR/framework
+
+setupenvironment
+configarchitecture "i386"
+
+insertpackage 'unstable' 'foo' 'all' '1.0'
+
+setupaptarchive --no-update
+changetowebserver
+
+# break package file
+cat > aptarchive/dists/unstable/main/binary-i386/Packages <<EOF
+Package: bar
+EOF
+compressfile aptarchive/dists/unstable/main/binary-i386/Packages '+1hour'
+
+# ensure that a update will only succeed entirely or not at all
+testfailure aptget update
+testequal "partial" ls rootdir/var/lib/apt/lists
-- 
cgit v1.2.3


From 2737f28a1cb2d03c66d2a7edd04215566903dbf1 Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Mon, 21 Jul 2014 11:19:37 +0200
Subject: Download Release first, then Release.gpg

The old way of handling this was that pkgAcqMetaIndex was responsible
to check/move both Release and Release.gpg in place. This breaks
the assumption of the transaction that each pkgAcquire::Item has
a single File that its responsible for.
---
 test/integration/test-apt-update-transactions | 1 +
 1 file changed, 1 insertion(+)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-transactions b/test/integration/test-apt-update-transactions
index ee8d20dbf..247334991 100755
--- a/test/integration/test-apt-update-transactions
+++ b/test/integration/test-apt-update-transactions
@@ -21,3 +21,4 @@ compressfile aptarchive/dists/unstable/main/binary-i386/Packages '+1hour'
 # ensure that a update will only succeed entirely or not at all
 testfailure aptget update
 testequal "partial" ls rootdir/var/lib/apt/lists
+
-- 
cgit v1.2.3


From e05672e88678f520b2db59599e939345ad0b6e53 Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@debian.org>
Date: Thu, 31 Jul 2014 09:53:13 +0200
Subject: Rework TransactionID stuff

---
 test/integration/test-apt-update-rollback | 180 ++++++++++++++++++++++++++++++
 1 file changed, 180 insertions(+)
 create mode 100755 test/integration/test-apt-update-rollback

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-rollback b/test/integration/test-apt-update-rollback
new file mode 100755
index 000000000..cd28f1f1f
--- /dev/null
+++ b/test/integration/test-apt-update-rollback
@@ -0,0 +1,180 @@
+#!/bin/sh
+#
+# test that apt-get update is transactional
+# 
+set -e
+
+avoid_ims_hit() {
+    touch -d '+1hour' aptarchive/dists/unstable/main/binary-i386/Packages*
+    touch -d '+1hour' aptarchive/dists/unstable/main/source/Sources*
+    touch -d '+1hour' aptarchive/dists/unstable/*Release*
+
+    touch -d '-1hour' rootdir/var/lib/apt/lists/*
+}
+
+create_fresh_archive()
+{
+    rm -rf aptarchive/*
+    rm -f rootdir/var/lib/apt/lists/_* rootdir/var/lib/apt/lists/partial/*
+
+    insertpackage 'unstable' 'old' 'all' '1.0'
+
+    setupaptarchive
+}
+
+add_new_package() {
+    insertpackage "unstable" "new" "all" "1.0"
+    insertsource "unstable" "new" "all" "1.0"
+
+    setupaptarchive --no-update
+
+    avoid_ims_hit
+}
+
+break_repository_sources_index() {
+    printf "xxx" > $APTARCHIVE/dists/unstable/main/source/Sources
+    gzip -c $APTARCHIVE/dists/unstable/main/source/Sources > \
+            $APTARCHIVE/dists/unstable/main/source/Sources.gz
+    avoid_ims_hit
+}
+
+test_inrelease_to_new_inrelease() {
+    msgmsg "Test InRelease to new InRelease works fine"
+    create_fresh_archive
+    testequal "old/unstable 1.0 all" apt list -q
+
+    add_new_package
+    testsuccess aptget update
+
+    testequal "new/unstable 1.0 all
+old/unstable 1.0 all" apt list -q
+}
+
+test_inrelease_to_broken_hash_reverts_all() {
+    msgmsg "Test InRelease to broken InRelease reverts everything"
+    create_fresh_archive
+    add_new_package
+    # break the Sources file
+    break_repository_sources_index
+
+    # test the error condition
+    testequal "W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease  
+
+W: Failed to fetch copy:${APTARCHIVE}/dists/unstable/main/source/Sources  Hash Sum mismatch
+
+W: Failed to fetch copy:${APTARCHIVE}/dists/unstable/main/binary-i386/Packages  
+
+E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
+    # ensure that the Packages file is also rolled back
+    testequal "E: Unable to locate package new" aptget install new -s -qq
+}
+
+test_inreleae_to_valid_release() {
+    msgmsg "Test InRelease to valid Release"
+    create_fresh_archive
+    add_new_package
+    # switch to a unsinged repo now
+    rm $APTARCHIVE/dists/unstable/InRelease
+    rm $APTARCHIVE/dists/unstable/Release.gpg
+    avoid_ims_hit
+
+    # update works
+    testsuccess aptget update -o Debug::Acquire::Transaction=1
+
+    # test that we can install the new packages but do no longer have a sig
+    testsuccess aptget install old -s
+    testsuccess aptget install new -s
+    testfailure ls $ROOTDIR/var/lib/apt/lists/*_InRelease
+    testfailure ls $ROOTDIR/var/lib/apt/lists/*_Release.gpg
+    testsuccess ls $ROOTDIR/var/lib/apt/lists/*_Release
+}
+
+test_inreleae_to_release_reverts_all() {
+    msgmsg "Test InRelease to broken Release reverts everything"
+    create_fresh_archive
+
+    # switch to a unsinged repo now
+    add_new_package
+    rm $APTARCHIVE/dists/unstable/InRelease
+    rm $APTARCHIVE/dists/unstable/Release.gpg
+    # break it
+    break_repository_sources_index
+
+    # ensure error
+    testequal "W: Failed to fetch file:$APTARCHIVE/dists/unstable/InRelease  
+
+W: Failed to fetch file:$APTARCHIVE/dists/unstable/Release  
+
+W: Failed to fetch file:$APTARCHIVE/dists/unstable/Release.gpg  
+
+W: Failed to fetch copy:$APTARCHIVE/dists/unstable/main/source/Sources  Hash Sum mismatch
+
+W: Failed to fetch copy:$APTARCHIVE/dists/unstable/main/binary-i386/Packages  
+
+E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq # -o Debug::acquire::transaction=1
+
+    # ensure that the Packages file is also rolled back
+    testsuccess aptget install old -s
+    testfailure aptget install new -s
+    testsuccess ls $ROOTDIR/var/lib/apt/lists/*_InRelease
+    testfailure ls $ROOTDIR/var/lib/apt/lists/*_Release
+}
+
+test_unauthenticated_to_invalid_inrelease() {
+    msgmsg "Test UnAuthenticated to invalid InRelease reverts everything"
+    create_fresh_archive
+    rm $APTARCHIVE/dists/unstable/InRelease
+    rm $APTARCHIVE/dists/unstable/Release.gpg
+    avoid_ims_hit
+    
+    testsuccess aptget update -qq
+    testequal "WARNING: The following packages cannot be authenticated!
+  old
+E: There are problems and -y was used without --force-yes" aptget install -qq -y old
+    
+    # go to authenticated but not correct
+    add_new_package
+    break_repository_sources_index
+
+    testequal "W: Hashsum mismatch $ROOTDIR/var/lib/apt/lists/${APTARCHIVE_LISTS}_dists_unstable_main_source_Sources
+W: Failed to fetch file:$APTARCHIVE/dists/unstable/InRelease  
+ 
+W: Failed to fetch copy:$APTARCHIVE/dists/unstable/main/source/Sources  Hash Sum mismatch
+
+E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
+
+    testfailure ls rootdir/var/lib/apt/lists/*_InRelease
+    testequal "WARNING: The following packages cannot be authenticated!
+  old
+E: There are problems and -y was used without --force-yes" aptget install -qq -y old
+}
+
+TESTDIR=$(readlink -f $(dirname $0))
+. $TESTDIR/framework
+
+setupenvironment
+configarchitecture "i386"
+
+# setup the archive and ensure we have a single package that installs fine
+setupaptarchive
+APTARCHIVE=$(readlink -f ./aptarchive)
+ROOTDIR=${TMPWORKINGDIRECTORY}/rootdir
+APTARCHIVE_LISTS="$(echo $APTARCHIVE | tr "/" "_" )"
+
+# test the following cases:
+# - InRelease -> broken InRelease revert to previous state 
+# - empty lists dir and broken remote leaves nothing on the system
+# - InRelease -> hashsum mismatch for one file reverts all files to previous state
+# - Release/Release.gpg -> hashsum mismatch
+# - InRelease -> Release with hashsum mismatch revert entire state and kills Release
+# - Release -> InRelease with broken Sig/Hash removes InRelease
+# going from Release/Release.gpg -> InRelease and vice versa
+# - unauthenticated -> invalid InRelease
+
+test_inrelease_to_new_inrelease
+test_inrelease_to_broken_hash_reverts_all
+
+test_inreleae_to_valid_release
+test_inreleae_to_release_reverts_all
+
+#test_unauthenticated_to_invalid_inrelease
-- 
cgit v1.2.3


From 6d979490c13e9d8004942507c99d152c22184a27 Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@debian.org>
Date: Thu, 31 Jul 2014 10:02:27 +0200
Subject: make test_unauthenticated_to_invalid_inrelease work

---
 test/integration/test-apt-update-rollback | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-rollback b/test/integration/test-apt-update-rollback
index cd28f1f1f..9771f0edc 100755
--- a/test/integration/test-apt-update-rollback
+++ b/test/integration/test-apt-update-rollback
@@ -136,11 +136,12 @@ E: There are problems and -y was used without --force-yes" aptget install -qq -y
     add_new_package
     break_repository_sources_index
 
-    testequal "W: Hashsum mismatch $ROOTDIR/var/lib/apt/lists/${APTARCHIVE_LISTS}_dists_unstable_main_source_Sources
-W: Failed to fetch file:$APTARCHIVE/dists/unstable/InRelease  
- 
+    testequal "W: Failed to fetch file:$APTARCHIVE/dists/unstable/InRelease  
+
 W: Failed to fetch copy:$APTARCHIVE/dists/unstable/main/source/Sources  Hash Sum mismatch
 
+W: Failed to fetch copy:$APTARCHIVE/dists/unstable/main/binary-i386/Packages  
+
 E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
 
     testfailure ls rootdir/var/lib/apt/lists/*_InRelease
@@ -177,4 +178,4 @@ test_inrelease_to_broken_hash_reverts_all
 test_inreleae_to_valid_release
 test_inreleae_to_release_reverts_all
 
-#test_unauthenticated_to_invalid_inrelease
+test_unauthenticated_to_invalid_inrelease
-- 
cgit v1.2.3


From c5fced388848b967f0ce076656cad5366517f981 Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@debian.org>
Date: Thu, 31 Jul 2014 18:40:05 +0200
Subject: ensure InRelease->Release is transactional as well

---
 test/integration/test-apt-update-rollback | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-rollback b/test/integration/test-apt-update-rollback
index 9771f0edc..c16e4f480 100755
--- a/test/integration/test-apt-update-rollback
+++ b/test/integration/test-apt-update-rollback
@@ -150,6 +150,22 @@ E: Some index files failed to download. They have been ignored, or old ones used
 E: There are problems and -y was used without --force-yes" aptget install -qq -y old
 }
 
+test_inrelease_to_unauth_inrelease() {
+    msgmsg "Test InRelease to InRelease without sig"
+    create_fresh_archive
+    signreleasefiles 'Marvin Paranoid'
+    avoid_ims_hit
+    
+    testsuccess aptget update -qq
+
+    testequal "WARNING: The following packages cannot be authenticated!
+  old
+E: There are problems and -y was used without --force-yes" aptget install -qq -y old
+
+    testfailure ls rootdir/var/lib/apt/lists/*_InRelease
+    testsuccess ls rootdir/var/lib/apt/lists/*_Release
+}
+
 TESTDIR=$(readlink -f $(dirname $0))
 . $TESTDIR/framework
 
@@ -179,3 +195,5 @@ test_inreleae_to_valid_release
 test_inreleae_to_release_reverts_all
 
 test_unauthenticated_to_invalid_inrelease
+
+test_inrelease_to_unauth_inrelease
-- 
cgit v1.2.3


From 21638c3af355b3997fadd169495551568af6acfe Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@debian.org>
Date: Thu, 31 Jul 2014 19:24:36 +0200
Subject: fail early (again) on gpg sig failures

---
 test/integration/test-apt-update-rollback | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-rollback b/test/integration/test-apt-update-rollback
index c16e4f480..a6297792e 100755
--- a/test/integration/test-apt-update-rollback
+++ b/test/integration/test-apt-update-rollback
@@ -156,14 +156,13 @@ test_inrelease_to_unauth_inrelease() {
     signreleasefiles 'Marvin Paranoid'
     avoid_ims_hit
     
-    testsuccess aptget update -qq
+    testequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file: unstable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY E8525D47528144E2
 
-    testequal "WARNING: The following packages cannot be authenticated!
-  old
-E: There are problems and -y was used without --force-yes" aptget install -qq -y old
+W: Failed to fetch file:$APTARCHIVE/dists/unstable/InRelease  
 
-    testfailure ls rootdir/var/lib/apt/lists/*_InRelease
-    testsuccess ls rootdir/var/lib/apt/lists/*_Release
+W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
+
+    testsuccess ls rootdir/var/lib/apt/lists/*_InRelease
 }
 
 TESTDIR=$(readlink -f $(dirname $0))
-- 
cgit v1.2.3


From 80976dd5452a9cfbe0c4f6229c729711ba685a5f Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@debian.org>
Date: Fri, 1 Aug 2014 11:06:47 +0200
Subject: mve MetaKey into pkgAcqBaseIndex

---
 test/integration/test-apt-update-rollback | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-rollback b/test/integration/test-apt-update-rollback
index a6297792e..d7078d217 100755
--- a/test/integration/test-apt-update-rollback
+++ b/test/integration/test-apt-update-rollback
@@ -44,7 +44,9 @@ test_inrelease_to_new_inrelease() {
     testequal "old/unstable 1.0 all" apt list -q
 
     add_new_package
-    testsuccess aptget update
+    aptget update -o Debug::Acquire::Transaction=1
+
+    testsuccess aptget update -o Debug::Acquire::Transaction=1
 
     testequal "new/unstable 1.0 all
 old/unstable 1.0 all" apt list -q
-- 
cgit v1.2.3


From 81273628cc3022641756b05e78256d59b7bd7c51 Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@debian.org>
Date: Fri, 1 Aug 2014 11:46:16 +0200
Subject: fix transactionid passing

---
 test/integration/test-apt-update-rollback | 1 -
 1 file changed, 1 deletion(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-rollback b/test/integration/test-apt-update-rollback
index d7078d217..4eef2aecf 100755
--- a/test/integration/test-apt-update-rollback
+++ b/test/integration/test-apt-update-rollback
@@ -44,7 +44,6 @@ test_inrelease_to_new_inrelease() {
     testequal "old/unstable 1.0 all" apt list -q
 
     add_new_package
-    aptget update -o Debug::Acquire::Transaction=1
 
     testsuccess aptget update -o Debug::Acquire::Transaction=1
 
-- 
cgit v1.2.3


From 7abcfdde365d2f1110b1f1189e3fce04abdac98c Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@debian.org>
Date: Fri, 1 Aug 2014 17:13:15 +0200
Subject: check hashes of compressed files as well

---
 test/integration/test-apt-update-rollback | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-rollback b/test/integration/test-apt-update-rollback
index 4eef2aecf..b8a2b0791 100755
--- a/test/integration/test-apt-update-rollback
+++ b/test/integration/test-apt-update-rollback
@@ -61,9 +61,7 @@ test_inrelease_to_broken_hash_reverts_all() {
     # test the error condition
     testequal "W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease  
 
-W: Failed to fetch copy:${APTARCHIVE}/dists/unstable/main/source/Sources  Hash Sum mismatch
-
-W: Failed to fetch copy:${APTARCHIVE}/dists/unstable/main/binary-i386/Packages  
+W: Failed to fetch file:${APTARCHIVE}/dists/unstable/main/source/Sources  Hash Sum mismatch
 
 E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
     # ensure that the Packages file is also rolled back
@@ -108,9 +106,7 @@ W: Failed to fetch file:$APTARCHIVE/dists/unstable/Release
 
 W: Failed to fetch file:$APTARCHIVE/dists/unstable/Release.gpg  
 
-W: Failed to fetch copy:$APTARCHIVE/dists/unstable/main/source/Sources  Hash Sum mismatch
-
-W: Failed to fetch copy:$APTARCHIVE/dists/unstable/main/binary-i386/Packages  
+W: Failed to fetch file:$APTARCHIVE/dists/unstable/main/source/Sources  Hash Sum mismatch
 
 E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq # -o Debug::acquire::transaction=1
 
@@ -139,9 +135,7 @@ E: There are problems and -y was used without --force-yes" aptget install -qq -y
 
     testequal "W: Failed to fetch file:$APTARCHIVE/dists/unstable/InRelease  
 
-W: Failed to fetch copy:$APTARCHIVE/dists/unstable/main/source/Sources  Hash Sum mismatch
-
-W: Failed to fetch copy:$APTARCHIVE/dists/unstable/main/binary-i386/Packages  
+W: Failed to fetch file:$APTARCHIVE/dists/unstable/main/source/Sources  Hash Sum mismatch
 
 E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
 
@@ -166,6 +160,19 @@ W: Some index files failed to download. They have been ignored, or old ones used
     testsuccess ls rootdir/var/lib/apt/lists/*_InRelease
 }
 
+test_inrelease_to_broken_gzip() {
+    msgmsg "Test InRelease to broken gzip"
+    create_fresh_archive
+    # append junk at the end of the gzip, this
+    echo "lala" >> $APTARCHIVE/dists/unstable/main/source/Sources.gz
+    # remove uncompressed file, otherwise apt will just fallback fetching
+    # that
+    rm $APTARCHIVE/dists/unstable/main/source/Sources
+    avoid_ims_hit
+
+    testfailure aptget update
+}
+
 TESTDIR=$(readlink -f $(dirname $0))
 . $TESTDIR/framework
 
@@ -190,10 +197,8 @@ APTARCHIVE_LISTS="$(echo $APTARCHIVE | tr "/" "_" )"
 
 test_inrelease_to_new_inrelease
 test_inrelease_to_broken_hash_reverts_all
-
 test_inreleae_to_valid_release
 test_inreleae_to_release_reverts_all
-
 test_unauthenticated_to_invalid_inrelease
-
 test_inrelease_to_unauth_inrelease
+test_inrelease_to_broken_gzip
-- 
cgit v1.2.3


From 183160cb20cd4aa86e78657bf060bf688edce703 Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@debian.org>
Date: Fri, 1 Aug 2014 17:15:53 +0200
Subject: make errors more consistent

---
 test/integration/test-apt-update-rollback | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-rollback b/test/integration/test-apt-update-rollback
index b8a2b0791..24027787e 100755
--- a/test/integration/test-apt-update-rollback
+++ b/test/integration/test-apt-update-rollback
@@ -59,9 +59,7 @@ test_inrelease_to_broken_hash_reverts_all() {
     break_repository_sources_index
 
     # test the error condition
-    testequal "W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease  
-
-W: Failed to fetch file:${APTARCHIVE}/dists/unstable/main/source/Sources  Hash Sum mismatch
+    testequal "W: Failed to fetch file:${APTARCHIVE}/dists/unstable/main/source/Sources  Hash Sum mismatch
 
 E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
     # ensure that the Packages file is also rolled back
@@ -100,13 +98,7 @@ test_inreleae_to_release_reverts_all() {
     break_repository_sources_index
 
     # ensure error
-    testequal "W: Failed to fetch file:$APTARCHIVE/dists/unstable/InRelease  
-
-W: Failed to fetch file:$APTARCHIVE/dists/unstable/Release  
-
-W: Failed to fetch file:$APTARCHIVE/dists/unstable/Release.gpg  
-
-W: Failed to fetch file:$APTARCHIVE/dists/unstable/main/source/Sources  Hash Sum mismatch
+    testequal "W: Failed to fetch file:$APTARCHIVE/dists/unstable/main/source/Sources  Hash Sum mismatch
 
 E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq # -o Debug::acquire::transaction=1
 
@@ -133,9 +125,7 @@ E: There are problems and -y was used without --force-yes" aptget install -qq -y
     add_new_package
     break_repository_sources_index
 
-    testequal "W: Failed to fetch file:$APTARCHIVE/dists/unstable/InRelease  
-
-W: Failed to fetch file:$APTARCHIVE/dists/unstable/main/source/Sources  Hash Sum mismatch
+    testequal "W: Failed to fetch file:$APTARCHIVE/dists/unstable/main/source/Sources  Hash Sum mismatch
 
 E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
 
-- 
cgit v1.2.3


From 67f2f9e2ed2f48833926abb7c31cca4a57ebfec1 Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@debian.org>
Date: Fri, 1 Aug 2014 17:20:19 +0200
Subject: add gzip test and todo

---
 test/integration/test-apt-update-rollback  |  4 ++++
 test/integration/test-hashsum-verification | 12 ++++++++++--
 2 files changed, 14 insertions(+), 2 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-rollback b/test/integration/test-apt-update-rollback
index 24027787e..ccd7f57ff 100755
--- a/test/integration/test-apt-update-rollback
+++ b/test/integration/test-apt-update-rollback
@@ -185,6 +185,10 @@ APTARCHIVE_LISTS="$(echo $APTARCHIVE | tr "/" "_" )"
 # going from Release/Release.gpg -> InRelease and vice versa
 # - unauthenticated -> invalid InRelease
 
+# stuff to do:
+# - ims-hit 
+# - gzip-index tests
+
 test_inrelease_to_new_inrelease
 test_inrelease_to_broken_hash_reverts_all
 test_inreleae_to_valid_release
diff --git a/test/integration/test-hashsum-verification b/test/integration/test-hashsum-verification
index e77efb46e..70bf1b476 100755
--- a/test/integration/test-hashsum-verification
+++ b/test/integration/test-hashsum-verification
@@ -75,5 +75,13 @@ runtest() {
 
 }
 
-runtest
-
+for COMPRESSEDINDEXES in 'false' 'true'; do
+       echo "Acquire::GzipIndexes \"$COMPRESSEDINDEXES\";" > rootdir/etc/apt/apt.conf.d/compressindexes
+       if $COMPRESSEDINDEXES; then
+               msgmsg 'Run tests with GzipIndexes enabled'
+       else
+               msgmsg 'Run tests with GzipIndexes disabled'
+       fi
+ 
+        runtest
+done
-- 
cgit v1.2.3


From 63d0f85391839a666957add1833e67f7638c8a83 Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@debian.org>
Date: Fri, 1 Aug 2014 19:25:00 +0200
Subject: make i-m-s work again

---
 test/integration/test-apt-update-ims | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100755 test/integration/test-apt-update-ims

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-ims b/test/integration/test-apt-update-ims
new file mode 100755
index 000000000..cf2b28bb5
--- /dev/null
+++ b/test/integration/test-apt-update-ims
@@ -0,0 +1,22 @@
+#!/bin/sh
+set -e
+
+TESTDIR=$(readlink -f $(dirname $0))
+. $TESTDIR/framework
+setupenvironment
+configarchitecture 'amd64'
+
+buildsimplenativepackage 'unrelated' 'all' '0.5~squeeze1' 'unstable'
+
+setupaptarchive
+changetowebserver
+
+testsuccess aptget update
+
+# check that I-M-S header is kept in redirections
+testequal "Hit http://localhost:8080 unstable InRelease
+Hit http://localhost:8080 unstable/main Sources
+Hit http://localhost:8080 unstable/main amd64 Packages
+Hit http://localhost:8080 unstable/main Translation-en
+Reading package lists..." aptget update 
+
-- 
cgit v1.2.3


From 63b7249e6930c1bcb69bac32f10108119eeacc2a Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@debian.org>
Date: Sat, 2 Aug 2014 05:37:43 +0200
Subject: add ims check verify

---
 test/integration/test-apt-update-ims | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-ims b/test/integration/test-apt-update-ims
index cf2b28bb5..3bd6e843c 100755
--- a/test/integration/test-apt-update-ims
+++ b/test/integration/test-apt-update-ims
@@ -20,3 +20,6 @@ Hit http://localhost:8080 unstable/main amd64 Packages
 Hit http://localhost:8080 unstable/main Translation-en
 Reading package lists..." aptget update 
 
+# ensure that we still do a hash check on ims hit
+msgtest 'Test I-M-S reverify'
+aptget update -o Debug::pkgAcquire::Auth=1 2>&1 | grep -A1 'RecivedHash:' | grep -q -- '- SHA' && msgpass || msgfail
-- 
cgit v1.2.3


From 09475bebba5554481a7cb05995ded92cf30063fa Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@debian.org>
Date: Sun, 24 Aug 2014 21:30:44 -0700
Subject: all tests pass

---
 test/integration/test-ubuntu-bug-346386-apt-get-update-paywall | 10 +++++-----
 .../test-ubuntu-bug-784473-InRelease-one-message-only          |  4 +---
 2 files changed, 6 insertions(+), 8 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-ubuntu-bug-346386-apt-get-update-paywall b/test/integration/test-ubuntu-bug-346386-apt-get-update-paywall
index 8e50843f3..388c2bfdb 100755
--- a/test/integration/test-ubuntu-bug-346386-apt-get-update-paywall
+++ b/test/integration/test-ubuntu-bug-346386-apt-get-update-paywall
@@ -37,8 +37,8 @@ ensure_n_canary_strings_in_dir() {
 
 LISTS='rootdir/var/lib/apt/lists'
 rm -rf rootdir/var/lib/apt/lists
-msgtest 'Got expected NODATA failure in' 'apt-get update'
-aptget update -qq 2>&1 | grep -q 'E: GPG error.*NODATA' && msgpass || msgfail
+msgtest 'Got expected failure message' 'apt-get update'
+aptget update -qq 2>&1 | grep -q 'W:.*Does not start with a cleartext signature' && msgpass || msgfail
 
 ensure_n_canary_strings_in_dir $LISTS 'ni ni ni' 0
 testequal 'partial' ls $LISTS
@@ -48,8 +48,8 @@ for f in Release Release.gpg main_binary-amd64_Packages main_source_Sources; do
     echo 'peng neee-wom' > $LISTS/localhost:8080_dists_stable_${f}
 done
 
-msgtest 'Got expected NODATA failure in' 'apt-get update'
-aptget update -qq 2>&1 | grep -q 'E: GPG error.*NODATA' && msgpass || msgfail
+msgtest 'Got expected failure message in' 'apt-get update'
+aptget update -qq 2>&1 | grep -q 'W:.*Does not start with a cleartext signature' && msgpass || msgfail
 
 ensure_n_canary_strings_in_dir $LISTS 'peng neee-wom' 4
 ensure_n_canary_strings_in_dir $LISTS 'ni ni ni' 0
@@ -58,7 +58,7 @@ ensure_n_canary_strings_in_dir $LISTS 'ni ni ni' 0
 echo 'peng neee-wom' > $LISTS/localhost:8080_dists_stable_InRelease
 rm -f $LISTS/localhost:8080_dists_stable_Release $LISTS/localhost:8080_dists_stable_Release.gpg
 msgtest 'excpected failure of' 'apt-get update'
-aptget update -qq 2>&1 | grep -q 'E: GPG error.*NODATA' && msgpass || msgfail
+aptget update -qq 2>&1 | grep -q 'W:.*Does not start with a cleartext signature' && msgpass || msgfail
 
 ensure_n_canary_strings_in_dir $LISTS 'peng neee-wom' 3
 ensure_n_canary_strings_in_dir $LISTS 'ni ni ni' 0
diff --git a/test/integration/test-ubuntu-bug-784473-InRelease-one-message-only b/test/integration/test-ubuntu-bug-784473-InRelease-one-message-only
index 50ca2bf57..09315868b 100755
--- a/test/integration/test-ubuntu-bug-784473-InRelease-one-message-only
+++ b/test/integration/test-ubuntu-bug-784473-InRelease-one-message-only
@@ -28,12 +28,10 @@ MD5Sum:
 done
 
 msgtest 'The unsigned garbage before signed block is' 'ignored'
-testsuccess --nomsg aptget update
+aptget update -qq 2>&1 | grep -q 'W:.*Does not start with a cleartext signature' && msgpass || msgfail
 
 ROOTDIR="$(readlink -f .)"
 testequal "Package files:
  100 ${ROOTDIR}/rootdir/var/lib/dpkg/status
      release a=now
- 500 file:${ROOTDIR}/aptarchive/ unstable/main i386 Packages
-     release a=unstable,n=sid,c=main
 Pinned packages:" aptcache policy
-- 
cgit v1.2.3


From c8aa88aa2c3139584cfabb1ce4619c773e9f2b99 Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Tue, 23 Sep 2014 18:08:53 +0200
Subject: cleanup, fix test-apt-update-unauth as the behavior of apt changed

---
 test/integration/test-apt-update-unauth | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-unauth b/test/integration/test-apt-update-unauth
index 13487603c..4e08b5e35 100755
--- a/test/integration/test-apt-update-unauth
+++ b/test/integration/test-apt-update-unauth
@@ -17,23 +17,41 @@ insertsource 'unstable' 'foo' 'all' '1.0'
 setupaptarchive
 changetowebserver
 
+# FIXME: 
+#  - also check the unauth -> auth success case, i.e. that all files are
+#    reverified
 runtest() {
     # start unauthenticated
     find rootdir/var/lib/apt/lists/ -type f | xargs rm -f
     rm -f aptarchive/dists/unstable/*Release*
+    # remove uncompressed version
+    find aptarchive/ -name Packages | xargs rm -f
     aptget update -qq
 
     # become authenticated
     generatereleasefiles
     signreleasefiles
 
-    # and ensure we do download the data again
-    msgtest "Check that the data is check when going to authenticated"
-    if aptget update |grep -q Hit; then
-        msgfail
-    else
+    # and ensure we re-check the downloaded data
+    msgtest "Check rollback on going from unauth -> auth"
+
+    # change the local packages file
+    PKGS=$(ls rootdir/var/lib/apt/lists/*Packages*)
+    echo "meep" > $PKGS
+    ls -l rootdir/var/lib/apt/lists > lists.before
+
+    # update and ensure all is reverted on the hashsum failure
+    aptget update -o Debug::Acquire::Transaction=1 -o Debug::pkgAcquire::Auth=1 -o Debug::pkgAcquire::worker=0 > output.log 2>&1 || true
+
+    # ensure we have before what we have after
+    ls -l rootdir/var/lib/apt/lists > lists.after
+    if diff -u lists.before lists.after; then
         msgpass
+    else
+        #cat output.log
+        msgfail
     fi
+
 }
 
 for COMPRESSEDINDEXES in 'false' 'true'; do
-- 
cgit v1.2.3


From 03bfbc965443393b92b2d6d82613472fa3a5067f Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Tue, 23 Sep 2014 23:48:19 +0200
Subject: make pdiff transactional (but at the cost of a CopyFile()

---
 test/integration/test-pdiff-usage | 1 +
 1 file changed, 1 insertion(+)

(limited to 'test/integration')

diff --git a/test/integration/test-pdiff-usage b/test/integration/test-pdiff-usage
index 74749d6ab..e86963f28 100755
--- a/test/integration/test-pdiff-usage
+++ b/test/integration/test-pdiff-usage
@@ -159,6 +159,7 @@ SHA1-Patches:
 " aptcache show apt newstuff
 }
 echo 'Debug::pkgAcquire::Diffs "true";
+Debug::Acquire::Transaction "true";
 Debug::pkgAcquire::rred "true";' > rootdir/etc/apt/apt.conf.d/rreddebug.conf
 
 testrun -o Acquire::PDiffs::Merge=0 -o APT::Get::List-Cleanup=1
-- 
cgit v1.2.3


From c4ffa0428b617cd844f0f9dfd5d16ae0553675ac Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@debian.org>
Date: Fri, 26 Sep 2014 20:59:56 +0200
Subject: Print warning for unauthenticated repositories

---
 .../integration/test-apt-get-update-unauth-warning | 30 ++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100755 test/integration/test-apt-get-update-unauth-warning

(limited to 'test/integration')

diff --git a/test/integration/test-apt-get-update-unauth-warning b/test/integration/test-apt-get-update-unauth-warning
new file mode 100755
index 000000000..4411a7430
--- /dev/null
+++ b/test/integration/test-apt-get-update-unauth-warning
@@ -0,0 +1,30 @@
+#!/bin/sh
+#
+# ensure we print warnings for unauthenticated repositories
+# 
+set -e
+
+TESTDIR=$(readlink -f $(dirname $0))
+. $TESTDIR/framework
+
+setupenvironment
+configarchitecture "i386"
+
+# a "normal" package with source and binary
+buildsimplenativepackage 'foo' 'all' '2.0'
+
+setupaptarchive --no-update
+
+APTARCHIVE=$(readlink -f ./aptarchive)
+rm -f $APTARCHIVE/dists/unstable/*Release*
+
+# update without authenticated InRelease file
+testequal "Ign file: unstable InRelease
+Ign file: unstable Release
+Reading package lists...
+W: The data from 'file: unstable Release' is not signed. Packages from that repository can not be authenticated." aptget update
+
+# ensure we can not install the package
+testequal "WARNING: The following packages cannot be authenticated!
+  foo
+E: There are problems and -y was used without --force-yes" aptget install -qq -y foo
-- 
cgit v1.2.3


From 631a7dc7906a10ccd5f14dcfe42224e6107e11f6 Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@debian.org>
Date: Fri, 26 Sep 2014 20:59:31 +0200
Subject: Do not allow going from authenticated to unauthenticated repo

Also rework the way we load the Release file, so it only after
Release.gpg verified the Release file. The rational is that we
never want to load untrusted data into our parsers. Only stuff
verified with gpg or by its hashes get loaded. To load untrusted
data you now need to use apt-get update --allow-unauthenticated.
---
 test/integration/test-apt-update-nofallback | 207 ++++++++++++++++++++++++++++
 1 file changed, 207 insertions(+)
 create mode 100755 test/integration/test-apt-update-nofallback

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-nofallback b/test/integration/test-apt-update-nofallback
new file mode 100755
index 000000000..4e8ea9916
--- /dev/null
+++ b/test/integration/test-apt-update-nofallback
@@ -0,0 +1,207 @@
+#!/bin/sh
+#
+# ensure we never fallback from a signed to a unsigned repo
+# 
+# hash checks are done in 
+# 
+set -e
+
+simulate_mitm_and_inject_evil_package()
+{
+    rm -f $APTARCHIVE/dists/unstable/InRelease
+    rm -f $APTARCHIVE/dists/unstable/Release.gpg
+    inject_evil_package
+}
+
+inject_evil_package()
+{
+    cat > $APTARCHIVE/dists/unstable/main/binary-i386/Packages <<EOF
+Package: evil
+Installed-Size: 29
+Maintainer: Joe Sixpack <joe@example.org>
+Architecture: all
+Version: 1.0
+Filename: pool/evil_1.0_all.deb
+Size: 1270
+Description: an autogenerated evil package
+EOF
+    # avoid ims hit
+    touch -d '+1hour' aptarchive/dists/unstable/main/binary-i386/Packages
+}
+
+assert_update_is_refused_and_last_good_state_used()
+{
+    testequal "E: The repository 'file: unstable Release.gpg' is no longer signed." aptget update -qq
+
+    assert_repo_is_intact
+}
+
+assert_repo_is_intact()
+{
+    testequal "foo/unstable 2.0 all" apt list -q
+    testsuccess "" aptget install -y -s foo
+    testfailure "" aptget install -y evil
+
+    LISTDIR=rootdir/var/lib/apt/lists
+    if ! ( ls $LISTDIR/*InRelease >/dev/null 2>&1 || 
+            ls $LISTDIR/*Release.gpg >/dev/null 2>&1 ); then
+        echo "Can not find InRelease/Release.gpg in $(ls $LISTDIR)"
+        msgfail
+    fi
+}
+
+setupaptarchive_with_lists_clean()
+{
+    setupaptarchive --no-update
+    rm -f rootdir/var/lib/apt/lists/_*
+    #rm -rf rootdir/var/lib/apt/lists
+}
+
+test_from_inrelease_to_unsigned()
+{
+    # setup archive with InRelease file
+    setupaptarchive_with_lists_clean
+    testsuccess aptget update
+
+    simulate_mitm_and_inject_evil_package
+    assert_update_is_refused_and_last_good_state_used
+}
+
+test_from_release_gpg_to_unsigned()
+{
+    # setup archive with Release/Release.gpg (but no InRelease)
+    setupaptarchive_with_lists_clean
+    rm $APTARCHIVE/dists/unstable/InRelease
+    testsuccess aptget update
+
+    simulate_mitm_and_inject_evil_package
+    assert_update_is_refused_and_last_good_state_used
+}
+
+test_cve_2012_0214()
+{
+    # see https://bugs.launchpad.net/ubuntu/+source/apt/+bug/947108
+    #
+    # it was possible to MITM the download so that InRelease/Release.gpg
+    # are not delivered (404) and a altered Release file was send
+    #
+    # apt left the old InRelease file in /var/lib/apt/lists and downloaded
+    # the unauthenticated Release file too giving the false impression that
+    # Release was authenticated
+    #
+    # Note that this is pretty much impossible nowdays because:
+    # a) InRelease is left as is, not split to InRelease/Release as it was 
+    #    in the old days
+    # b) we refuse to go from signed->unsigned
+    #
+    # Still worth having a regression test the simulates the condition
+
+    # setup archive with InRelease
+    setupaptarchive_with_lists_clean
+    testsuccess aptget update
+
+    # do what CVE-2012-0214 did
+    rm $APTARCHIVE/dists/unstable/InRelease
+    rm $APTARCHIVE/dists/unstable/Release.gpg
+    inject_evil_package
+    # build valid Release file
+    aptftparchive -qq release ./aptarchive > aptarchive/dists/unstable/Release 
+
+    assert_update_is_refused_and_last_good_state_used
+
+    # ensure there is no _Release file downloaded
+    testfailure ls rootdir/var/lib/apt/lists/*_Release
+}
+
+test_subvert_inrelease()
+{
+    # setup archive with InRelease
+    setupaptarchive_with_lists_clean
+    testsuccess aptget update
+
+    # replace InRelease with something else
+    mv $APTARCHIVE/dists/unstable/Release $APTARCHIVE/dists/unstable/InRelease
+
+    testequal "W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease  Does not start with a cleartext signature
+
+E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
+
+    # ensure we keep the repo
+    assert_repo_is_intact
+}
+
+test_inrelease_to_invalid_inrelease()
+{
+    # setup archive with InRelease
+    setupaptarchive_with_lists_clean
+    testsuccess aptget update
+
+    # now remove InRelease and subvert Release do no longer verify
+    sed -i 's/Codename.*/Codename: evil!'/ $APTARCHIVE/dists/unstable/InRelease
+    inject_evil_package
+
+    testequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file: unstable InRelease: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
+
+W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease  
+
+W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
+
+    # ensure we keep the repo
+    assert_repo_is_intact
+    testfailure grep "evil" rootdir/var/lib/apt/lists/*InRelease
+}
+
+test_release_gpg_to_invalid_release_release_gpg()
+{
+    # setup archive with InRelease
+    setupaptarchive_with_lists_clean
+    rm $APTARCHIVE/dists/unstable/InRelease
+    testsuccess aptget update
+
+    # now subvert Release do no longer verify
+    echo "Some evil data" >>  $APTARCHIVE/dists/unstable/Release
+    inject_evil_package
+
+    testequal "E: The repository 'file: unstable Release.gpg' is no longer signed." aptget update -qq
+
+    assert_repo_is_intact
+    testfailure grep "evil" rootdir/var/lib/apt/lists/*Release
+}
+
+
+TESTDIR=$(readlink -f $(dirname $0))
+. $TESTDIR/framework
+
+setupenvironment
+configarchitecture "i386"
+
+# a "normal" package with source and binary
+buildsimplenativepackage 'foo' 'all' '2.0'
+
+# setup the archive and ensure we have a single package that installs fine
+setupaptarchive
+APTARCHIVE=$(readlink -f ./aptarchive)
+assert_repo_is_intact
+
+# test the various cases where a repo may go from signed->unsigned
+msgmsg "test_from_inrelease_to_unsigned"
+test_from_inrelease_to_unsigned
+
+msgmsg "test_from_release_gpg_to_unsigned"
+test_from_release_gpg_to_unsigned
+
+# ensure we do not regress on CVE-2012-0214
+msgmsg "test_cve_2012_0214"
+test_cve_2012_0214
+
+# ensure InRelase can not be subverted
+msgmsg "test_subvert_inrelease"
+test_subvert_inrelease
+
+# ensure we revert to last good state if InRelease does not verify
+msgmsg "test_inrelease_to_invalid_inrelease"
+test_inrelease_to_invalid_inrelease
+
+# ensure we revert to last good state if Release/Release.gpg does not verify
+msgmsg "test_release_gpg_to_invalid_release_release_gpg"
+test_release_gpg_to_invalid_release_release_gpg
-- 
cgit v1.2.3


From bca84917c326fa3158e120147c8aecebe0789b47 Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@debian.org>
Date: Fri, 26 Sep 2014 22:45:18 +0200
Subject: test fixes

---
 test/integration/test-apt-get-source-authenticated       |  2 +-
 test/integration/test-apt-get-update-unauth-warning      | 14 ++++++++++++--
 test/integration/test-apt-update-rollback                | 16 +++++++---------
 test/integration/test-apt-update-unauth                  |  2 +-
 .../integration/test-bug-717891-abolute-uris-for-proxies |  2 +-
 test/integration/test-bug-738785-switch-protocol         |  2 +-
 test/integration/test-policy-pinning                     |  3 ++-
 7 files changed, 25 insertions(+), 16 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-get-source-authenticated b/test/integration/test-apt-get-source-authenticated
index 2cee13923..d73097b54 100755
--- a/test/integration/test-apt-get-source-authenticated
+++ b/test/integration/test-apt-get-source-authenticated
@@ -21,7 +21,7 @@ APTARCHIVE=$(readlink -f ./aptarchive)
 rm -f $APTARCHIVE/dists/unstable/*Release*
 
 # update without authenticated InRelease file
-testsuccess aptget update
+testsuccess aptget update --allow-unauthenticated
 
 # this all should fail
 testfailure aptget install -y foo
diff --git a/test/integration/test-apt-get-update-unauth-warning b/test/integration/test-apt-get-update-unauth-warning
index 4411a7430..b1c676738 100755
--- a/test/integration/test-apt-get-update-unauth-warning
+++ b/test/integration/test-apt-get-update-unauth-warning
@@ -18,11 +18,21 @@ setupaptarchive --no-update
 APTARCHIVE=$(readlink -f ./aptarchive)
 rm -f $APTARCHIVE/dists/unstable/*Release*
 
-# update without authenticated InRelease file
+# update without authenticated files leads to warning
 testequal "Ign file: unstable InRelease
 Ign file: unstable Release
 Reading package lists...
-W: The data from 'file: unstable Release' is not signed. Packages from that repository can not be authenticated." aptget update
+W: The data from 'file: unstable Release' is not signed. Packages from that repository can not be authenticated.
+W: Use --allow-unauthenticated to force the update" aptget update
+
+# no package foo
+testequal "Listing..." apt list foo
+
+# allow override
+testequal "Ign file: unstable InRelease
+Ign file: unstable Release
+Reading package lists...
+W: The data from 'file: unstable Release' is not signed. Packages from that repository can not be authenticated." aptget update --allow-unauthenticated
 
 # ensure we can not install the package
 testequal "WARNING: The following packages cannot be authenticated!
diff --git a/test/integration/test-apt-update-rollback b/test/integration/test-apt-update-rollback
index ccd7f57ff..a88b0042b 100755
--- a/test/integration/test-apt-update-rollback
+++ b/test/integration/test-apt-update-rollback
@@ -75,15 +75,14 @@ test_inreleae_to_valid_release() {
     rm $APTARCHIVE/dists/unstable/Release.gpg
     avoid_ims_hit
 
-    # update works
-    testsuccess aptget update -o Debug::Acquire::Transaction=1
+    # update fails
+    testequal "E: The repository 'file: unstable Release.gpg' is no longer signed." aptget update -qq
 
     # test that we can install the new packages but do no longer have a sig
     testsuccess aptget install old -s
-    testsuccess aptget install new -s
-    testfailure ls $ROOTDIR/var/lib/apt/lists/*_InRelease
-    testfailure ls $ROOTDIR/var/lib/apt/lists/*_Release.gpg
-    testsuccess ls $ROOTDIR/var/lib/apt/lists/*_Release
+    testfailure aptget install new -s
+    testsuccess ls $ROOTDIR/var/lib/apt/lists/*_InRelease
+    testfailure ls $ROOTDIR/var/lib/apt/lists/*_Release
 }
 
 test_inreleae_to_release_reverts_all() {
@@ -98,9 +97,7 @@ test_inreleae_to_release_reverts_all() {
     break_repository_sources_index
 
     # ensure error
-    testequal "W: Failed to fetch file:$APTARCHIVE/dists/unstable/main/source/Sources  Hash Sum mismatch
-
-E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq # -o Debug::acquire::transaction=1
+    testequal "E: The repository 'file: unstable Release.gpg' is no longer signed." aptget update -qq # -o Debug::acquire::transaction=1
 
     # ensure that the Packages file is also rolled back
     testsuccess aptget install old -s
@@ -112,6 +109,7 @@ E: Some index files failed to download. They have been ignored, or old ones used
 test_unauthenticated_to_invalid_inrelease() {
     msgmsg "Test UnAuthenticated to invalid InRelease reverts everything"
     create_fresh_archive
+    rm -rf rootdir/var/lib/apt/lists/*
     rm $APTARCHIVE/dists/unstable/InRelease
     rm $APTARCHIVE/dists/unstable/Release.gpg
     avoid_ims_hit
diff --git a/test/integration/test-apt-update-unauth b/test/integration/test-apt-update-unauth
index 4e08b5e35..2e46e3ace 100755
--- a/test/integration/test-apt-update-unauth
+++ b/test/integration/test-apt-update-unauth
@@ -26,7 +26,7 @@ runtest() {
     rm -f aptarchive/dists/unstable/*Release*
     # remove uncompressed version
     find aptarchive/ -name Packages | xargs rm -f
-    aptget update -qq
+    aptget update -qq --allow-unauthenticated
 
     # become authenticated
     generatereleasefiles
diff --git a/test/integration/test-bug-717891-abolute-uris-for-proxies b/test/integration/test-bug-717891-abolute-uris-for-proxies
index ac1d6ec11..a8947b5e2 100755
--- a/test/integration/test-bug-717891-abolute-uris-for-proxies
+++ b/test/integration/test-bug-717891-abolute-uris-for-proxies
@@ -12,7 +12,7 @@ setupaptarchive
 changetowebserver --request-absolute='uri'
 
 msgtest 'Check that absolute paths are' 'not accepted'
-testfailure --nomsg aptget update
+testfailure --nomsg aptget update --allow-unauthenticated
 
 echo 'Acquire::http::Proxy "http://localhost:8080";' > rootdir/etc/apt/apt.conf.d/99proxy
 
diff --git a/test/integration/test-bug-738785-switch-protocol b/test/integration/test-bug-738785-switch-protocol
index 1e5748eae..4ff044515 100755
--- a/test/integration/test-bug-738785-switch-protocol
+++ b/test/integration/test-bug-738785-switch-protocol
@@ -60,4 +60,4 @@ mv rootdir/${COPYMETHODS}.bak rootdir/${COPYMETHODS}
 # check that downgrades from https to http are not allowed
 webserverconfig 'aptwebserver::support::http' 'true'
 sed -i -e 's#:8080/redirectme#:4433/downgrademe#' -e 's# http:# https:#' rootdir/etc/apt/sources.list.d/*
-testfailure aptget update
+testfailure aptget update --allow-unauthenticated
diff --git a/test/integration/test-policy-pinning b/test/integration/test-policy-pinning
index 8eb4bcbad..2281d7a1d 100755
--- a/test/integration/test-policy-pinning
+++ b/test/integration/test-policy-pinning
@@ -28,7 +28,7 @@ Pinned packages:" aptcache policy $*
 aptgetupdate() {
 	# just to be sure that no old files are used
 	rm -rf rootdir/var/lib/apt
-	if aptget update -qq 2>&1 | grep '^E: '; then
+	if aptget update  --allow-unauthenticated -qq 2>&1 | grep '^E: '; then
 		msgwarn 'apt-get update failed with an error'
 	fi
 }
@@ -36,6 +36,7 @@ aptgetupdate() {
 ### not signed archive
 
 aptgetupdate
+
 testequalpolicy 100 500
 testequalpolicy 990 500 -t now
 
-- 
cgit v1.2.3


From e1bd768b762bd74221f9089133883723a7307f9b Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Mon, 29 Sep 2014 11:03:02 +0200
Subject: test fixes

---
 test/integration/test-apt-update-rollback                            | 2 +-
 test/integration/test-apt-update-unauth                              | 2 ++
 .../test-bug-617690-allow-unauthenticated-makes-all-untrusted        | 5 ++++-
 test/integration/test-bug-728500-tempdir                             | 2 +-
 4 files changed, 8 insertions(+), 3 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-rollback b/test/integration/test-apt-update-rollback
index a88b0042b..e37be9554 100755
--- a/test/integration/test-apt-update-rollback
+++ b/test/integration/test-apt-update-rollback
@@ -114,7 +114,7 @@ test_unauthenticated_to_invalid_inrelease() {
     rm $APTARCHIVE/dists/unstable/Release.gpg
     avoid_ims_hit
     
-    testsuccess aptget update -qq
+    testsuccess aptget update -qq --allow-unauthenticated
     testequal "WARNING: The following packages cannot be authenticated!
   old
 E: There are problems and -y was used without --force-yes" aptget install -qq -y old
diff --git a/test/integration/test-apt-update-unauth b/test/integration/test-apt-update-unauth
index 2e46e3ace..5db8a3c16 100755
--- a/test/integration/test-apt-update-unauth
+++ b/test/integration/test-apt-update-unauth
@@ -8,6 +8,8 @@ set -e
 TESTDIR=$(readlink -f $(dirname $0))
 . $TESTDIR/framework
 
+umask 022
+
 setupenvironment
 configarchitecture "i386"
 
diff --git a/test/integration/test-bug-617690-allow-unauthenticated-makes-all-untrusted b/test/integration/test-bug-617690-allow-unauthenticated-makes-all-untrusted
index f93510fd7..276e10564 100755
--- a/test/integration/test-bug-617690-allow-unauthenticated-makes-all-untrusted
+++ b/test/integration/test-bug-617690-allow-unauthenticated-makes-all-untrusted
@@ -24,15 +24,18 @@ testfilemissing() {
 
 testrun() {
 	rm -rf rootdir/var/lib/apt
-	testsuccess aptget update
 
 	if [ "$1" = 'trusted' ]; then
+	    testsuccess aptget update
+
 		testsuccess aptget download cool
 		testfileexists 'cool_1.0_i386.deb'
 
 		testsuccess aptget download cool --allow-unauthenticated
 		testfileexists 'cool_1.0_i386.deb'
 	else
+	    testsuccess aptget update --allow-unauthenticated
+
 		testfailure aptget download cool
 		testfilemissing 'cool_1.0_i386.deb'
 
diff --git a/test/integration/test-bug-728500-tempdir b/test/integration/test-bug-728500-tempdir
index 0451fc1ed..e9df0a709 100755
--- a/test/integration/test-bug-728500-tempdir
+++ b/test/integration/test-bug-728500-tempdir
@@ -17,7 +17,7 @@ msgtest 'Test apt-get update with incorrect' 'TMPDIR'
 OUTPUT=$(mktemp)
 addtrap "rm $OUTPUT;"
 export TMPDIR=/does-not-exists
-if aptget update >${OUTPUT} 2>&1; then
+if aptget update -o Debug::Acquire::gpg=1 >${OUTPUT} 2>&1; then
 	msgpass
 else
 	echo
-- 
cgit v1.2.3


From c292cc32b3ab0d70c63e68f7c94446932217c0ec Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Mon, 29 Sep 2014 11:47:03 +0200
Subject: more test fixes

---
 test/integration/test-bug-596498-trusted-unsigned-repo |  2 +-
 test/integration/test-hashsum-verification             | 10 +++++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-bug-596498-trusted-unsigned-repo b/test/integration/test-bug-596498-trusted-unsigned-repo
index 06c9c8285..973520a97 100755
--- a/test/integration/test-bug-596498-trusted-unsigned-repo
+++ b/test/integration/test-bug-596498-trusted-unsigned-repo
@@ -12,7 +12,7 @@ setupaptarchive
 
 aptgetupdate() {
 	rm -rf rootdir/var/lib/apt/ rootdir/var/cache/apt/*.bin
-	aptget update -qq
+	aptget update -qq --allow-unauthenticated
 }
 
 PKGTEXT="$(aptget install cool --assume-no -d | head -n 7)"
diff --git a/test/integration/test-hashsum-verification b/test/integration/test-hashsum-verification
index 2a400dcb4..2db2bab0f 100755
--- a/test/integration/test-hashsum-verification
+++ b/test/integration/test-hashsum-verification
@@ -70,9 +70,13 @@ runtest() {
         rm -rf rootdir/var/lib/apt/lists
         rm aptarchive/InRelease aptarchive/Release.gpg
         msgtest 'unsigned apt-get update gets the expected hashsum mismatch'
-	aptget update 2>&1 | grep "Hash Sum mismatch" > /dev/null && msgpass || msgfail
-
-
+	aptget update --allow-unauthenticated >output.log 2>&1 || true
+        if grep -q "Hash Sum mismatch" output.log; then
+            msgpass
+        else
+            cat output.log
+            msgfail
+        fi
 }
 
 for COMPRESSEDINDEXES in 'false' 'true'; do
-- 
cgit v1.2.3


From c99fe2e169243fc6e1a3278ce3768f0f521e260b Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Wed, 1 Oct 2014 12:21:55 +0200
Subject: Use
 Acquire::Allow{InsecureRepositories,DowngradeToInsecureRepositories}

The configuration key Acquire::AllowInsecureRepositories controls if
apt allows loading of unsigned repositories at all.

The configuration Acquire::AllowDowngradeToInsecureRepositories
controls if a signed repository can ever become unsigned. This
should really never be needed but we provide it to avoid having
to mess around in /var/lib/apt/lists if there is a use-case for
this (which I can't think of right now).
---
 test/integration/test-apt-get-source-authenticated |  2 +-
 .../integration/test-apt-get-update-unauth-warning |  4 ++--
 test/integration/test-apt-update-nofallback        | 23 ++++++++++++++++++++++
 test/integration/test-apt-update-rollback          |  2 +-
 test/integration/test-apt-update-unauth            |  2 +-
 .../test-bug-596498-trusted-unsigned-repo          |  2 +-
 ...17690-allow-unauthenticated-makes-all-untrusted |  4 ++--
 .../test-bug-717891-abolute-uris-for-proxies       |  2 +-
 test/integration/test-bug-738785-switch-protocol   |  2 +-
 test/integration/test-hashsum-verification         |  2 +-
 test/integration/test-policy-pinning               |  2 +-
 11 files changed, 35 insertions(+), 12 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-get-source-authenticated b/test/integration/test-apt-get-source-authenticated
index d73097b54..d833ddd85 100755
--- a/test/integration/test-apt-get-source-authenticated
+++ b/test/integration/test-apt-get-source-authenticated
@@ -21,7 +21,7 @@ APTARCHIVE=$(readlink -f ./aptarchive)
 rm -f $APTARCHIVE/dists/unstable/*Release*
 
 # update without authenticated InRelease file
-testsuccess aptget update --allow-unauthenticated
+testsuccess aptget update --allow-insecure-repositories
 
 # this all should fail
 testfailure aptget install -y foo
diff --git a/test/integration/test-apt-get-update-unauth-warning b/test/integration/test-apt-get-update-unauth-warning
index b1c676738..510249747 100755
--- a/test/integration/test-apt-get-update-unauth-warning
+++ b/test/integration/test-apt-get-update-unauth-warning
@@ -23,7 +23,7 @@ testequal "Ign file: unstable InRelease
 Ign file: unstable Release
 Reading package lists...
 W: The data from 'file: unstable Release' is not signed. Packages from that repository can not be authenticated.
-W: Use --allow-unauthenticated to force the update" aptget update
+W: Use --allow-insecure-repositories to force the update" aptget update
 
 # no package foo
 testequal "Listing..." apt list foo
@@ -32,7 +32,7 @@ testequal "Listing..." apt list foo
 testequal "Ign file: unstable InRelease
 Ign file: unstable Release
 Reading package lists...
-W: The data from 'file: unstable Release' is not signed. Packages from that repository can not be authenticated." aptget update --allow-unauthenticated
+W: The data from 'file: unstable Release' is not signed. Packages from that repository can not be authenticated." aptget update --allow-insecure-repositories
 
 # ensure we can not install the package
 testequal "WARNING: The following packages cannot be authenticated!
diff --git a/test/integration/test-apt-update-nofallback b/test/integration/test-apt-update-nofallback
index 4e8ea9916..a53226e18 100755
--- a/test/integration/test-apt-update-nofallback
+++ b/test/integration/test-apt-update-nofallback
@@ -78,6 +78,25 @@ test_from_release_gpg_to_unsigned()
     assert_update_is_refused_and_last_good_state_used
 }
 
+test_from_inrelease_to_unsigned_with_override()
+{
+    # setup archive with InRelease file
+    setupaptarchive_with_lists_clean
+    testsuccess aptget update
+
+    # simulate moving to a unsigned but otherwise valid repo
+    simulate_mitm_and_inject_evil_package
+    generatereleasefiles
+
+    # and ensure we can update to it (with enough force) 
+    testsuccess aptget update --allow-insecure-repositories \
+        -o Acquire::AllowDowngradeToInsecureRepositories=1
+    # but that the individual packages are still considered untrusted
+    testequal "WARNING: The following packages cannot be authenticated!
+  evil
+E: There are problems and -y was used without --force-yes" aptget install -qq -y evil
+}
+
 test_cve_2012_0214()
 {
     # see https://bugs.launchpad.net/ubuntu/+source/apt/+bug/947108
@@ -205,3 +224,7 @@ test_inrelease_to_invalid_inrelease
 # ensure we revert to last good state if Release/Release.gpg does not verify
 msgmsg "test_release_gpg_to_invalid_release_release_gpg"
 test_release_gpg_to_invalid_release_release_gpg
+
+# ensure we can ovveride the downgrade error
+msgmsg "test_from_inrelease_to_unsigned"
+test_from_inrelease_to_unsigned_with_override
diff --git a/test/integration/test-apt-update-rollback b/test/integration/test-apt-update-rollback
index e37be9554..ee8bc6926 100755
--- a/test/integration/test-apt-update-rollback
+++ b/test/integration/test-apt-update-rollback
@@ -114,7 +114,7 @@ test_unauthenticated_to_invalid_inrelease() {
     rm $APTARCHIVE/dists/unstable/Release.gpg
     avoid_ims_hit
     
-    testsuccess aptget update -qq --allow-unauthenticated
+    testsuccess aptget update -qq --allow-insecure-repositories
     testequal "WARNING: The following packages cannot be authenticated!
   old
 E: There are problems and -y was used without --force-yes" aptget install -qq -y old
diff --git a/test/integration/test-apt-update-unauth b/test/integration/test-apt-update-unauth
index 5db8a3c16..ade523ea7 100755
--- a/test/integration/test-apt-update-unauth
+++ b/test/integration/test-apt-update-unauth
@@ -28,7 +28,7 @@ runtest() {
     rm -f aptarchive/dists/unstable/*Release*
     # remove uncompressed version
     find aptarchive/ -name Packages | xargs rm -f
-    aptget update -qq --allow-unauthenticated
+    aptget update -qq --allow-insecure-repositories
 
     # become authenticated
     generatereleasefiles
diff --git a/test/integration/test-bug-596498-trusted-unsigned-repo b/test/integration/test-bug-596498-trusted-unsigned-repo
index 973520a97..3104a70c2 100755
--- a/test/integration/test-bug-596498-trusted-unsigned-repo
+++ b/test/integration/test-bug-596498-trusted-unsigned-repo
@@ -12,7 +12,7 @@ setupaptarchive
 
 aptgetupdate() {
 	rm -rf rootdir/var/lib/apt/ rootdir/var/cache/apt/*.bin
-	aptget update -qq --allow-unauthenticated
+	aptget update -qq --allow-insecure-repositories
 }
 
 PKGTEXT="$(aptget install cool --assume-no -d | head -n 7)"
diff --git a/test/integration/test-bug-617690-allow-unauthenticated-makes-all-untrusted b/test/integration/test-bug-617690-allow-unauthenticated-makes-all-untrusted
index 276e10564..0736bb6dc 100755
--- a/test/integration/test-bug-617690-allow-unauthenticated-makes-all-untrusted
+++ b/test/integration/test-bug-617690-allow-unauthenticated-makes-all-untrusted
@@ -26,7 +26,7 @@ testrun() {
 	rm -rf rootdir/var/lib/apt
 
 	if [ "$1" = 'trusted' ]; then
-	    testsuccess aptget update
+	        testsuccess aptget update
 
 		testsuccess aptget download cool
 		testfileexists 'cool_1.0_i386.deb'
@@ -34,7 +34,7 @@ testrun() {
 		testsuccess aptget download cool --allow-unauthenticated
 		testfileexists 'cool_1.0_i386.deb'
 	else
-	    testsuccess aptget update --allow-unauthenticated
+                testsuccess aptget update --allow-insecure-repositories
 
 		testfailure aptget download cool
 		testfilemissing 'cool_1.0_i386.deb'
diff --git a/test/integration/test-bug-717891-abolute-uris-for-proxies b/test/integration/test-bug-717891-abolute-uris-for-proxies
index a8947b5e2..54a616686 100755
--- a/test/integration/test-bug-717891-abolute-uris-for-proxies
+++ b/test/integration/test-bug-717891-abolute-uris-for-proxies
@@ -12,7 +12,7 @@ setupaptarchive
 changetowebserver --request-absolute='uri'
 
 msgtest 'Check that absolute paths are' 'not accepted'
-testfailure --nomsg aptget update --allow-unauthenticated
+testfailure --nomsg aptget update --allow-insecure-repositories
 
 echo 'Acquire::http::Proxy "http://localhost:8080";' > rootdir/etc/apt/apt.conf.d/99proxy
 
diff --git a/test/integration/test-bug-738785-switch-protocol b/test/integration/test-bug-738785-switch-protocol
index 4ff044515..f81bba4b9 100755
--- a/test/integration/test-bug-738785-switch-protocol
+++ b/test/integration/test-bug-738785-switch-protocol
@@ -60,4 +60,4 @@ mv rootdir/${COPYMETHODS}.bak rootdir/${COPYMETHODS}
 # check that downgrades from https to http are not allowed
 webserverconfig 'aptwebserver::support::http' 'true'
 sed -i -e 's#:8080/redirectme#:4433/downgrademe#' -e 's# http:# https:#' rootdir/etc/apt/sources.list.d/*
-testfailure aptget update --allow-unauthenticated
+testfailure aptget update --allow-insecure-repositories
diff --git a/test/integration/test-hashsum-verification b/test/integration/test-hashsum-verification
index 2db2bab0f..5f88110b3 100755
--- a/test/integration/test-hashsum-verification
+++ b/test/integration/test-hashsum-verification
@@ -70,7 +70,7 @@ runtest() {
         rm -rf rootdir/var/lib/apt/lists
         rm aptarchive/InRelease aptarchive/Release.gpg
         msgtest 'unsigned apt-get update gets the expected hashsum mismatch'
-	aptget update --allow-unauthenticated >output.log 2>&1 || true
+	aptget update --allow-insecure-repositories >output.log 2>&1 || true
         if grep -q "Hash Sum mismatch" output.log; then
             msgpass
         else
diff --git a/test/integration/test-policy-pinning b/test/integration/test-policy-pinning
index 2281d7a1d..c08a2f103 100755
--- a/test/integration/test-policy-pinning
+++ b/test/integration/test-policy-pinning
@@ -28,7 +28,7 @@ Pinned packages:" aptcache policy $*
 aptgetupdate() {
 	# just to be sure that no old files are used
 	rm -rf rootdir/var/lib/apt
-	if aptget update  --allow-unauthenticated -qq 2>&1 | grep '^E: '; then
+	if aptget update  --allow-insecure-repositories -qq 2>&1 | grep '^E: '; then
 		msgwarn 'apt-get update failed with an error'
 	fi
 }
-- 
cgit v1.2.3


From e8b1db38cca29cbdc0116e567f0aa7a28034287b Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Wed, 1 Oct 2014 14:06:01 +0200
Subject: update test/integration/test-releasefile-verification

---
 test/integration/test-releasefile-verification | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

(limited to 'test/integration')

diff --git a/test/integration/test-releasefile-verification b/test/integration/test-releasefile-verification
index e558b83e8..3765a4b1f 100755
--- a/test/integration/test-releasefile-verification
+++ b/test/integration/test-releasefile-verification
@@ -235,10 +235,21 @@ runtest2() {
 " aptcache show apt
 	failaptnew
 }
-runtest2
 
+# diable some protection by default and ensure we still do the verification
+# correctly
+cat > rootdir/etc/apt/apt.conf.d/weaken-security <<EOF
+Acquire::AllowInsecureRepositories "1";
+Acquire::AllowDowngradeToInsecureRepositories "1";
+EOF
+
+msgmsg "Runing base test"
+runtest2
 
 DELETEFILE="InRelease"
+msgmsg "Running test with deletion of $DELETEFILE"
 runtest
+
 DELETEFILE="Release.gpg"
+msgmsg "Running test with deletion of $DELETEFILE"
 runtest
-- 
cgit v1.2.3


From 8beef749860d99fd21ea15852aad7716dd7b741b Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Wed, 1 Oct 2014 14:22:46 +0200
Subject: fix test-apt-update-nofallback test

---
 test/integration/test-apt-update-nofallback | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-nofallback b/test/integration/test-apt-update-nofallback
index a53226e18..c400dcc36 100755
--- a/test/integration/test-apt-update-nofallback
+++ b/test/integration/test-apt-update-nofallback
@@ -181,7 +181,11 @@ test_release_gpg_to_invalid_release_release_gpg()
     echo "Some evil data" >>  $APTARCHIVE/dists/unstable/Release
     inject_evil_package
 
-    testequal "E: The repository 'file: unstable Release.gpg' is no longer signed." aptget update -qq
+    testequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file: unstable Release.gpg: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
+
+W: Failed to fetch file:${APTARCHIVE}/dists/unstable/Release.gpg  
+
+W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
 
     assert_repo_is_intact
     testfailure grep "evil" rootdir/var/lib/apt/lists/*Release
-- 
cgit v1.2.3


From 0b844e23f014bd3ce95e27fe5fa81138e9ae4879 Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Wed, 1 Oct 2014 17:13:33 +0200
Subject: hack around test-apt-update-unauth failure

---
 test/integration/test-apt-update-unauth | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-unauth b/test/integration/test-apt-update-unauth
index ade523ea7..cf5195024 100755
--- a/test/integration/test-apt-update-unauth
+++ b/test/integration/test-apt-update-unauth
@@ -26,34 +26,43 @@ runtest() {
     # start unauthenticated
     find rootdir/var/lib/apt/lists/ -type f | xargs rm -f
     rm -f aptarchive/dists/unstable/*Release*
-    # remove uncompressed version
-    find aptarchive/ -name Packages | xargs rm -f
+
     aptget update -qq --allow-insecure-repositories
 
+    # FIXME: this really shouldn't be needed
+    rm -f rootdir/var/lib/apt/lists/partial/*
+
     # become authenticated
     generatereleasefiles
     signreleasefiles
 
+    # move uncompressed away
+    mv aptarchive/dists/unstable/main/binary-i386/Packages \
+        aptarchive/dists/unstable/main/binary-i386/Packages.uncompressed
+
     # and ensure we re-check the downloaded data
     msgtest "Check rollback on going from unauth -> auth"
 
     # change the local packages file
     PKGS=$(ls rootdir/var/lib/apt/lists/*Packages*)
     echo "meep" > $PKGS
-    ls -l rootdir/var/lib/apt/lists > lists.before
+    ls rootdir/var/lib/apt/lists/ > lists.before
 
     # update and ensure all is reverted on the hashsum failure
-    aptget update -o Debug::Acquire::Transaction=1 -o Debug::pkgAcquire::Auth=1 -o Debug::pkgAcquire::worker=0 > output.log 2>&1 || true
+    aptget update -o Debug::Acquire::Transaction=0 -o Debug::pkgAcquire::Auth=1 -o Debug::pkgAcquire::worker=0 -o Debug::acquire::http=0 > output.log 2>&1 || true
 
     # ensure we have before what we have after
-    ls -l rootdir/var/lib/apt/lists > lists.after
+    ls rootdir/var/lib/apt/lists/ > lists.after
     if diff -u lists.before lists.after; then
         msgpass
     else
-        #cat output.log
+        cat output.log
         msgfail
     fi
 
+    # move uncompressed back for release file 
+    mv aptarchive/dists/unstable/main/binary-i386/Packages.uncompressed \
+        aptarchive/dists/unstable/main/binary-i386/Packages
 }
 
 for COMPRESSEDINDEXES in 'false' 'true'; do
-- 
cgit v1.2.3


From 47450dea0904298c8d5ea06b15ea26368da5a4ee Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Wed, 1 Oct 2014 18:01:14 +0200
Subject: fix leftover files from Acquire::GzipIndex

---
 test/integration/test-apt-update-ims | 29 ++++++++++++++++++++++-------
 1 file changed, 22 insertions(+), 7 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-ims b/test/integration/test-apt-update-ims
index 3bd6e843c..946dfc7af 100755
--- a/test/integration/test-apt-update-ims
+++ b/test/integration/test-apt-update-ims
@@ -11,15 +11,30 @@ buildsimplenativepackage 'unrelated' 'all' '0.5~squeeze1' 'unstable'
 setupaptarchive
 changetowebserver
 
-testsuccess aptget update
+runtest() {
+    rm -f rootdir/var/lib/apt/lists/localhost*
 
-# check that I-M-S header is kept in redirections
-testequal "Hit http://localhost:8080 unstable InRelease
+    testsuccess aptget update
+
+    # ensure no leftovers in partial
+    testfailure ls "rootdir/var/lib/apt/lists/partial/*"
+
+    # check that I-M-S header is kept in redirections
+    testequal "Hit http://localhost:8080 unstable InRelease
 Hit http://localhost:8080 unstable/main Sources
 Hit http://localhost:8080 unstable/main amd64 Packages
 Hit http://localhost:8080 unstable/main Translation-en
-Reading package lists..." aptget update 
+Reading package lists..." aptget update  -o Debug::pkgAcquire::Worker=0 -o Debug::Acquire::http=0
+    
+    # ensure that we still do a hash check on ims hit
+    msgtest 'Test I-M-S reverify'
+    aptget update -o Debug::pkgAcquire::Auth=1 2>&1 | grep -A1 'RecivedHash:' | grep -q -- '- SHA' && msgpass || msgfail
+
+    # ensure no leftovers in partial
+    testfailure ls "rootdir/var/lib/apt/lists/partial/*"
+}
+
+runtest
 
-# ensure that we still do a hash check on ims hit
-msgtest 'Test I-M-S reverify'
-aptget update -o Debug::pkgAcquire::Auth=1 2>&1 | grep -A1 'RecivedHash:' | grep -q -- '- SHA' && msgpass || msgfail
+echo "Acquire::GzipIndexes "1";" > rootdir/etc/apt/apt.conf.d/02compressindex
+runtest
-- 
cgit v1.2.3


From 1e8ba0d4087f72a930a588ce5fbf0c22dddb9403 Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Thu, 2 Oct 2014 00:38:35 +0200
Subject: donkults fixes

---
 test/integration/test-apt-by-hash-update | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-by-hash-update b/test/integration/test-apt-by-hash-update
index 23282bf86..6e1ecdaff 100755
--- a/test/integration/test-apt-by-hash-update
+++ b/test/integration/test-apt-by-hash-update
@@ -34,7 +34,7 @@ Building dependency tree...
 E: Unable to locate package foo" aptget install -q -s foo
 
 # ensure we can apt-get update by hash
-testsuccess aptget update -o APT::Acquire::By-Hash=1
+testsuccess aptget update -o APT::Acquire::By-Hash=1 
 
 # ensure it works
 testequal "Inst foo (1.0 unstable [all])
-- 
cgit v1.2.3


From 1ce243188c2ba218f5dce8ec8b40556d58ed8ec2 Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Thu, 2 Oct 2014 18:28:55 +0200
Subject: cleanup around pkgAcqMetaSig and improved tests

---
 test/integration/test-apt-update-ims | 34 +++++++++++++++++++++++++++++-----
 1 file changed, 29 insertions(+), 5 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-ims b/test/integration/test-apt-update-ims
index 946dfc7af..38dcd73fd 100755
--- a/test/integration/test-apt-update-ims
+++ b/test/integration/test-apt-update-ims
@@ -20,11 +20,7 @@ runtest() {
     testfailure ls "rootdir/var/lib/apt/lists/partial/*"
 
     # check that I-M-S header is kept in redirections
-    testequal "Hit http://localhost:8080 unstable InRelease
-Hit http://localhost:8080 unstable/main Sources
-Hit http://localhost:8080 unstable/main amd64 Packages
-Hit http://localhost:8080 unstable/main Translation-en
-Reading package lists..." aptget update  -o Debug::pkgAcquire::Worker=0 -o Debug::Acquire::http=0
+    testequal "$EXPECT" aptget update  -o Debug::pkgAcquire::Worker=0 -o Debug::Acquire::http=0
     
     # ensure that we still do a hash check on ims hit
     msgtest 'Test I-M-S reverify'
@@ -34,6 +30,34 @@ Reading package lists..." aptget update  -o Debug::pkgAcquire::Worker=0 -o Debug
     testfailure ls "rootdir/var/lib/apt/lists/partial/*"
 }
 
+EXPECT="Hit http://localhost:8080 unstable InRelease
+Hit http://localhost:8080 unstable/main Sources
+Hit http://localhost:8080 unstable/main amd64 Packages
+Hit http://localhost:8080 unstable/main Translation-en
+Reading package lists..."
+# with InRelease
+runtest
+
+# with gzip
+echo "Acquire::GzipIndexes "1";" > rootdir/etc/apt/apt.conf.d/02compressindex
+runtest
+
+# FIXME: how can we get rid of this extra line
+#  "Get:1 http://localhost:8080 unstable Release.gpg" 
+#
+# with Release/Release.gpg 
+EXPECT="Ign http://localhost:8080 unstable InRelease
+Hit http://localhost:8080 unstable Release
+Hit http://localhost:8080 unstable Release.gpg
+Get:1 http://localhost:8080 unstable Release.gpg
+Hit http://localhost:8080 unstable/main Sources
+Hit http://localhost:8080 unstable/main amd64 Packages
+Hit http://localhost:8080 unstable/main Translation-en
+Reading package lists..."
+
+find aptarchive -name "InRelease" | xargs rm -f
+
+echo "Acquire::GzipIndexes "0";" > rootdir/etc/apt/apt.conf.d/02compressindex
 runtest
 
 echo "Acquire::GzipIndexes "1";" > rootdir/etc/apt/apt.conf.d/02compressindex
-- 
cgit v1.2.3


From 0f56b51e125d24cf5af68459077ad1b682743bc2 Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Mon, 6 Oct 2014 09:34:06 +0200
Subject: update test

---
 test/integration/test-apt-get-update-unauth-warning | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-get-update-unauth-warning b/test/integration/test-apt-get-update-unauth-warning
index 510249747..75863615e 100755
--- a/test/integration/test-apt-get-update-unauth-warning
+++ b/test/integration/test-apt-get-update-unauth-warning
@@ -20,13 +20,17 @@ rm -f $APTARCHIVE/dists/unstable/*Release*
 
 # update without authenticated files leads to warning
 testequal "Ign file: unstable InRelease
-Ign file: unstable Release
-Reading package lists...
+Err file: unstable Release
+  
 W: The data from 'file: unstable Release' is not signed. Packages from that repository can not be authenticated.
-W: Use --allow-insecure-repositories to force the update" aptget update
+W: Use --allow-insecure-repositories to force the update
+W: Failed to fetch file:$APTARCHIVE/dists/unstable/Release  
+
+E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update
 
 # no package foo
 testequal "Listing..." apt list foo
+testequal "partial" ls rootdir/var/lib/apt/lists
 
 # allow override
 testequal "Ign file: unstable InRelease
-- 
cgit v1.2.3


From f30976478e684fc19e48d71881805454ceb6ecae Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Mon, 6 Oct 2014 11:45:42 +0200
Subject: Rework pkgAcqMeta{Index,Sig,ClearSig}::Done() for readability

Move common code out but do not use subclassing for ::Done
to make it easier to understand what each class is doing when
its done
---
 test/integration/test-apt-update-ims | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-update-ims b/test/integration/test-apt-update-ims
index 38dcd73fd..61b808b0f 100755
--- a/test/integration/test-apt-update-ims
+++ b/test/integration/test-apt-update-ims
@@ -30,6 +30,7 @@ runtest() {
     testfailure ls "rootdir/var/lib/apt/lists/partial/*"
 }
 
+msgmsg "InRelease"
 EXPECT="Hit http://localhost:8080 unstable InRelease
 Hit http://localhost:8080 unstable/main Sources
 Hit http://localhost:8080 unstable/main amd64 Packages
@@ -42,14 +43,11 @@ runtest
 echo "Acquire::GzipIndexes "1";" > rootdir/etc/apt/apt.conf.d/02compressindex
 runtest
 
-# FIXME: how can we get rid of this extra line
-#  "Get:1 http://localhost:8080 unstable Release.gpg" 
-#
+msgmsg "Release/Release.gpg"
 # with Release/Release.gpg 
 EXPECT="Ign http://localhost:8080 unstable InRelease
 Hit http://localhost:8080 unstable Release
 Hit http://localhost:8080 unstable Release.gpg
-Get:1 http://localhost:8080 unstable Release.gpg
 Hit http://localhost:8080 unstable/main Sources
 Hit http://localhost:8080 unstable/main amd64 Packages
 Hit http://localhost:8080 unstable/main Translation-en
@@ -62,3 +60,23 @@ runtest
 
 echo "Acquire::GzipIndexes "1";" > rootdir/etc/apt/apt.conf.d/02compressindex
 runtest
+
+
+# no Release.gpg or InRelease
+msgmsg "Release only"
+EXPECT="Ign http://localhost:8080 unstable InRelease
+Hit http://localhost:8080 unstable Release
+Ign http://localhost:8080 unstable Release.gpg
+Hit http://localhost:8080 unstable/main Sources
+Hit http://localhost:8080 unstable/main amd64 Packages
+Hit http://localhost:8080 unstable/main Translation-en
+Reading package lists..."
+
+find aptarchive -name "Release.gpg" | xargs rm -f
+
+echo 'Acquire::AllowInsecureRepositories "1";' > rootdir/etc/apt/apt.conf.d/insecure.conf
+echo "Acquire::GzipIndexes "0";" > rootdir/etc/apt/apt.conf.d/02compressindex
+runtest
+
+echo "Acquire::GzipIndexes "1";" > rootdir/etc/apt/apt.conf.d/02compressindex
+runtest
-- 
cgit v1.2.3


From 673c9469abd656a92c7e8f1f91f919cad09f391e Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Mon, 6 Oct 2014 14:34:38 +0200
Subject: cleanup pkgAcq*::Failed()

---
 test/integration/test-apt-get-update-unauth-warning | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-get-update-unauth-warning b/test/integration/test-apt-get-update-unauth-warning
index 75863615e..37bcea623 100755
--- a/test/integration/test-apt-get-update-unauth-warning
+++ b/test/integration/test-apt-get-update-unauth-warning
@@ -22,7 +22,7 @@ rm -f $APTARCHIVE/dists/unstable/*Release*
 testequal "Ign file: unstable InRelease
 Err file: unstable Release
   
-W: The data from 'file: unstable Release' is not signed. Packages from that repository can not be authenticated.
+W: The repository 'file: unstable Release' does not have a Release file. This is deprecated, please contact the owner of the repository.
 W: Use --allow-insecure-repositories to force the update
 W: Failed to fetch file:$APTARCHIVE/dists/unstable/Release  
 
-- 
cgit v1.2.3


From 42299a28ac40721f6cf29c9b786924c2cd4a210f Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Mon, 6 Oct 2014 14:43:05 +0200
Subject: fix test

---
 test/integration/test-apt-get-update-unauth-warning | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-get-update-unauth-warning b/test/integration/test-apt-get-update-unauth-warning
index 37bcea623..27160b5f9 100755
--- a/test/integration/test-apt-get-update-unauth-warning
+++ b/test/integration/test-apt-get-update-unauth-warning
@@ -36,8 +36,7 @@ testequal "partial" ls rootdir/var/lib/apt/lists
 testequal "Ign file: unstable InRelease
 Ign file: unstable Release
 Reading package lists...
-W: The data from 'file: unstable Release' is not signed. Packages from that repository can not be authenticated." aptget update --allow-insecure-repositories
-
+W: The repository 'file: unstable Release' does not have a Release file. This is deprecated, please contact the owner of the repository." aptget update --allow-insecure-repositories
 # ensure we can not install the package
 testequal "WARNING: The following packages cannot be authenticated!
   foo
-- 
cgit v1.2.3


From 04a54261afd1c99686109f102afc83346c01c930 Mon Sep 17 00:00:00 2001
From: David Kalnischkies <david@kalnischkies.de>
Date: Mon, 6 Oct 2014 11:15:03 +0200
Subject: ensure partial dirs are 0700 and owned by _apt:root

Reworks the API involved in creating and setting up the fetcher to be a
bit more pleasent to look at and work with as e.g. an empty string for
no lock isn't very nice. With the lock we can also stop creating all our
partial directories "just in case". This way we can also be a bit more
aggressive with the partial directory itself as with a lock, we know we
will gone need it.
---
 test/integration/test-apt-get-clean | 1 +
 1 file changed, 1 insertion(+)

(limited to 'test/integration')

diff --git a/test/integration/test-apt-get-clean b/test/integration/test-apt-get-clean
index 646ea31be..98f7c84d0 100755
--- a/test/integration/test-apt-get-clean
+++ b/test/integration/test-apt-get-clean
@@ -18,6 +18,7 @@ testsuccess aptget clean
 
 # generate some dirt and clean it up
 touch rootdir/var/lib/apt/lists/partial/http.debian.net_debian_dists_sid_main_i18n_Translation-en
+mkdir -p rootdir/var/cache/apt/archives
 touch rootdir/var/cache/apt/archives/foo_1_all.deb
 touch rootdir/var/cache/apt/archives/foo_2_all.deb
 touch rootdir/var/cache/apt/archives/foo_3_all.deb
-- 
cgit v1.2.3


From 5684f71fa0f6c1b765aa53e22ca3b024c578b9c9 Mon Sep 17 00:00:00 2001
From: David Kalnischkies <david@kalnischkies.de>
Date: Mon, 6 Oct 2014 14:29:53 +0200
Subject: use _apt:root only for partial directories

Using a different user for calling methods is intended to protect us
from methods running amok (via remotely exploited bugs) by limiting what
can be done by them. By using root:root for the final directories and
just have the files in partial writeable by the methods we enhance this
in sofar as a method can't modify already verified data in its parent
directory anymore.

As a side effect, this also clears most of the problems you could have
if the final directories are shared without user-sharing or if these
directories disappear as they are now again root owned and only the
partial directories contain _apt owned files (usually none if apt isn't
running) and the directory itself is autocreated with the right
permissions.
---
 test/integration/framework              | 22 +++++++++++++++++-----
 test/integration/test-apt-get-download  | 16 ++++++++++++++++
 test/integration/test-apt-update-unauth | 20 +++++++++++---------
 3 files changed, 44 insertions(+), 14 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/framework b/test/integration/framework
index e83606fae..688a1abf2 100644
--- a/test/integration/framework
+++ b/test/integration/framework
@@ -164,9 +164,10 @@ addtrap() {
 
 setupenvironment() {
 	TMPWORKINGDIRECTORY=$(mktemp -d)
-	TESTDIRECTORY=$(readlink -f $(dirname $0))
+	addtrap "cd /; rm -rf $TMPWORKINGDIRECTORY;"
 	msgninfo "Preparing environment for ${CCMD}$(basename $0)${CINFO} in ${TMPWORKINGDIRECTORY}… "
 
+	TESTDIRECTORY=$(readlink -f $(dirname $0))
         # allow overriding the default BUILDDIR location
 	BUILDDIRECTORY=${APT_INTEGRATION_TESTS_BUILD_DIR:-"${TESTDIRECTORY}/../../build/bin"}
 	LIBRARYPATH=${APT_INTEGRATION_TESTS_LIBRARY_PATH:-"${BUILDDIRECTORY}"}
@@ -177,7 +178,6 @@ setupenvironment() {
 	test -x "${BUILDDIRECTORY}/apt-get" || msgdie "You need to build tree first"
         # -----
 
-	addtrap "cd /; rm -rf $TMPWORKINGDIRECTORY;"
 	cd $TMPWORKINGDIRECTORY
 	mkdir rootdir aptarchive keys
 	cd rootdir
@@ -210,6 +210,7 @@ setupenvironment() {
 		cp "${TESTDIRECTORY}/${SOURCESSFILE}" aptarchive/Sources
 	fi
 	cp $(find $TESTDIRECTORY -name '*.pub' -o -name '*.sec') keys/
+	chmod 644 $(find keys -name '*.pub' -o -name '*.sec')
 	ln -s ${TMPWORKINGDIRECTORY}/keys/joesixpack.pub rootdir/etc/apt/trusted.gpg.d/joesixpack.gpg
 	echo "Dir \"${TMPWORKINGDIRECTORY}/rootdir\";" > aptconfig.conf
 	echo "Dir::state::status \"${TMPWORKINGDIRECTORY}/rootdir/var/lib/dpkg/status\";" >> aptconfig.conf
@@ -837,9 +838,7 @@ setupaptarchive() {
 	fi
 	signreleasefiles
 	if [ "$1" != '--no-update' ]; then
-		msgninfo "\tSync APT's cache with the archive… "
-		aptget update -qq
-		msgdone "info"
+		testsuccess aptget update -o Debug::pkgAcquire::Worker=true -o Debug::Acquire::gpgv=true
 	fi
 }
 
@@ -1175,6 +1174,19 @@ testfailure() {
 	fi
 }
 
+testaccessrights() {
+	msgtest "Test that file $1 has access rights set to" "$2"
+	if [ "$2" = "$(stat --format '%a' "$1")" ]; then
+		msgpass
+	else
+		echo >&2
+		ls -l >&2 "$1"
+		echo -n >&2 "stat(1) reports access rights: "
+		stat --format '%a' "$1"
+		msgfail
+	fi
+}
+
 testwebserverlaststatuscode() {
 	local DOWNLOG='rootdir/tmp/webserverstatus-testfile.log'
 	local STATUS='rootdir/tmp/webserverstatus-statusfile.log'
diff --git a/test/integration/test-apt-get-download b/test/integration/test-apt-get-download
index 58ed44f8f..0514542b3 100755
--- a/test/integration/test-apt-get-download
+++ b/test/integration/test-apt-get-download
@@ -11,8 +11,23 @@ buildsimplenativepackage 'apt' 'all' '1.0' 'stable'
 buildsimplenativepackage 'apt' 'all' '2.0' 'unstable'
 insertinstalledpackage 'vrms' 'all' '1.0'
 
+umask 0027
+
 setupaptarchive
 
+# apt-ftparchive knows how to chmod files
+find aptarchive/dists -name '*Packages*' -type f | while read file; do
+	testaccessrights "$file" '644'
+done
+# created by the framework without special care
+find aptarchive/dists -name '*Release*' -type f | while read file; do
+	testaccessrights "$file" '640'
+done
+# all copied files are properly chmodded
+find rootdir/var/lib/apt/lists -type f | while read file; do
+	testaccessrights "$file" '644'
+done
+
 testdownload() {
 	local APT="$2"
 	if [ -n "$3" ]; then
@@ -65,6 +80,7 @@ testsuccess aptget update
 # test with already stored deb
 testsuccess aptget install -d apt
 testsuccess test -s rootdir/var/cache/apt/archives/apt_2.0_all.deb
+testaccessrights 'aptarchive/pool/apt_2.0_all.deb' '644'
 mv aptarchive/pool/apt_2.0_all.deb aptarchive/pool/apt_2.0_all.deb.gone
 testdownload apt_2.0_all.deb apt
 mv aptarchive/pool/apt_2.0_all.deb.gone aptarchive/pool/apt_2.0_all.deb
diff --git a/test/integration/test-apt-update-unauth b/test/integration/test-apt-update-unauth
index cf5195024..b7ccd6cf3 100755
--- a/test/integration/test-apt-update-unauth
+++ b/test/integration/test-apt-update-unauth
@@ -27,7 +27,7 @@ runtest() {
     find rootdir/var/lib/apt/lists/ -type f | xargs rm -f
     rm -f aptarchive/dists/unstable/*Release*
 
-    aptget update -qq --allow-insecure-repositories
+    testsuccess aptget update -qq --allow-insecure-repositories
 
     # FIXME: this really shouldn't be needed
     rm -f rootdir/var/lib/apt/lists/partial/*
@@ -41,7 +41,6 @@ runtest() {
         aptarchive/dists/unstable/main/binary-i386/Packages.uncompressed
 
     # and ensure we re-check the downloaded data
-    msgtest "Check rollback on going from unauth -> auth"
 
     # change the local packages file
     PKGS=$(ls rootdir/var/lib/apt/lists/*Packages*)
@@ -49,18 +48,22 @@ runtest() {
     ls rootdir/var/lib/apt/lists/ > lists.before
 
     # update and ensure all is reverted on the hashsum failure
-    aptget update -o Debug::Acquire::Transaction=0 -o Debug::pkgAcquire::Auth=1 -o Debug::pkgAcquire::worker=0 -o Debug::acquire::http=0 > output.log 2>&1 || true
+    testfailure aptget update -o Debug::Acquire::Transaction=0 -o Debug::pkgAcquire::Auth=1 -o Debug::pkgAcquire::worker=0 -o Debug::acquire::http=0
 
     # ensure we have before what we have after
+    msgtest 'Check rollback on going from' 'unauth -> auth'
     ls rootdir/var/lib/apt/lists/ > lists.after
-    if diff -u lists.before lists.after; then
+    if cmp lists.before lists.after; then
         msgpass
     else
-        cat output.log
-        msgfail
+	echo >&2 '### Output of previous apt-get update ###'
+	cat >&2 rootdir/tmp/testfailure.output
+	echo >&2 '### Changes in the lists-directory: ###'
+	diff -u >&2 lists.before lists.after
+	msgfail
     fi
 
-    # move uncompressed back for release file 
+    # move uncompressed back for release file
     mv aptarchive/dists/unstable/main/binary-i386/Packages.uncompressed \
         aptarchive/dists/unstable/main/binary-i386/Packages
 }
@@ -72,6 +75,5 @@ for COMPRESSEDINDEXES in 'false' 'true'; do
 	else
 		msgmsg 'Run tests with GzipIndexes disabled'
 	fi
-
-        runtest
+	runtest
 done
-- 
cgit v1.2.3


From 4dbfe436c60880f2625e4d3a9d0127a83dd6276e Mon Sep 17 00:00:00 2001
From: David Kalnischkies <david@kalnischkies.de>
Date: Tue, 7 Oct 2014 01:46:30 +0200
Subject: display errortext for all Err as well as Ign logs

consistently using Item::Failed in all specializec classes helps setting
up some information bits otherwise unset, so some errors had an empty
reason as an error. Ign is upgraded to display the error message we
ignored to further help in understanding what happens.
---
 test/integration/framework                         |  13 ++-
 .../integration/test-apt-get-update-unauth-warning |   7 +-
 test/integration/test-apt-update-ims               |   5 +-
 test/integration/test-apt-update-nofallback        |   2 +-
 test/integration/test-apt-update-rollback          | 101 ++++++++++-----------
 .../test-bug-595691-empty-and-broken-archive-files |   2 +-
 6 files changed, 70 insertions(+), 60 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/framework b/test/integration/framework
index 688a1abf2..29e5fafe6 100644
--- a/test/integration/framework
+++ b/test/integration/framework
@@ -715,7 +715,7 @@ buildaptarchivefromincoming() {
 	aptftparchive -qq generate ftparchive.conf
 	cd - > /dev/null
 	msgdone "info"
-	generatereleasefiles
+	generatereleasefiles "$@"
 }
 
 buildaptarchivefromfiles() {
@@ -830,14 +830,19 @@ setupflataptarchive() {
 }
 
 setupaptarchive() {
-	buildaptarchive
+	local NOUPDATE=0
+	if [ "$1" = '--no-update' ]; then
+		NOUPDATE=1
+		shift
+	fi
+	buildaptarchive "$@"
 	if [ -e aptarchive/dists ]; then
 		setupdistsaptarchive
 	else
 		setupflataptarchive
 	fi
-	signreleasefiles
-	if [ "$1" != '--no-update' ]; then
+	signreleasefiles 'Joe Sixpack' "$@"
+	if [ "1" != "$NOUPDATE" ]; then
 		testsuccess aptget update -o Debug::pkgAcquire::Worker=true -o Debug::Acquire::gpgv=true
 	fi
 }
diff --git a/test/integration/test-apt-get-update-unauth-warning b/test/integration/test-apt-get-update-unauth-warning
index 27160b5f9..8e212a3c4 100755
--- a/test/integration/test-apt-get-update-unauth-warning
+++ b/test/integration/test-apt-get-update-unauth-warning
@@ -20,11 +20,12 @@ rm -f $APTARCHIVE/dists/unstable/*Release*
 
 # update without authenticated files leads to warning
 testequal "Ign file: unstable InRelease
+  File not found
 Err file: unstable Release
-  
+  File not found
 W: The repository 'file: unstable Release' does not have a Release file. This is deprecated, please contact the owner of the repository.
 W: Use --allow-insecure-repositories to force the update
-W: Failed to fetch file:$APTARCHIVE/dists/unstable/Release  
+W: Failed to fetch file:$APTARCHIVE/dists/unstable/Release  File not found
 
 E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update
 
@@ -34,7 +35,9 @@ testequal "partial" ls rootdir/var/lib/apt/lists
 
 # allow override
 testequal "Ign file: unstable InRelease
+  File not found
 Ign file: unstable Release
+  File not found
 Reading package lists...
 W: The repository 'file: unstable Release' does not have a Release file. This is deprecated, please contact the owner of the repository." aptget update --allow-insecure-repositories
 # ensure we can not install the package
diff --git a/test/integration/test-apt-update-ims b/test/integration/test-apt-update-ims
index 61b808b0f..8aa5a7262 100755
--- a/test/integration/test-apt-update-ims
+++ b/test/integration/test-apt-update-ims
@@ -44,8 +44,9 @@ echo "Acquire::GzipIndexes "1";" > rootdir/etc/apt/apt.conf.d/02compressindex
 runtest
 
 msgmsg "Release/Release.gpg"
-# with Release/Release.gpg 
+# with Release/Release.gpg
 EXPECT="Ign http://localhost:8080 unstable InRelease
+  404  Not Found
 Hit http://localhost:8080 unstable Release
 Hit http://localhost:8080 unstable Release.gpg
 Hit http://localhost:8080 unstable/main Sources
@@ -65,8 +66,10 @@ runtest
 # no Release.gpg or InRelease
 msgmsg "Release only"
 EXPECT="Ign http://localhost:8080 unstable InRelease
+  404  Not Found
 Hit http://localhost:8080 unstable Release
 Ign http://localhost:8080 unstable Release.gpg
+  404  Not Found
 Hit http://localhost:8080 unstable/main Sources
 Hit http://localhost:8080 unstable/main amd64 Packages
 Hit http://localhost:8080 unstable/main Translation-en
diff --git a/test/integration/test-apt-update-nofallback b/test/integration/test-apt-update-nofallback
index c400dcc36..321472c2e 100755
--- a/test/integration/test-apt-update-nofallback
+++ b/test/integration/test-apt-update-nofallback
@@ -161,7 +161,7 @@ test_inrelease_to_invalid_inrelease()
 
     testequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file: unstable InRelease: The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 
-W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease  
+W: Failed to fetch file:${APTARCHIVE}/dists/unstable/InRelease  The following signatures were invalid: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 
 W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
 
diff --git a/test/integration/test-apt-update-rollback b/test/integration/test-apt-update-rollback
index ee8bc6926..5b9c200fe 100755
--- a/test/integration/test-apt-update-rollback
+++ b/test/integration/test-apt-update-rollback
@@ -19,44 +19,44 @@ create_fresh_archive()
 
     insertpackage 'unstable' 'old' 'all' '1.0'
 
-    setupaptarchive
+    setupaptarchive --no-update
 }
 
 add_new_package() {
     insertpackage "unstable" "new" "all" "1.0"
     insertsource "unstable" "new" "all" "1.0"
 
-    setupaptarchive --no-update
-
-    avoid_ims_hit
+    setupaptarchive --no-update "$@"
 }
 
 break_repository_sources_index() {
-    printf "xxx" > $APTARCHIVE/dists/unstable/main/source/Sources
-    gzip -c $APTARCHIVE/dists/unstable/main/source/Sources > \
-            $APTARCHIVE/dists/unstable/main/source/Sources.gz
-    avoid_ims_hit
+    printf 'xxx' > $APTARCHIVE/dists/unstable/main/source/Sources
+    compressfile "$APTARCHIVE/dists/unstable/main/source/Sources" "$@"
 }
 
-test_inrelease_to_new_inrelease() {
-    msgmsg "Test InRelease to new InRelease works fine"
+start_with_good_inrelease() {
     create_fresh_archive
+    testsuccess aptget update
     testequal "old/unstable 1.0 all" apt list -q
+}
 
-    add_new_package
+test_inrelease_to_new_inrelease() {
+    msgmsg 'Test InRelease to new InRelease works fine'
+    start_with_good_inrelease
 
+    add_new_package '+1hour'
     testsuccess aptget update -o Debug::Acquire::Transaction=1
-
     testequal "new/unstable 1.0 all
 old/unstable 1.0 all" apt list -q
 }
 
 test_inrelease_to_broken_hash_reverts_all() {
-    msgmsg "Test InRelease to broken InRelease reverts everything"
-    create_fresh_archive
-    add_new_package
+    msgmsg 'Test InRelease to broken InRelease reverts everything'
+    start_with_good_inrelease
+
+    add_new_package '+1hour'
     # break the Sources file
-    break_repository_sources_index
+    break_repository_sources_index '+1hour'
 
     # test the error condition
     testequal "W: Failed to fetch file:${APTARCHIVE}/dists/unstable/main/source/Sources  Hash Sum mismatch
@@ -66,14 +66,14 @@ E: Some index files failed to download. They have been ignored, or old ones used
     testequal "E: Unable to locate package new" aptget install new -s -qq
 }
 
-test_inreleae_to_valid_release() {
-    msgmsg "Test InRelease to valid Release"
-    create_fresh_archive
-    add_new_package
-    # switch to a unsinged repo now
+test_inrelease_to_valid_release() {
+    msgmsg 'Test InRelease to valid Release'
+    start_with_good_inrelease
+
+    add_new_package '+1hour'
+    # switch to a unsigned repo now
     rm $APTARCHIVE/dists/unstable/InRelease
     rm $APTARCHIVE/dists/unstable/Release.gpg
-    avoid_ims_hit
 
     # update fails
     testequal "E: The repository 'file: unstable Release.gpg' is no longer signed." aptget update -qq
@@ -85,16 +85,17 @@ test_inreleae_to_valid_release() {
     testfailure ls $ROOTDIR/var/lib/apt/lists/*_Release
 }
 
-test_inreleae_to_release_reverts_all() {
-    msgmsg "Test InRelease to broken Release reverts everything"
-    create_fresh_archive
+test_inrelease_to_release_reverts_all() {
+    msgmsg 'Test InRelease to broken Release reverts everything'
+    start_with_good_inrelease
 
-    # switch to a unsinged repo now
-    add_new_package
+    # switch to a unsigned repo now
+    add_new_package '+1hour'
     rm $APTARCHIVE/dists/unstable/InRelease
     rm $APTARCHIVE/dists/unstable/Release.gpg
+
     # break it
-    break_repository_sources_index
+    break_repository_sources_index '+1hour'
 
     # ensure error
     testequal "E: The repository 'file: unstable Release.gpg' is no longer signed." aptget update -qq # -o Debug::acquire::transaction=1
@@ -107,21 +108,19 @@ test_inreleae_to_release_reverts_all() {
 }
 
 test_unauthenticated_to_invalid_inrelease() {
-    msgmsg "Test UnAuthenticated to invalid InRelease reverts everything"
+    msgmsg 'Test UnAuthenticated to invalid InRelease reverts everything'
     create_fresh_archive
-    rm -rf rootdir/var/lib/apt/lists/*
     rm $APTARCHIVE/dists/unstable/InRelease
     rm $APTARCHIVE/dists/unstable/Release.gpg
-    avoid_ims_hit
-    
-    testsuccess aptget update -qq --allow-insecure-repositories
+
+    testsuccess aptget update --allow-insecure-repositories
     testequal "WARNING: The following packages cannot be authenticated!
   old
 E: There are problems and -y was used without --force-yes" aptget install -qq -y old
-    
+
     # go to authenticated but not correct
-    add_new_package
-    break_repository_sources_index
+    add_new_package '+1hour'
+    break_repository_sources_index '+1hour'
 
     testequal "W: Failed to fetch file:$APTARCHIVE/dists/unstable/main/source/Sources  Hash Sum mismatch
 
@@ -134,14 +133,14 @@ E: There are problems and -y was used without --force-yes" aptget install -qq -y
 }
 
 test_inrelease_to_unauth_inrelease() {
-    msgmsg "Test InRelease to InRelease without sig"
-    create_fresh_archive
-    signreleasefiles 'Marvin Paranoid'
-    avoid_ims_hit
-    
+    msgmsg 'Test InRelease to InRelease without good sig'
+    start_with_good_inrelease
+
+    signreleasefiles 'Marvin Paranoid' '+1hour'
+
     testequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file: unstable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY E8525D47528144E2
 
-W: Failed to fetch file:$APTARCHIVE/dists/unstable/InRelease  
+W: Failed to fetch file:$APTARCHIVE/dists/unstable/InRelease  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY E8525D47528144E2
 
 W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
 
@@ -150,13 +149,13 @@ W: Some index files failed to download. They have been ignored, or old ones used
 
 test_inrelease_to_broken_gzip() {
     msgmsg "Test InRelease to broken gzip"
-    create_fresh_archive
-    # append junk at the end of the gzip, this
+    start_with_good_inrelease
+
+    # append junk at the end of the compressed file
     echo "lala" >> $APTARCHIVE/dists/unstable/main/source/Sources.gz
-    # remove uncompressed file, otherwise apt will just fallback fetching
-    # that
+    touch -d '+2min' $APTARCHIVE/dists/unstable/main/source/Sources.gz
+    # remove uncompressed file to avoid fallback
     rm $APTARCHIVE/dists/unstable/main/source/Sources
-    avoid_ims_hit
 
     testfailure aptget update
 }
@@ -174,7 +173,7 @@ ROOTDIR=${TMPWORKINGDIRECTORY}/rootdir
 APTARCHIVE_LISTS="$(echo $APTARCHIVE | tr "/" "_" )"
 
 # test the following cases:
-# - InRelease -> broken InRelease revert to previous state 
+# - InRelease -> broken InRelease revert to previous state
 # - empty lists dir and broken remote leaves nothing on the system
 # - InRelease -> hashsum mismatch for one file reverts all files to previous state
 # - Release/Release.gpg -> hashsum mismatch
@@ -184,13 +183,13 @@ APTARCHIVE_LISTS="$(echo $APTARCHIVE | tr "/" "_" )"
 # - unauthenticated -> invalid InRelease
 
 # stuff to do:
-# - ims-hit 
+# - ims-hit
 # - gzip-index tests
 
 test_inrelease_to_new_inrelease
 test_inrelease_to_broken_hash_reverts_all
-test_inreleae_to_valid_release
-test_inreleae_to_release_reverts_all
+test_inrelease_to_valid_release
+test_inrelease_to_release_reverts_all
 test_unauthenticated_to_invalid_inrelease
 test_inrelease_to_unauth_inrelease
 test_inrelease_to_broken_gzip
diff --git a/test/integration/test-bug-595691-empty-and-broken-archive-files b/test/integration/test-bug-595691-empty-and-broken-archive-files
index 683c174bd..fedf82c92 100755
--- a/test/integration/test-bug-595691-empty-and-broken-archive-files
+++ b/test/integration/test-bug-595691-empty-and-broken-archive-files
@@ -13,7 +13,7 @@ setupflataptarchive
 testaptgetupdate() {
 	rm -rf rootdir/var/lib/apt
 	aptget update 2>> testaptgetupdate.diff >> testaptgetupdate.diff || true
-	sed -i -e '/Ign / d' -e '/Release/ d' -e 's#Get:[0-9]\+ #Get: #' -e 's#\[[0-9]* [kMGTPY]*B\]#\[\]#' testaptgetupdate.diff
+	sed -i -e '/Ign /,+1d' -e '/Release/ d' -e 's#Get:[0-9]\+ #Get: #' -e 's#\[[0-9]* [kMGTPY]*B\]#\[\]#' testaptgetupdate.diff
 	GIVEN="$1"
 	shift
 	msgtest "Test for correctness of" "apt-get update with $*"
-- 
cgit v1.2.3