You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

218 lines
8.8 KiB

  1. #!/bin/sh
  2. #
  3. # test that apt-get update is transactional
  4. #
  5. set -e
  6. avoid_ims_hit() {
  7. touch -d '+1hour' aptarchive/dists/unstable/main/binary-i386/Packages*
  8. touch -d '+1hour' aptarchive/dists/unstable/main/source/Sources*
  9. touch -d '+1hour' aptarchive/dists/unstable/*Release*
  10. touch -d '-1hour' rootdir/var/lib/apt/lists/*
  11. }
  12. create_fresh_archive()
  13. {
  14. rm -rf aptarchive/*
  15. rm -f rootdir/var/lib/apt/lists/_* rootdir/var/lib/apt/lists/partial/*
  16. insertpackage 'unstable' 'old' 'all' '1.0'
  17. setupaptarchive --no-update
  18. }
  19. add_new_package() {
  20. insertpackage 'unstable' 'new' 'all' '1.0'
  21. insertsource 'unstable' 'new' 'all' '1.0'
  22. setupaptarchive --no-update "$@"
  23. }
  24. break_repository_sources_index() {
  25. mv "$APTARCHIVE/dists/unstable/main/source/Sources.gz" "$APTARCHIVE/dists/unstable/main/source/Sources.gz.orig"
  26. printf 'xxx' > "$APTARCHIVE/dists/unstable/main/source/Sources"
  27. compressfile "$APTARCHIVE/dists/unstable/main/source/Sources" "$@"
  28. }
  29. start_with_good_inrelease() {
  30. create_fresh_archive
  31. testsuccess aptget update
  32. listcurrentlistsdirectory > lists.before
  33. testsuccessequal 'old/unstable 1.0 all' apt list -qq
  34. }
  35. test_inrelease_to_new_inrelease() {
  36. msgmsg 'Test InRelease to new InRelease works fine'
  37. start_with_good_inrelease
  38. add_new_package '+1hour'
  39. testsuccess aptget update -o Debug::Acquire::Transaction=1
  40. testsuccessequal 'new/unstable 1.0 all
  41. old/unstable 1.0 all' apt list -qq
  42. }
  43. test_inrelease_to_broken_hash_reverts_all() {
  44. msgmsg 'Test InRelease to broken InRelease reverts everything'
  45. start_with_good_inrelease
  46. add_new_package '+1hour'
  47. # break the Sources file
  48. break_repository_sources_index '+1hour'
  49. # test the error condition
  50. testfailureequal "E: Failed to fetch file:${APTARCHIVE}/dists/unstable/main/source/Sources.gz Hash Sum mismatch
  51. Hashes of expected file:
  52. - Checksum-FileSize:$(stat -c '%s' 'aptarchive/dists/unstable/main/source/Sources.gz.orig')
  53. - SHA256:$(sha256sum 'aptarchive/dists/unstable/main/source/Sources.gz.orig' | cut -d' ' -f 1)
  54. Hashes of received file:
  55. - SHA256:$(sha256sum 'aptarchive/dists/unstable/main/source/Sources.gz' | cut -d' ' -f 1)
  56. - Checksum-FileSize:$(stat -c '%s' 'aptarchive/dists/unstable/main/source/Sources.gz')
  57. Last modification reported: $(lastmodification 'aptarchive/dists/unstable/main/source/Sources.gz')
  58. Release file created at: $(releasefiledate 'aptarchive/dists/unstable/InRelease')
  59. E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
  60. # ensure that the Packages file is also rolled back
  61. testfileequal lists.before "$(listcurrentlistsdirectory)"
  62. testfailureequal "E: Unable to locate package new" aptget install new -s -qq
  63. }
  64. test_inrelease_to_valid_release() {
  65. msgmsg 'Test InRelease to valid Release'
  66. start_with_good_inrelease
  67. add_new_package '+1hour'
  68. # switch to a unsigned repo now
  69. rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
  70. # update fails
  71. testfailureequal "E: The repository 'file:${APTARCHIVE} unstable Release' is no longer signed." aptget update -qq
  72. # test that security downgrade was not successful
  73. testfileequal lists.before "$(listcurrentlistsdirectory)"
  74. testsuccess aptget install old -s
  75. testfailure aptget install new -s
  76. testnotempty find "${ROOTDIR}/var/lib/apt/lists" -name '*_InRelease'
  77. testempty find "${ROOTDIR}/var/lib/apt/lists" -name '*_Release'
  78. }
  79. test_inrelease_to_release_reverts_all() {
  80. msgmsg 'Test InRelease to broken Release reverts everything'
  81. start_with_good_inrelease
  82. # switch to a unsigned repo now
  83. add_new_package '+1hour'
  84. rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
  85. # break it
  86. break_repository_sources_index '+1hour'
  87. # ensure error
  88. testfailureequal "E: The repository 'file:${APTARCHIVE} unstable Release' is no longer signed." aptget update -qq # -o Debug::acquire::transaction=1
  89. # ensure that the Packages file is also rolled back
  90. testfileequal lists.before "$(listcurrentlistsdirectory)"
  91. testsuccess aptget install old -s
  92. testfailure aptget install new -s
  93. testnotempty find "${ROOTDIR}/var/lib/apt/lists" -name '*_InRelease'
  94. testempty find "${ROOTDIR}/var/lib/apt/lists" -name '*_Release'
  95. }
  96. test_unauthenticated_to_invalid_inrelease() {
  97. msgmsg 'Test UnAuthenticated to invalid InRelease reverts everything'
  98. create_fresh_archive
  99. rm -f "$APTARCHIVE/dists/unstable/InRelease" "$APTARCHIVE/dists/unstable/Release.gpg"
  100. testwarning aptget update --allow-insecure-repositories
  101. listcurrentlistsdirectory > lists.before
  102. testfailureequal "WARNING: The following packages cannot be authenticated!
  103. old
  104. E: There were unauthenticated packages and -y was used without --allow-unauthenticated" aptget install -qq -y old
  105. # go to authenticated but not correct
  106. add_new_package '+1hour'
  107. break_repository_sources_index '+1hour'
  108. testfailureequal "E: Failed to fetch file:$APTARCHIVE/dists/unstable/main/source/Sources.gz Hash Sum mismatch
  109. Hashes of expected file:
  110. - Checksum-FileSize:$(stat -c '%s' 'aptarchive/dists/unstable/main/source/Sources.gz.orig')
  111. - SHA256:$(sha256sum 'aptarchive/dists/unstable/main/source/Sources.gz.orig' | cut -d' ' -f 1)
  112. Hashes of received file:
  113. - SHA256:$(sha256sum 'aptarchive/dists/unstable/main/source/Sources.gz' | cut -d' ' -f 1)
  114. - Checksum-FileSize:$(stat -c '%s' 'aptarchive/dists/unstable/main/source/Sources.gz')
  115. Last modification reported: $(lastmodification 'aptarchive/dists/unstable/main/source/Sources.gz')
  116. Release file created at: $(releasefiledate 'aptarchive/dists/unstable/InRelease')
  117. E: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
  118. testfileequal lists.before "$(listcurrentlistsdirectory)"
  119. testempty find "${ROOTDIR}/var/lib/apt/lists" -maxdepth 1 -name '*_InRelease'
  120. testfailureequal "WARNING: The following packages cannot be authenticated!
  121. old
  122. E: There were unauthenticated packages and -y was used without --allow-unauthenticated" aptget install -qq -y old
  123. }
  124. test_inrelease_to_unauth_inrelease() {
  125. msgmsg 'Test InRelease to InRelease without good sig'
  126. start_with_good_inrelease
  127. signreleasefiles 'Marvin Paranoid'
  128. testwarningequal "W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: file:${APTARCHIVE} unstable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY E8525D47528144E2
  129. W: Failed to fetch file:$APTARCHIVE/dists/unstable/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY E8525D47528144E2
  130. W: Some index files failed to download. They have been ignored, or old ones used instead." aptget update -qq
  131. testfileequal lists.before "$(listcurrentlistsdirectory)"
  132. testnotempty find "${ROOTDIR}/var/lib/apt/lists" -name '*_InRelease'
  133. }
  134. test_inrelease_to_broken_gzip() {
  135. msgmsg "Test InRelease to broken gzip"
  136. start_with_good_inrelease
  137. break_repository_sources_index '+1hour'
  138. generatereleasefiles '+2hours'
  139. signreleasefiles
  140. # append junk at the end of the compressed file
  141. echo "lala" >> "$APTARCHIVE/dists/unstable/main/source/Sources.gz"
  142. touch -d '+2min' "$APTARCHIVE/dists/unstable/main/source/Sources.gz"
  143. # remove uncompressed file to avoid fallback
  144. rm "$APTARCHIVE/dists/unstable/main/source/Sources"
  145. testfailure aptget update
  146. testsuccess grep 'Hash Sum mismatch' rootdir/tmp/testfailure.output
  147. testfileequal lists.before "$(listcurrentlistsdirectory)"
  148. }
  149. TESTDIR="$(readlink -f "$(dirname "$0")")"
  150. . "$TESTDIR/framework"
  151. setupenvironment
  152. configarchitecture "i386"
  153. export APT_DONT_SIGN='Release.gpg'
  154. APTARCHIVE="$(readlink -f ./aptarchive)"
  155. ROOTDIR="${TMPWORKINGDIRECTORY}/rootdir"
  156. APTARCHIVE_LISTS="$(echo "$APTARCHIVE" | tr "/" "_" )"
  157. # test the following cases:
  158. # - InRelease -> broken InRelease revert to previous state
  159. # - empty lists dir and broken remote leaves nothing on the system
  160. # - InRelease -> hashsum mismatch for one file reverts all files to previous state
  161. # - Release/Release.gpg -> hashsum mismatch
  162. # - InRelease -> Release with hashsum mismatch revert entire state and kills Release
  163. # - Release -> InRelease with broken Sig/Hash removes InRelease
  164. # going from Release/Release.gpg -> InRelease and vice versa
  165. # - unauthenticated -> invalid InRelease
  166. # stuff to do:
  167. # - ims-hit
  168. # - gzip-index tests
  169. test_inrelease_to_new_inrelease
  170. test_inrelease_to_broken_hash_reverts_all
  171. test_inrelease_to_valid_release
  172. test_inrelease_to_release_reverts_all
  173. test_unauthenticated_to_invalid_inrelease
  174. test_inrelease_to_unauth_inrelease
  175. test_inrelease_to_broken_gzip