diff options
Diffstat (limited to '')
| -rw-r--r-- | tests/verify.test | 437 |
1 files changed, 437 insertions, 0 deletions
diff --git a/tests/verify.test b/tests/verify.test new file mode 100644 index 0000000..949e25d --- /dev/null +++ b/tests/verify.test @@ -0,0 +1,437 @@ +set -u +. "$TESTSDIR"/test.inc + +mkdir gpgtestdir +chmod go-rwx gpgtestdir +export GNUPGHOME="`pwd`/gpgtestdir" +gpg --import $TESTSDIR/good.key $TESTSDIR/evil.key $TESTSDIR/expired.key $TESTSDIR/revoked.key $TESTSDIR/expiredwithsubkey-working.key $TESTSDIR/withsubkeys-works.key + +CURDATE="$(date +"%Y-%m-%d")" + +mkdir conf lists +cat > conf/distributions <<CONFEND +Codename: Test +Architectures: source +Components: everything +Update: rule otherrule +CONFEND +cat > conf/updates <<CONFEND +Name: commonbase +Method: file:$WORKDIR/test +VerifyRelease: 111 +Suite: test + +Name: rule +From: commonbase + +Name: otherrule +From: commonbase +CONFEND + +testrun - -b . update Test 3<<EOF +return 255 +stdout +$(odb) +stderr +*=Error: Too short key id '111' in VerifyRelease condition '111'! +-v0*=There have been errors! +EOF + +cat > conf/updates <<CONFEND +Name: commonbase +Method: file:$WORKDIR/test +VerifyRelease: 11111111 22222222 +Suite: test + +Name: rule +From: commonbase + +Name: otherrule +From: commonbase +CONFEND + +testrun - -b . update Test 3<<EOF +return 255 +stdout +stderr +*=Error: Space separated key-ids in VerifyRelease condition '11111111 22222222'! +*=(Alternate keys can be separated with '|'. Do not put spaces in key-ids.) +-v0*=There have been errors! +EOF + +cat > conf/updates <<CONFEND +Name: commonbase +Method: file:$WORKDIR/test +VerifyRelease: 11111111 +Suite: test + +Name: rule +From: commonbase + +Name: otherrule +From: commonbase +CONFEND + +testrun - -b . update Test 3<<EOF +return 249 +stdout +stderr +*=Error: unknown key '11111111'! +-v0*=There have been errors! +EOF + +cat > conf/updates <<CONFEND +Name: commonbase +Method: file:$WORKDIR/test +VerifyRelease: 11111111 + +Name: rule +From: commonbase +VerifyRelease: DC3C29B8|685AF714 +Suite: test + +Name: otherrule +From: commonbase +VerifyRelease: 685AF714|D04DD3D6 +Suite: test +CONFEND + +mkdir test +mkdir test/dists +mkdir test/dists/test +cat > test/dists/test/Release <<EOF +Codename: test +Components: everything +Architectures: coal +EOF + +gpg --list-secret-keys +gpg --expert --sign --clearsign -u 60DDED5B -u D7A5D887 -u revoked@nowhere.tld --output test/dists/test/InRelease test/dists/test/Release +gpg --expert --sign --clearsign -u 60DDED5B -u D7A5D887 -u good@nowhere.tld --output test/dists/test/InRelease.good test/dists/test/Release +gpg --expert -a --sign --clearsign -u evil@nowhere.tld --output test/dists/test/InRelease.evil test/dists/test/Release + +rm -r gpgtestdir +mkdir gpgtestdir +chmod go-rwx gpgtestdir +gpg --import $TESTSDIR/good.key $TESTSDIR/evil.key $TESTSDIR/expired.key $TESTSDIR/revoked.key $TESTSDIR/revoked.pkey $TESTSDIR/expiredwithsubkey.key $TESTSDIR/withsubkeys.key +gpg --list-keys + +testrun - -b . update Test 3<<EOF +return 255 +stderr +*=VerifyRelease condition 'DC3C29B8|685AF714' lists revoked key '72F1D61F685AF714'. +*=(To use it anyway, append it with a '!' to force usage). +-v0*=There have been errors! +stdout +EOF + +sed -e 's/685AF714/&!/' -i conf/updates + +testrun - -b . update Test 3<<EOF +return 255 +stderr +*=VerifyRelease condition '685AF714!|D04DD3D6' lists expired key '894FA29DD04DD3D6'. +*=(To use it anyway, append it with a '!' to force usage). +-v0*=There have been errors! +stdout +EOF + +sed -e 's/D04DD3D6/&!/' -i conf/updates + +testrun - -b . update Test 3<<EOF +return 250 +stderr +-v1*=aptmethod got 'file:${WORKDIR}/test/dists/test/InRelease' +-v2*=Copy file '${WORKDIR}/test/dists/test/InRelease' to './lists/commonbase_test_InRelease'... +*=Not accepting valid signature in './lists/commonbase_test_InRelease' with REVOKED '12D6C95C8C737389EAAF535972F1D61F685AF714' +*=(To ignore it append a ! to the key and run reprepro with --ignore=revokedkey) +*=ERROR: Condition '685AF714!|D04DD3D6!' not fulfilled for './lists/commonbase_test_InRelease'. +*=Signatures in './lists/commonbase_test_InRelease': +*='DCAD3A286F5178E2F4B09330A573FEB160DDED5B' (signed ${CURDATE}): expired key +*='236B4B98B5087AF4B621CB14D8A28B7FD7A5D887' (signed ${CURDATE}): valid +*='12D6C95C8C737389EAAF535972F1D61F685AF714' (signed ${CURDATE}): key revoced +*=Error: Not enough signatures found for remote repository commonbase (file:${WORKDIR}/test test)! +-v0*=There have been errors! +stdout +EOF + +testrun - --ignore=revokedkey -b . update Test 3<<EOF +return 255 +stderr +-v1*=aptmethod got 'file:${WORKDIR}/test/dists/test/InRelease' +-v2*=Copy file '${WORKDIR}/test/dists/test/InRelease' to './lists/commonbase_test_InRelease'... +*=WARNING: valid signature in './lists/commonbase_test_InRelease' with revoked '12D6C95C8C737389EAAF535972F1D61F685AF714' is accepted as requested! +*=Missing checksums in Release file './lists/commonbase_test_InRelease'! +-v0*=There have been errors! +stdout +EOF + +cp test/dists/test/InRelease.good test/dists/test/InRelease + +testrun - -b . update Test 3<<EOF +return 250 +stderr +-v1*=aptmethod got 'file:${WORKDIR}/test/dists/test/InRelease' +-v2*=Copy file '${WORKDIR}/test/dists/test/InRelease' to './lists/commonbase_test_InRelease'... +*=ERROR: Condition '685AF714!|D04DD3D6!' not fulfilled for './lists/commonbase_test_InRelease'. +*=Signatures in './lists/commonbase_test_InRelease': +*='DCAD3A286F5178E2F4B09330A573FEB160DDED5B' (signed ${CURDATE}): expired key +*='236B4B98B5087AF4B621CB14D8A28B7FD7A5D887' (signed ${CURDATE}): valid +*='12E94E82B6D7A883AF6EC8E980F4C43EDC3C29B8' (signed ${CURDATE}): valid +*=Error: Not enough signatures found for remote repository commonbase (file:${WORKDIR}/test test)! +-v0*=There have been errors! +stdout +EOF + +# different order +cat > conf/updates <<CONFEND +Name: commonbase +Method: file:$WORKDIR/test +VerifyRelease: 11111111 + +Name: rule +From: commonbase +VerifyRelease: 685AF714!|D04DD3D6! +Suite: test + +Name: otherrule +From: commonbase +VerifyRelease: DC3C29B8|685AF714! +Suite: test +CONFEND + +testrun - -b . update Test 3<<EOF +return 250 +stderr +-v1*=aptmethod got 'file:${WORKDIR}/test/dists/test/InRelease' +-v2*=Copy file '${WORKDIR}/test/dists/test/InRelease' to './lists/commonbase_test_InRelease'... +*=ERROR: Condition '685AF714!|D04DD3D6!' not fulfilled for './lists/commonbase_test_InRelease'. +*=Signatures in './lists/commonbase_test_InRelease': +*='DCAD3A286F5178E2F4B09330A573FEB160DDED5B' (signed ${CURDATE}): expired key +*='236B4B98B5087AF4B621CB14D8A28B7FD7A5D887' (signed ${CURDATE}): valid +*='12E94E82B6D7A883AF6EC8E980F4C43EDC3C29B8' (signed ${CURDATE}): valid +*=Error: Not enough signatures found for remote repository commonbase (file:${WORKDIR}/test test)! +-v0*=There have been errors! +stdout +EOF + +# now subkeys: +cat > conf/updates <<CONFEND +Name: commonbase +Method: file:$WORKDIR/test +VerifyRelease: F62C6D3B + +Name: rule +From: commonbase +VerifyRelease: D7A5D887 +Suite: test + +Name: otherrule +From: commonbase +Suite: test +CONFEND + +testrun - -b . update Test 3<<EOF +return 250 +stderr +-v1*=aptmethod got 'file:${WORKDIR}/test/dists/test/InRelease' +-v2*=Copy file '${WORKDIR}/test/dists/test/InRelease' to './lists/commonbase_test_InRelease'... +*=ERROR: Condition 'F62C6D3B' not fulfilled for './lists/commonbase_test_InRelease'. +*=Signatures in './lists/commonbase_test_InRelease': +*='DCAD3A286F5178E2F4B09330A573FEB160DDED5B' (signed ${CURDATE}): expired key +*='236B4B98B5087AF4B621CB14D8A28B7FD7A5D887' (signed ${CURDATE}): valid +*='12E94E82B6D7A883AF6EC8E980F4C43EDC3C29B8' (signed ${CURDATE}): valid +*=Error: Not enough signatures found for remote repository commonbase (file:${WORKDIR}/test test)! +-v0*=There have been errors! +stdout +EOF + +sed -e 's/F62C6D3B/F62C6D3B+/' -i conf/updates + +testrun - -b . update Test 3<<EOF +return 255 +stderr +-v1*=aptmethod got 'file:${WORKDIR}/test/dists/test/InRelease' +-v2*=Copy file '${WORKDIR}/test/dists/test/InRelease' to './lists/commonbase_test_InRelease'... +*=Missing checksums in Release file './lists/commonbase_test_InRelease'! +-v0*=There have been errors! +stdout +EOF + +# now subkey of an expired key +cat > conf/updates <<CONFEND +Name: commonbase +Method: file:$WORKDIR/test +VerifyRelease: 60DDED5B! + +Name: rule +From: commonbase +Suite: test + +Name: otherrule +From: commonbase +Suite: test +CONFEND + +# gpgme no longer seems to distinguish expired and parent-expired: +testrun - -b . update Test 3<<EOF +return 250 +stderr +-v1*=aptmethod got 'file:${WORKDIR}/test/dists/test/InRelease' +-v2*=Copy file '${WORKDIR}/test/dists/test/InRelease' to './lists/commonbase_test_InRelease'... +*=Not accepting valid signature in './lists/commonbase_test_InRelease' with EXPIRED 'DCAD3A286F5178E2F4B09330A573FEB160DDED5B' +*=(To ignore it append a ! to the key and run reprepro with --ignore=expiredkey) +*=ERROR: Condition '60DDED5B!' not fulfilled for './lists/commonbase_test_InRelease'. +*=Signatures in './lists/commonbase_test_InRelease': +*='DCAD3A286F5178E2F4B09330A573FEB160DDED5B' (signed ${CURDATE}): expired key +*='236B4B98B5087AF4B621CB14D8A28B7FD7A5D887' (signed ${CURDATE}): valid +*='12E94E82B6D7A883AF6EC8E980F4C43EDC3C29B8' (signed ${CURDATE}): valid +*=Error: Not enough signatures found for remote repository commonbase (file:${WORKDIR}/test test)! +-v0*=There have been errors! +stdout +EOF + +# now listing the expired key, of which we use an non-expired subkey +cat > conf/updates <<CONFEND +Name: commonbase +Method: file:$WORKDIR/test +VerifyRelease: A260449A!+ + +Name: rule +From: commonbase +Suite: test + +Name: otherrule +From: commonbase +Suite: test +CONFEND + +# gpgme no longer seems to distinguish expired and parent-expired: +testrun - -b . update Test 3<<EOF +return 250 +stderr +-v1*=aptmethod got 'file:${WORKDIR}/test/dists/test/InRelease' +-v2*=Copy file '${WORKDIR}/test/dists/test/InRelease' to './lists/commonbase_test_InRelease'... +*=Not accepting valid signature in './lists/commonbase_test_InRelease' with EXPIRED 'DCAD3A286F5178E2F4B09330A573FEB160DDED5B' +*=(To ignore it append a ! to the key and run reprepro with --ignore=expiredkey) +*=ERROR: Condition 'A260449A!+' not fulfilled for './lists/commonbase_test_InRelease'. +*=Signatures in './lists/commonbase_test_InRelease': +*='DCAD3A286F5178E2F4B09330A573FEB160DDED5B' (signed ${CURDATE}): expired key +*='236B4B98B5087AF4B621CB14D8A28B7FD7A5D887' (signed ${CURDATE}): valid +*='12E94E82B6D7A883AF6EC8E980F4C43EDC3C29B8' (signed ${CURDATE}): valid +*=Error: Not enough signatures found for remote repository commonbase (file:${WORKDIR}/test test)! +-v0*=There have been errors! +stdout +EOF + +# Now testing what happens when only signed with a totally different key: +cp test/dists/test/InRelease.evil test/dists/test/InRelease + +testrun - -b . update Test 3<<EOF +return 250 +stderr +-v1*=aptmethod got 'file:${WORKDIR}/test/dists/test/InRelease' +-v2*=Copy file '${WORKDIR}/test/dists/test/InRelease' to './lists/commonbase_test_InRelease'... +*=ERROR: Condition 'A260449A!+' not fulfilled for './lists/commonbase_test_InRelease'. +*=Signatures in './lists/commonbase_test_InRelease': +*='FDC7D039CCC83CC4921112A09FA943670C672A4A' (signed ${CURDATE}): valid +*=Error: Not enough signatures found for remote repository commonbase (file:${WORKDIR}/test test)! +-v0*=There have been errors! +stdout +EOF + +# Now testing an expired signature: +cat > conf/updates <<CONFEND +Name: commonbase +Method: file:$WORKDIR/test +VerifyRelease: F62C6D3B+ + +Name: rule +From: commonbase +VerifyRelease: F62C6D3B +Suite: test + +Name: otherrule +From: commonbase +Suite: test +CONFEND + +# expired signatures are not that easy to fake, so cat it: +cat > test/dists/test/InRelease <<'EOF' +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA1 + +Codename: test +Components: everything +Architectures: coal +-----BEGIN PGP SIGNATURE----- +Version: GnuPG v1.4.12 (GNU/Linux) + +iKIEAQECAAwFAk+6EiEFgwABUYAACgkQFU9je/YsbTv4LgP8DkaRBhBG7+JDD1N1 +GANCsth4rzKDfpyMrttFjW6Ra9QegDdnHyLz09IL5Hyzmst4s8DQ69q2LyZaQt3+ +0C2OG9iQ2GjQt8xvppDufvymFpqTbqnGn/LeG6KjP542Su8XZxptFPT2DyPNCe0W +Vz5f8yupwc67sAWj/qhmBEpZp9E= +=025V +-----END PGP SIGNATURE----- +EOF + +testrun - -b . update Test 3<<EOF +return 250 +stderr +-v1*=aptmethod got 'file:${WORKDIR}/test/dists/test/InRelease' +-v2*=Copy file '${WORKDIR}/test/dists/test/InRelease' to './lists/commonbase_test_InRelease'... +*=Not accepting valid but EXPIRED signature in './lists/commonbase_test_InRelease' with '2938A0D8CD4E20437CAE9CE4154F637BF62C6D3B' +*=(To ignore it append a ! to the key and run reprepro with --ignore=expiredsignature) +*=ERROR: Condition 'F62C6D3B+' not fulfilled for './lists/commonbase_test_InRelease'. +*=Signatures in './lists/commonbase_test_InRelease': +*='2938A0D8CD4E20437CAE9CE4154F637BF62C6D3B' (signed 2012-05-21): expired signature (since 2012-05-22) +*=Error: Not enough signatures found for remote repository commonbase (file:${WORKDIR}/test test)! +-v0*=There have been errors! +stdout +EOF + +testrun - --ignore=expiredsignature -b . update Test 3<<EOF +return 250 +stderr +-v1*=aptmethod got 'file:${WORKDIR}/test/dists/test/InRelease' +-v2*=Copy file '${WORKDIR}/test/dists/test/InRelease' to './lists/commonbase_test_InRelease'... +*=Not accepting valid but EXPIRED signature in './lists/commonbase_test_InRelease' with '2938A0D8CD4E20437CAE9CE4154F637BF62C6D3B' +*=(To ignore it append a ! to the key and run reprepro with --ignore=expiredsignature) +*=ERROR: Condition 'F62C6D3B+' not fulfilled for './lists/commonbase_test_InRelease'. +*=Signatures in './lists/commonbase_test_InRelease': +*='2938A0D8CD4E20437CAE9CE4154F637BF62C6D3B' (signed 2012-05-21): expired signature (since 2012-05-22) +*=Error: Not enough signatures found for remote repository commonbase (file:${WORKDIR}/test test)! +-v0*=There have been errors! +stdout +EOF + +sed -e 's/F62C6D3B/&!/' -i conf/updates + +testrun - --ignore=expiredsignature -b . update Test 3<<EOF +return 255 +stderr +-v1*=aptmethod got 'file:${WORKDIR}/test/dists/test/InRelease' +-v2*=Copy file '${WORKDIR}/test/dists/test/InRelease' to './lists/commonbase_test_InRelease'... +*=WARNING: valid but expired signature in './lists/commonbase_test_InRelease' with '2938A0D8CD4E20437CAE9CE4154F637BF62C6D3B' is accepted as requested! +*=Missing checksums in Release file './lists/commonbase_test_InRelease'! +-v0*=There have been errors! +stdout +EOF + +#empty file: +cat > test/dists/test/InRelease <<EOF +EOF + +testrun - -b . update Test 3<<EOF +return 250 +stderr +-v1*=aptmethod got 'file:${WORKDIR}/test/dists/test/InRelease' +-v2*=Copy file '${WORKDIR}/test/dists/test/InRelease' to './lists/commonbase_test_InRelease'... +*=Error: Not enough signatures found for remote repository commonbase (file:$WORKDIR/test test)! +-v0*=There have been errors! +stdout +EOF + +rm -rf db conf gpgtestdir gpgtestdir lists test + +testsuccess |