apt/test, branch 2.9.26

Make notices about .list sources without signed-by less obnoxious

2025-01-28T18:48:47Z

apt: Introduce the modernize-sources command

2025-01-28T18:47:00Z

This handles rewriting .list entries to .sources ones; the only options handled are - signed-by => Signed-By - trusted => Trusted The options to specify architectures, check-valid-until, etc. are not supported as they are not exposed in the code. We probably should refactor the parser at some point so we can actually read the parsed entry rather than the abstract objects we create from it. This can be improved further: - Keyrings from /etc/apt/trusted.gpg.d should be moved to /etc/apt/keyrings. - automatic detection by trying to verify using each keyring in trusted.gpg.d until we find the right one and then using that for Signed-By rather than leave some sources empty.

apt-secure manual page is in manual section 8

2025-01-28T18:45:23Z

sqv, gpgv: Do not fail if Dir::Etc::Trusted is set and trusted.gpg.d is missing

2025-01-22T08:55:11Z

This should remain a warning case for now. So push the errors to a stack and see if we can find any file. Explictly warn again if Dir::Etc::trusted is set, as it is like _super_ deprecated. Reported-By: Cyril Brulebois in Bug#1032131

Remove superseded warning about trusted.gpg fallback

2025-01-21T11:16:34Z

This warning has been superseded by the missing sources.list notice (which will also become a warning shortly) Adjust the sqv exit to avoid introducing a new spurious "No good signature" that we did not reach before. moo

Warn about missing Signed-By in .list format

2025-01-21T11:16:34Z

Warn about the missing field there and suggest the transition to deb822 .sources files if we found any non-deb822 source without signed-by.

Grep for more evil in test as a signature can contain evil

2025-01-17T01:09:05Z

The test was failing for me as the PGP signature contained "GeviljGB" which is clearly not the evil we are looking for. Sadly, reproducing this is hard, but random failures of the test suite are annoying, so lets grep for a bit longer strings that can't happen in the signature block to avoid this particular problem.

Write Pre-Depends with a dash again in EDSP

2025-01-17T00:27:48Z

For some reason ~ that I don't know and can't come up with on the spot ~ we output the Pre-Depends field as PreDepends in the translated user-visible output and I accidentally copied that over to the untranslated variant that replaced the embedded copy (with a dash) in the EDSP generator. Code-copies and implementation details littered all over the place are apparently sometimes a good bug-free thing, too… Regression-of: 6828ae2c2f9268c8187f0fa91b3c464ed84a8476 Closes: #1093254

t/i/test-method-gpgv-legacy-keyring: Switch to http, extend

2025-01-14T09:01:51Z

Add some more test cases where only one of the sources is bad; and switch to htp to make the order more reliable.

Drop SourceListWarnings::NonFreeFirmware messages

2025-01-05T22:16:09Z

They were implemented to help a tiny bit in notifying users even if they didn't read the Release notes (or didn't realize it would apply to them) that they likely have to change their sources.list entries, but that transition is now over for a while, so everyone who should have seen it has hopefully reacted to it and so all this code now does is waste space, time and idly waiting for false positives.