Warn about missing Signed-By in .list format

Warn about the missing field there and suggest the transition
to deb822 .sources files if we found any non-deb822 source
without signed-by.

3 files changed, 22 insertions, 3 deletions

diff --git a/apt-private/private-update.cc b/apt-private/private-update.cc
index 694480a96..d5faf5d2f 100644
--- a/apt-private/private-update.cc
+++ b/apt-private/private-update.cc
@@ -106,15 +106,23 @@ bool DoUpdate()
 
    if (_config->FindB("APT::Get::Update::SourceListWarnings::SignedBy", SLWarnings))
    {
+      bool allDeb822 = true;
       for (auto *S : *List)
       {
-	 if (not S->HasFlag(metaIndex::Flag::DEB822) || not S->GetSignedBy().empty())
+	 if (not S->GetSignedBy().empty())
 	    continue;
 
 	 URI uri(S->GetURI());
 	 // TRANSLATOR: the first is manpage reference, the last the URI from a sources.list
 	 _error->Notice(_("Missing Signed-By in the %s entry for '%s'"),
 			"sources.list(5)", URI::ArchiveOnly(uri).c_str());
+	 allDeb822 &= S->HasFlag(metaIndex::Flag::DEB822);
+      }
+      if (not allDeb822)
+      {
+	 _error->Notice(_("Consider migrating all sources.list(5) entries to the deb822 .sources format"));
+	 _error->Notice(_("The deb822 .sources format supports both embedded as well as external OpenPGP keys"));
+	 _error->Notice(_("See apt-secure(7) for best practices in configuring repository signing."));
       }
    }
 
diff --git a/test/integration/framework b/test/integration/framework
index 7c1b31ca2..3784ece06 100644
--- a/test/integration/framework
+++ b/test/integration/framework
@@ -580,6 +580,8 @@ EOF
 
 	echo 'APT::Machine-ID "912e43bd1c1d4ba481f9f8ccab25f9ee";' > rootdir/etc/apt/apt.conf.d/machine-id
 
+	echo "APT::Get::Update::SourceListWarnings::SignedBy \"false\";" >> rootdir/etc/apt/apt.conf.d/signed-by
+
 	configcompression '.' 'gz' #'bz2' 'lzma' 'xz'
 	confighashes 'SHA256' # these are tests, not security best-practices
 
diff --git a/test/integration/test-apt-get-update-sourceslist-warning b/test/integration/test-apt-get-update-sourceslist-warning
index 115dd3e16..652f9f49f 100755
--- a/test/integration/test-apt-get-update-sourceslist-warning
+++ b/test/integration/test-apt-get-update-sourceslist-warning
@@ -8,6 +8,7 @@ setupenvironment
 configarchitecture 'amd64'
 setupaptarchive --no-update
 
+rm rootdir/etc/apt/apt.conf.d/signed-by
 testsuccess apt update
 testsuccess apt update --no-download
 
@@ -44,7 +45,15 @@ rm rootdir/etc/apt/sources.list.d/example.sources
 msgmsg 'Detect login info embedded in sources.list'
 echo 'deb http://apt:debian@example.org/debian bookworm main' > rootdir/etc/apt/sources.list.d/example.list
 testsuccessequal "$BOILERPLATE
-N: Usage of apt_auth.conf(5) should be preferred over embedding login information directly in the sources.list(5) entry for 'http://example.org/debian'" apt update --no-download
+N: Usage of apt_auth.conf(5) should be preferred over embedding login information directly in the sources.list(5) entry for 'http://example.org/debian'
+N: Missing Signed-By in the sources.list(5) entry for 'http://example.org/debian'
+N: Consider migrating all sources.list(5) entries to the deb822 .sources format
+N: The deb822 .sources format supports both embedded as well as external OpenPGP keys
+N: See apt-secure(7) for best practices in configuring repository signing." apt update --no-download
 echo 'deb tor+https://apt:debian@example.org/debian bookworm main' > rootdir/etc/apt/sources.list.d/example.list
 testsuccessequal "$BOILERPLATE
-N: Usage of apt_auth.conf(5) should be preferred over embedding login information directly in the sources.list(5) entry for 'tor+https://example.org/debian'" apt update --no-download
+N: Usage of apt_auth.conf(5) should be preferred over embedding login information directly in the sources.list(5) entry for 'tor+https://example.org/debian'
+N: Missing Signed-By in the sources.list(5) entry for 'tor+https://example.org/debian'
+N: Consider migrating all sources.list(5) entries to the deb822 .sources format
+N: The deb822 .sources format supports both embedded as well as external OpenPGP keys
+N: See apt-secure(7) for best practices in configuring repository signing." apt update --no-download