update: Add notice about missing Signed-By in deb822 sources

We want to gently steer users towards having Signed-By for each
source such that we can retire a shared keyring across sources
which improves resilience against configuration issues and
incompetent malicious actors.

4 files changed, 20 insertions, 2 deletions

diff --git a/apt-pkg/deb/debmetaindex.cc b/apt-pkg/deb/debmetaindex.cc
index ef6bce261..744a5cab7 100644
--- a/apt-pkg/deb/debmetaindex.cc
+++ b/apt-pkg/deb/debmetaindex.cc
@@ -1397,6 +1397,9 @@ class APT_HIDDEN debSLTypeDebian : public pkgSourceList::Type		/*{{{*/
 	  Deb->SetSnapshot(GetSnapshotOption(Options, "snapshot")) == false)
 	 return false;
 
+      if (GetBoolOption(Options, "sourceslist-entry-is-deb822", false))
+	 Deb->SetFlag(metaIndex::Flag::DEB822);
+
       std::map<std::string, std::string>::const_iterator const signedby = Options.find("signed-by");
       if (signedby == Options.end())
       {
diff --git a/apt-pkg/metaindex.cc b/apt-pkg/metaindex.cc
index 97996b3f1..f3df9b159 100644
--- a/apt-pkg/metaindex.cc
+++ b/apt-pkg/metaindex.cc
@@ -11,8 +11,9 @@
 #include <vector>
 									/*}}}*/
 
-class metaIndexPrivate							/*{{{*/
+struct metaIndexPrivate							/*{{{*/
 {
+   int Flags;
 };
 									/*}}}*/
 
@@ -69,6 +70,8 @@ APT_PURE signed short metaIndex::GetDefaultPin() const { return DefaultPin; }
 APT_PURE bool metaIndex::GetSupportsAcquireByHash() const { return SupportsAcquireByHash; }
 APT_PURE time_t metaIndex::GetValidUntil() const { return ValidUntil; }
 APT_PURE time_t metaIndex::GetDate() const { return this->Date; }
+APT_PURE bool metaIndex::HasFlag(metaIndex::Flag Flag) const { return d->Flags & int(Flag); }
+void metaIndex::SetFlag(metaIndex::Flag Flag) { d->Flags |= int(Flag); }
 APT_PURE metaIndex::TriState metaIndex::GetLoadedSuccessfully() const { return LoadedSuccessfully; }
 APT_PURE std::string metaIndex::GetExpectedDist() const { return Dist; }
 									/*}}}*/
diff --git a/apt-pkg/metaindex.h b/apt-pkg/metaindex.h
index b8db21705..3e9cf3718 100644
--- a/apt-pkg/metaindex.h
+++ b/apt-pkg/metaindex.h
@@ -30,7 +30,13 @@ public:
    enum APT_HIDDEN TriState {
       TRI_YES, TRI_DONTCARE, TRI_NO, TRI_UNSET
    };
-private:
+
+   enum class APT_HIDDEN Flag
+   {
+      DEB822 = 0x01,
+   };
+
+   private:
    metaIndexPrivate * const d;
 protected:
    std::vector <pkgIndexFile *> *Indexes;
@@ -74,6 +80,10 @@ public:
    time_t GetValidUntil() const;
    time_t GetDate() const;
    virtual time_t GetNotBefore() const = 0;
+#ifdef APT_COMPILING_APT
+   bool HasFlag(Flag flag) const;
+#endif
+   void SetFlag(Flag flag) APT_HIDDEN;
 
    std::string GetExpectedDist() const;
    bool CheckDist(std::string const &MaybeDist) const;
diff --git a/apt-pkg/sourcelist.cc b/apt-pkg/sourcelist.cc
index 055cf4142..e11afceed 100644
--- a/apt-pkg/sourcelist.cc
+++ b/apt-pkg/sourcelist.cc
@@ -143,6 +143,8 @@ bool pkgSourceList::Type::ParseStanza(vector<metaIndex *> &List,	/*{{{*/
       Options["sourceslist-entry"] = entry;
    }
 
+   Options["sourceslist-entry-is-deb822"] = "true";
+
    // now create one item per suite/section
    auto const list_uris = FindMultiValue(Tags, "URIs");
    auto const list_comp = FindMultiValue(Tags, "Components");