Merge branch 'trust-deprecation' into 'main'

Warn about missing Signed-By in .list format

See merge request apt-team/apt!431

3 files changed, 13 insertions, 67 deletions

diff --git a/test/integration/framework b/test/integration/framework
index 7c1b31ca2..3784ece06 100644
--- a/test/integration/framework
+++ b/test/integration/framework
@@ -580,6 +580,8 @@ EOF
 
 	echo 'APT::Machine-ID "912e43bd1c1d4ba481f9f8ccab25f9ee";' > rootdir/etc/apt/apt.conf.d/machine-id
 
+	echo "APT::Get::Update::SourceListWarnings::SignedBy \"false\";" >> rootdir/etc/apt/apt.conf.d/signed-by
+
 	configcompression '.' 'gz' #'bz2' 'lzma' 'xz'
 	confighashes 'SHA256' # these are tests, not security best-practices
 
diff --git a/test/integration/test-apt-get-update-sourceslist-warning b/test/integration/test-apt-get-update-sourceslist-warning
index 115dd3e16..652f9f49f 100755
--- a/test/integration/test-apt-get-update-sourceslist-warning
+++ b/test/integration/test-apt-get-update-sourceslist-warning
@@ -8,6 +8,7 @@ setupenvironment
 configarchitecture 'amd64'
 setupaptarchive --no-update
 
+rm rootdir/etc/apt/apt.conf.d/signed-by
 testsuccess apt update
 testsuccess apt update --no-download
 
@@ -44,7 +45,15 @@ rm rootdir/etc/apt/sources.list.d/example.sources
 msgmsg 'Detect login info embedded in sources.list'
 echo 'deb http://apt:debian@example.org/debian bookworm main' > rootdir/etc/apt/sources.list.d/example.list
 testsuccessequal "$BOILERPLATE
-N: Usage of apt_auth.conf(5) should be preferred over embedding login information directly in the sources.list(5) entry for 'http://example.org/debian'" apt update --no-download
+N: Usage of apt_auth.conf(5) should be preferred over embedding login information directly in the sources.list(5) entry for 'http://example.org/debian'
+N: Missing Signed-By in the sources.list(5) entry for 'http://example.org/debian'
+N: Consider migrating all sources.list(5) entries to the deb822 .sources format
+N: The deb822 .sources format supports both embedded as well as external OpenPGP keys
+N: See apt-secure(7) for best practices in configuring repository signing." apt update --no-download
 echo 'deb tor+https://apt:debian@example.org/debian bookworm main' > rootdir/etc/apt/sources.list.d/example.list
 testsuccessequal "$BOILERPLATE
-N: Usage of apt_auth.conf(5) should be preferred over embedding login information directly in the sources.list(5) entry for 'tor+https://example.org/debian'" apt update --no-download
+N: Usage of apt_auth.conf(5) should be preferred over embedding login information directly in the sources.list(5) entry for 'tor+https://example.org/debian'
+N: Missing Signed-By in the sources.list(5) entry for 'tor+https://example.org/debian'
+N: Consider migrating all sources.list(5) entries to the deb822 .sources format
+N: The deb822 .sources format supports both embedded as well as external OpenPGP keys
+N: See apt-secure(7) for best practices in configuring repository signing." apt update --no-download
diff --git a/test/integration/test-method-gpgv-legacy-keyring b/test/integration/test-method-gpgv-legacy-keyring
deleted file mode 100755
index cc500ad1c..000000000
--- a/test/integration/test-method-gpgv-legacy-keyring
+++ /dev/null
@@ -1,65 +0,0 @@
-#!/bin/sh
-set -e
-
-TESTDIR="$(readlink -f "$(dirname "$0")")"
-. "$TESTDIR/framework"
-
-setupenvironment
-configarchitecture "amd64"
-
-insertpackage 'testing' 'foo' 'all' '1'
-insertpackage 'unstable' 'foo' 'all' '1'
-
-buildaptarchive
-setupaptarchive --no-update
-changetowebserver
-
-alias inrelease_size="stat -c %s aptarchive/dists/testing/InRelease"
-alias uinrelease_size="stat -c %s aptarchive/dists/unstable/InRelease"
-
-testsuccessequal "Get:1 http://localhost:${APTHTTPPORT} testing InRelease [$(inrelease_size) B]
-Get:2 http://localhost:${APTHTTPPORT} unstable InRelease [$(uinrelease_size) B]
-Get:3 http://localhost:${APTHTTPPORT} testing/main all Packages [248 B]
-Get:4 http://localhost:${APTHTTPPORT} testing/main Translation-en [225 B]
-Get:5 http://localhost:${APTHTTPPORT} unstable/main all Packages [246 B]
-Get:6 http://localhost:${APTHTTPPORT} unstable/main Translation-en [224 B]
-Reading package lists..." aptget update -q
-
-mv rootdir/etc/apt/trusted.gpg.d/joesixpack.gpg rootdir/etc/apt/trusted.gpg
-
-testwarningequal "Hit:1 http://localhost:${APTHTTPPORT} testing InRelease
-Hit:2 http://localhost:${APTHTTPPORT} unstable InRelease
-Reading package lists...
-W: http://localhost:${APTHTTPPORT}/dists/testing/InRelease: Key is stored in legacy trusted.gpg keyring (${TMPWORKINGDIRECTORY}/rootdir/etc/apt/trusted.gpg). Use Signed-By instead. See the USER CONFIGURATION section in apt-secure(8) for details.
-W: http://localhost:${APTHTTPPORT}/dists/unstable/InRelease: Key is stored in legacy trusted.gpg keyring (${TMPWORKINGDIRECTORY}/rootdir/etc/apt/trusted.gpg). Use Signed-By instead. See the USER CONFIGURATION section in apt-secure(8) for details." aptget update -q
-
-# 2.4.0 regression: If the InRelease file was signed with two keys, fallback to trusted.gpg did not
-# work: It ran the fallback, but then ignored the result, as keys were still missing.
-original_inrelease_size=$(inrelease_size)
-cp -a aptarchive/dists/unstable/InRelease aptarchive/dists/unstable/InRelease.bak
-redatereleasefiles '+1 hour' 'Joe Sixpack,Marvin Paranoid'
-cp -a aptarchive/dists/unstable/InRelease.bak aptarchive/dists/unstable/InRelease
-testwarningequal "Get:1 http://localhost:${APTHTTPPORT} testing InRelease [$(inrelease_size) B]
-Hit:2 http://localhost:${APTHTTPPORT} unstable InRelease
-Reading package lists...
-W: http://localhost:${APTHTTPPORT}/dists/testing/InRelease: Key is stored in legacy trusted.gpg keyring (${TMPWORKINGDIRECTORY}/rootdir/etc/apt/trusted.gpg). Use Signed-By instead. See the USER CONFIGURATION section in apt-secure(8) for details.
-W: http://localhost:${APTHTTPPORT}/dists/unstable/InRelease: Key is stored in legacy trusted.gpg keyring (${TMPWORKINGDIRECTORY}/rootdir/etc/apt/trusted.gpg). Use Signed-By instead. See the USER CONFIGURATION section in apt-secure(8) for details." aptget update -q -omsg=with-two-signatures
-
-# Now the first one is good, hooray
-cp keys/marvinparanoid.pub rootdir/etc/apt/trusted.gpg.d/marvinparanoid.gpg
-testwarningequal "Hit:1 http://localhost:${APTHTTPPORT} testing InRelease
-Hit:2 http://localhost:${APTHTTPPORT} unstable InRelease
-Reading package lists...
-W: http://localhost:${APTHTTPPORT}/dists/unstable/InRelease: Key is stored in legacy trusted.gpg keyring (${TMPWORKINGDIRECTORY}/rootdir/etc/apt/trusted.gpg). Use Signed-By instead. See the USER CONFIGURATION section in apt-secure(8) for details." aptget update -q -omsg=with-two-signatures
-
-# Now the 2nd one is good
-cp keys/marvinparanoid.pub rootdir/etc/apt/trusted.gpg.d/marvinparanoid.gpg
-redatereleasefiles '+2 hour' 'Joe Sixpack'
-cp -a aptarchive/dists/testing/InRelease aptarchive/dists/testing/InRelease.bak
-redatereleasefiles '+2 hour' 'Joe Sixpack,Marvin Paranoid'
-cp -a aptarchive/dists/testing/InRelease.bak aptarchive/dists/testing/InRelease
-testwarningequal "Get:1 http://localhost:${APTHTTPPORT} testing InRelease [$(inrelease_size) B]
-Get:2 http://localhost:${APTHTTPPORT} unstable InRelease [$(uinrelease_size) B]
-Reading package lists...
-W: http://localhost:${APTHTTPPORT}/dists/testing/InRelease: Key is stored in legacy trusted.gpg keyring (${TMPWORKINGDIRECTORY}/rootdir/etc/apt/trusted.gpg). Use Signed-By instead. See the USER CONFIGURATION section in apt-secure(8) for details." aptget update -q -omsg=with-two-signatures
-