Merge branch 'replace-apt-key-sq' into 'main'

Use sq in the test suite, remove apt-key

See merge request apt-team/apt!413

10 files changed, 100 insertions, 585 deletions

diff --git a/test/integration/framework b/test/integration/framework
index a93168278..bae14e984 100644
--- a/test/integration/framework
+++ b/test/integration/framework
@@ -199,7 +199,6 @@ aptcache() { runapt apt-cache "$@"; }
 aptcdrom() { runapt apt-cdrom "$@"; }
 aptget() { runapt apt-get "$@"; }
 aptftparchive() { runapt "${APTFTPARCHIVEBINDIR}/apt-ftparchive" "$@"; }
-aptkey() { runapt "${APTTESTHELPERSBINDIR}/apt-key" "$@"; }
 aptmark() { runapt apt-mark "$@"; }
 aptsortpkgs() { runapt apt-sortpkgs "$@"; }
 apt() { runapt apt "$@"; }
@@ -210,6 +209,7 @@ aptextracttemplates() { runapt apt-extracttemplates "$@"; }
 aptinternalsolver() { runapt "${APTINTERNALSOLVER}" "$@"; }
 aptdumpsolver() { runapt "${APTDUMPSOLVER}" "$@"; }
 aptinternalplanner() { runapt "${APTINTERNALPLANNER}" "$@"; }
+sq() { command sq --key-store=none --cert-store=none "$@"; }
 
 dpkg() {
 	"${TMPWORKINGDIRECTORY}/rootdir/usr/bin/dpkg" "$@"
@@ -587,11 +587,6 @@ EOF
 	echo 'DPkg::Path "";' >> aptconfig.conf
 	echo 'Dir::Bin::ischroot "/bin/false";' >> aptconfig.conf
 
-	# If gpgv supports --weak-digest, pass it to make sure we can disable SHA1
-	if aptkey verify --weak-digest SHA1 --help 2>/dev/null >/dev/null; then
-		echo 'Acquire::gpgv::Options { "--weak-digest"; "sha1"; };' > rootdir/etc/apt/apt.conf.d/no-sha1
-	fi
-
 	# most tests just need one signed Release file, not both
 	export APT_DONT_SIGN='Release.gpg'
 
@@ -881,9 +876,8 @@ buildsimplenativepackage() {
 		| while read SRC; do
 		echo "pool/${SRC}" >> "${BUILDDIR}/../${RELEASE}.${DISTSECTION}.srclist"
 #		if expr match "${SRC}" '.*\.dsc' >/dev/null 2>&1; then
-#			aptkey --keyring ./keys/joesixpack.pub --secret-keyring ./keys/joesixpack.sec --quiet --readonly \
-#				adv --yes --default-key 'Joe Sixpack' \
-#				--clearsign -o "${BUILDDIR}/../${SRC}.sign" "${BUILDDIR}/../$SRC"
+#			sq sign --signer-file ./keys/joesixpack.sec
+#				-o "${BUILDDIR}/../${SRC}.sign" --cleartext "${BUILDDIR}/../$SRC"
 #			mv "${BUILDDIR}/../${SRC}.sign" "${BUILDDIR}/../$SRC"
 #		fi
 	done
@@ -1301,22 +1295,7 @@ killgpgagent() {
 	GNUPGHOME="${GPGHOME}" gpgconf --kill gpg-agent >/dev/null 2>&1 || true
 	rm -rf "$GPGHOME"
 }
-dosigning() {
-	local KEY="$1"
-	shift
-	local GPGHOME="${TMPWORKINGDIRECTORY}/signinghome"
-	if [ -n "$APT_TEST_SIGNINGHOME" ]; then
-		GPGHOME="$APT_TEST_SIGNINGHOME"
-	else
-		if [ ! -e "$GPGHOME" ]; then
-			mkdir -p --mode=700 "${GPGHOME}"
-			addtrap 'prefix' 'killgpgagent;'
-		fi
-	fi
-	testsuccess aptkey --quiet --keyring ${KEY}.pub --secret-keyring ${KEY}.sec --readonly \
-		--homedir "${GPGHOME}" adv --batch --yes --digest-algo "${APT_TESTS_DIGEST_ALGO:-SHA512}" \
-		"$@"
-}
+
 signreleasefiles() {
 	local SIGNERS="${1:-Joe Sixpack}"
 	local REPODIR="${2:-aptarchive}"
@@ -1348,20 +1327,22 @@ signreleasefiles() {
 				cp "$SECUNEXPIRED" "${REXKEY}.sec"
 				cp "$PUBUNEXPIRED" "${REXKEY}.pub"
 			else
-				if ! printf "expire\n1w\nsave\n" | aptkey --quiet --keyring "${REXKEY}.pub" --secret-keyring "${REXKEY}.sec" \
-					--readonly adv --batch --yes --digest-algo "${APT_TESTS_DIGEST_ALGO:-SHA512}" \
-					--default-key "$SIGNER" --command-fd 0 --edit-key "${SIGNER}" >setexpire.gpg 2>&1; then
-					cat setexpire.gpg
-					exit 1
-				fi
-				cp "${REXKEY}.sec" "$SECUNEXPIRED"
-				cp "${REXKEY}.pub" "$PUBUNEXPIRED"
+				chronic sq key expire --expiration 1w --cert-file "${REXKEY}.sec" --output "$SECUNEXPIRED"
+				chronic sq key subkey expire --expiration 1w --policy-as-of 2020-01-01 --cert-file "$SECUNEXPIRED" --output "$SECUNEXPIRED" --overwrite --key  B3C9747B5FFD84E5585C3055DB4B332DD8DA0F4F
+				chronic sq key delete --cert-file "${SECUNEXPIRED}" --output "$PUBUNEXPIRED"
+				cp "${SECUNEXPIRED}" "${REXKEY}.sec"
+				cp "${PUBUNEXPIRED}" "${REXKEY}.pub"
 			fi
 		fi
 		if [ ! -e "${KEY}.pub" ]; then
 			local K="keys/$(echo "$SIGNER" | tr 'A-Z' 'a-z' | tr -d ' ,')"
-			cat "${K}.pub" >> "${KEY}.new.pub"
-			cat "${K}.sec" >> "${KEY}.new.sec"
+			if [ ! -e "${KEY}.new.pub" ]; then
+				cp "${K}.pub" "${KEY}.new.pub"
+				cp "${K}.sec" "${KEY}.new.sec"
+			else
+				chronic sq keyring merge "${KEY}.new.pub" "${K}.pub" --output "${KEY}.new.pub" --overwrite
+				chronic sq keyring merge "${KEY}.new.sec" "${K}.sec" --output "${KEY}.new.sec" --overwrite
+			fi
 		fi
 	done
 	if [ ! -e "${KEY}.pub" ]; then
@@ -1374,14 +1355,18 @@ signreleasefiles() {
 		if [ "$APT_DONT_SIGN" = 'Release.gpg' ]; then
 			rm -f "${RELEASE}.gpg"
 		else
-			dosigning "$KEY" "$@" $SIGUSERS --armor --detach-sign --sign --output "${RELEASE}.gpg" "${RELEASE}"
+			if command sq --cli-version 0.40 version 2>/dev/null; then
+				sq sign $time --signer-file "$KEY.sec" "$@" --overwrite --output "${RELEASE}.gpg" --signature-file "${RELEASE}"
+			else
+				sq sign $time --signer-file "$KEY.sec" "$@" --overwrite --signature-file "${RELEASE}.gpg" "${RELEASE}"
+			fi
 			touch -d "$DATE" "${RELEASE}.gpg"
 		fi
 		local INRELEASE="${RELEASE%/*}/InRelease"
 		if [ "$APT_DONT_SIGN" = 'InRelease' ]; then
 			rm -f "$INRELEASE"
 		else
-			dosigning "$KEY" "$@" $SIGUSERS --clearsign --output "$INRELEASE" "$RELEASE"
+			sq sign $time --signer-file "$KEY.sec" "$@" --overwrite --output "${INRELEASE}" --cleartext "${RELEASE}"
 			touch -d "$DATE" "${INRELEASE}"
 		fi
 	done
@@ -2024,27 +2009,14 @@ testfailure() {
 	else
 		local EXITCODE=$?
 		if expr match "$1" '^apt.*' >/dev/null; then
-			if [ "$1" = 'aptkey' ]; then
-				if grep -q " Can't check signature: 
- BAD signature from 
- signature could not be verified" "$OUTPUT"; then
-					msgpass
-				elif [ -e "$OUTPUT" -a ! -s "$OUTPUT" ]; then
-					msgwarn "apt-key failed without output, this is normal for gpgv-sq (see sequoia-chameleon-gnupg#88)"
-					msgpass
-				else
-					msgfailoutput "run failed with exitcode ${EXITCODE}, but no signature error" "$OUTPUT" "$@"
-				fi
+			if grep -q -E ' runtime error: ' "$OUTPUT"; then
+				msgfailoutput 'compiler detected undefined behavior' "$OUTPUT" "$@"
+			elif grep -q -E '==ERROR' "$OUTPUT"; then
+				msgfailoutput 'compiler sanitizers reported errors' "$OUTPUT" "$@"
+			elif ! grep -q -E '^E: ' "$OUTPUT"; then
+				msgfailoutput "run failed with exitcode ${EXITCODE}, but with no errors" "$OUTPUT" "$@"
 			else
-				if grep -q -E ' runtime error: ' "$OUTPUT"; then
-					msgfailoutput 'compiler detected undefined behavior' "$OUTPUT" "$@"
-				elif grep -q -E '==ERROR' "$OUTPUT"; then
-					msgfailoutput 'compiler sanitizers reported errors' "$OUTPUT" "$@"
-				elif ! grep -q -E '^E: ' "$OUTPUT"; then
-					msgfailoutput "run failed with exitcode ${EXITCODE}, but with no errors" "$OUTPUT" "$@"
-				else
-					msgpass
-				fi
+				msgpass
 			fi
 		else
 			msgpass
@@ -2182,14 +2154,6 @@ mapkeynametokeyid() {
 		shift
 	done
 }
-testaptkeys() {
-	local OUTPUT="${TMPWORKINGDIRECTORY}/rootdir/tmp/aptkeylist.output"
-	if ! aptkey list --with-colon 2>/dev/null | grep '^pub' | cut -d':' -f 5 > "$OUTPUT"; then
-		echo -n > "$OUTPUT"
-	fi
-	testfileequal "$OUTPUT" "$(mapkeynametokeyid "$@")"
-}
-
 pause() {
 	echo "STOPPED execution. Press enter to continue"
 	local IGNORE
diff --git a/test/integration/run-tests b/test/integration/run-tests
index 331adfcfa..24d0cc00f 100755
--- a/test/integration/run-tests
+++ b/test/integration/run-tests
@@ -156,16 +156,6 @@ if [ -n "$APT_TEST_JOBS" ]; then
 	exit $((FAIL <= 255 ? FAIL : 255))
 fi
 
-APT_TEST_SIGNINGHOME="$(mktemp --directory --tmpdir 'apt-key-signinghome.XXXXXXXXXX')"
-removesigninghome() {
-	if [ -z "$APT_TEST_SIGNINGHOME" ]; then return; fi
-	GNUPGHOME="${APT_TEST_SIGNINGHOME}" gpgconf --kill gpg-agent >/dev/null 2>&1 || true
-	rm -rf -- "$APT_TEST_SIGNINGHOME"
-}
-trap "exit 1" 0 HUP INT ILL ABRT FPE SEGV PIPE TERM
-trap "removesigninghome" 0 QUIT
-export APT_TEST_SIGNINGHOME
-
 TOTAL="$(echo "$TESTLIST" | wc -l)"
 if [ "$MSGLEVEL" -le 1 ]; then
 	printf "${CTEST}Running testcases${CRESET}: "
diff --git a/test/integration/test-apt-key b/test/integration/test-apt-key
deleted file mode 100755
index c2180c5f1..000000000
--- a/test/integration/test-apt-key
+++ /dev/null
@@ -1,428 +0,0 @@
-#!/bin/sh
-set -e
-
-# apt-key is a shell script, so relatively prune to be effected by 'crazy' things:
-# confuses config parser as there exists no way of escaping " currently.
-#TMPDIR="$(mktemp -d)/This is \"fü\$\$ing cràzy\", \$(man man | head -n1 | cut -d' ' -f 1)\$!"
-# gpg doesn't like | in path names – documented e.g. in the man gpg2 --agent-program
-#TMPDIR="$(mktemp -d)/This is fü\$\$ing cràzy, \$(man man | head -n1 | cut -d' ' -f 1)\$!"
-TMPDIR_ADD="This is fü\$\$ing cràzy, \$(apt -v)\$!"
-
-TESTDIR="$(readlink -f "$(dirname "$0")")"
-. "$TESTDIR/framework"
-
-setupenvironment
-chmod o+x "${TMPWORKINGDIRECTORY}/.."
-configarchitecture 'amd64'
-
-insertpackage 'unstable' 'bar' 'i386' '1'
-insertsource 'unstable' 'foo' 'all' '1'
-setupaptarchive --no-update
-
-# start from a clean plate again
-cleanplate() {
-	rm -rf "${ROOTDIR}/etc/apt/trusted.gpg.d/" "${ROOTDIR}/etc/apt/trusted.gpg"
-	mkdir "${ROOTDIR}/etc/apt/trusted.gpg.d/"
-}
-testmultigpg() {
-	testfailure --nomsg aptkey --quiet --readonly "$@"
-	testsuccess grep "^gpgv: Can't check signature" "${ROOTDIR}/tmp/testfailure.output"
-	testsuccess grep '^gpgv: Good signature from' "${ROOTDIR}/tmp/testfailure.output"
-}
-testaptkeyskeyring() {
-	local KEYRING="$1"
-	shift
-	local OUTPUT="${TMPWORKINGDIRECTORY}/rootdir/tmp/aptkeylistkeyring.output"
-	if ! aptkey --keyring "$KEYRING" list --with-colon 2>/dev/null | grep '^pub' | cut -d':' -f 5 > "$OUTPUT"; then
-		echo -n > "$OUTPUT"
-	fi
-	testfileequal "$OUTPUT" "$(mapkeynametokeyid "$@")"
-}
-testsuccessempty() {
-	testempty "$@"
-}
-testrun() {
-	local EXT="${1:-gpg}"
-	local TESTSTATE="${2:-testsuccess}"
-	echo "APT::Key::ArchiveKeyring \"${KEYDIR}/joesixpack.pub.gpg\";
-APT::Key::RemovedKeys \"${KEYDIR}/rexexpired.pub.gpg\";" > "${ROOTDIR}/etc/apt/apt.conf.d/aptkey.conf"
-
-	cleanplate
-	ln -sf "$(readlink -f "${KEYDIR}/joesixpack.pub.${EXT}")" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	testaptkeys 'Joe Sixpack'
-
-	${TESTSTATE} aptkey list
-	msgtest 'Check that paths in list output are not' 'double-slashed'
-	testfailure --nomsg grep '//' "${ROOTDIR}/tmp/${TESTSTATE}.output"
-
-	${TESTSTATE} aptkey finger
-	msgtest 'Check that paths in finger output are not' 'double-slashed'
-	testfailure --nomsg grep '//' "${ROOTDIR}/tmp/${TESTSTATE}.output"
-
-	cp -a "${KEYDIR}/joesixpack.pub.${EXT}" "${KEYDIR}/joesixpack.pub.${EXT}.bak"
-	if [ "$TESTSTATE" = 'testwarning' ]; then
-		testwarning aptkey --fakeroot update
-		testsuccess grep '^gpg: key .*DBAC8DAE: "Joe Sixpack (APT Testcases Dummy) <joe@example.org>" not changed$' "${ROOTDIR}/tmp/testwarning.output"
-		testsuccess grep '^W: .* are ignored as the file has an unsupported filetype' "${ROOTDIR}/tmp/testwarning.output"
-	else
-		testequalor2 'gpg: key DBAC8DAE: "Joe Sixpack (APT Testcases Dummy) <joe@example.org>" not changed
-gpg: Total number processed: 1
-gpg:              unchanged: 1' 'gpg: key 5A90D141DBAC8DAE: "Joe Sixpack (APT Testcases Dummy) <joe@example.org>" not changed
-gpg: Total number processed: 1
-gpg:              unchanged: 1' aptkey --fakeroot update
-	fi
-	testsuccess test -L "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	testsuccess cmp "${KEYDIR}/joesixpack.pub.${EXT}" "${KEYDIR}/joesixpack.pub.${EXT}.bak"
-
-	testaptkeys 'Joe Sixpack'
-	testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg"
-
-	${TESTSTATE} aptkey --fakeroot add "${KEYDIR}/rexexpired.pub.${EXT}"
-	testfilestats "${ROOTDIR}/etc/apt/trusted.gpg" '%a' '=' '644'
-
-	testaptkeys 'Rex Expired' 'Joe Sixpack'
-
-	msgtest 'Check that Sixpack key can be' 'exported'
-	aptkey export 'Sixpack' > "${TMPWORKINGDIRECTORY}/aptkey.export" 2>/dev/null
-	aptkey --keyring "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}" exportall > "${TMPWORKINGDIRECTORY}/aptkey.exportall"
-	testsuccess --nomsg cmp "${TMPWORKINGDIRECTORY}/aptkey.export" "${TMPWORKINGDIRECTORY}/aptkey.exportall"
-	testsuccess test -s "${TMPWORKINGDIRECTORY}/aptkey.export"
-	testsuccess test -s "${TMPWORKINGDIRECTORY}/aptkey.exportall"
-
-	msgtest 'Check that multiple keys can be' 'exported'
-	aptkey export 'Sixpack' 'Expired' > "${TMPWORKINGDIRECTORY}/aptkey.export" 2>/dev/null
-	aptkey --keyring "${KEYDIR}/rexexpired.pub.${EXT}" \
-		--keyring "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}" exportall > "${TMPWORKINGDIRECTORY}/aptkey.exportall"
-	testsuccess --nomsg cmp "${TMPWORKINGDIRECTORY}/aptkey.export" "${TMPWORKINGDIRECTORY}/aptkey.exportall"
-	testsuccess test -s "${TMPWORKINGDIRECTORY}/aptkey.export"
-	testsuccess test -s "${TMPWORKINGDIRECTORY}/aptkey.exportall"
-
-	msgtest 'Execute update again to trigger removal of' 'Rex Expired key'
-	${TESTSTATE} --nomsg aptkey --fakeroot update
-
-	testaptkeys 'Joe Sixpack'
-
-	msgtest "Try to remove a key which exists, but isn't in the" 'forced keyring'
-	testsuccess --nomsg aptkey --fakeroot --keyring "${ROOTDIR}/etc/apt/trusted.gpg" del DBAC8DAE
-
-	testaptkeys 'Joe Sixpack'
-
-	${TESTSTATE} aptkey --fakeroot del DBAC8DAE
-	"${TESTSTATE}empty" aptkey list
-
-	ln -sf "$(readlink -f "${KEYDIR}/joesixpack.pub.${EXT}")" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	testaptkeys 'Joe Sixpack'
-	msgtest "Remove a key from" 'forced keyring in trusted.d.gpg'
-	testsuccess --nomsg aptkey --fakeroot --keyring "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}" del DBAC8DAE
-	testsuccess cmp -s "$(readlink -f "${KEYDIR}/joesixpack.pub.${EXT}")" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}~"
-	"${TESTSTATE}empty" aptkey list
-
-	cp -a "${KEYDIR}/marvinparanoid.pub.asc" "${ROOTDIR}/etc/foobar.pub"
-	testsuccess aptkey --fakeroot --keyring "${ROOTDIR}/etc/foobar.pub" add "${KEYDIR}/rexexpired.pub.asc" "${KEYDIR}/joesixpack.pub.gpg"
-	testfilestats "${ROOTDIR}/etc/foobar.pub" '%a' '=' '644'
-	testaptkeyskeyring "${ROOTDIR}/etc/foobar.pub" 'Marvin Paranoid' 'Rex Expired' 'Joe Sixpack'
-	"${TESTSTATE}empty" aptkey list
-
-	msgtest 'Test key removal with' 'lowercase key ID' #keylength somewhere between 8byte and short
-	cleanplate
-	cp -a "${KEYDIR}/joesixpack.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	${TESTSTATE} --nomsg aptkey --fakeroot del d141dbac8dae
-	"${TESTSTATE}empty" aptkey list
-
-	if [ "$(id -u)" != '0' ]; then
-		msgtest 'Test key removal with' 'unreadable key'
-		cleanplate
-		cp -a "${KEYDIR}/joesixpack.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-		echo 'foobar' > "${ROOTDIR}/etc/apt/trusted.gpg.d/unreadablekey.${EXT}"
-		chmod 000 "${ROOTDIR}/etc/apt/trusted.gpg.d/unreadablekey.${EXT}"
-		testwarning --nomsg aptkey --fakeroot del d141dbac8dae
-		testwarning aptkey list
-		chmod 644 "${ROOTDIR}/etc/apt/trusted.gpg.d/unreadablekey.${EXT}"
-		rm -f "${ROOTDIR}/etc/apt/trusted.gpg.d/unreadablekey.${EXT}"
-		grep -v '^W: ' "${ROOTDIR}/tmp/testwarning.output" > "${ROOTDIR}/aptkeylist.output" || true
-		testempty cat "${ROOTDIR}/aptkeylist.output"
-	fi
-
-	msgtest 'Test key removal with' 'single key in real file'
-	cleanplate
-	cp -a "${KEYDIR}/joesixpack.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	${TESTSTATE} --nomsg aptkey --fakeroot del DBAC8DAE
-	"${TESTSTATE}empty" aptkey list
-	testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	testsuccess cmp "${KEYDIR}/joesixpack.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}~"
-
-	msgtest 'Test key removal with' 'different key specs'
-	cleanplate
-	cp -a "${KEYDIR}/joesixpack.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	cp -a "${KEYDIR}/marvinparanoid.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/marvinparanoid.${EXT}"
-	${TESTSTATE} --nomsg aptkey --fakeroot del 0xDBAC8DAE 528144E2
-	"${TESTSTATE}empty" aptkey list
-	testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	testsuccess cmp "${KEYDIR}/joesixpack.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}~"
-	testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg.d/marvinparanoid.${EXT}"
-	testsuccess cmp "${KEYDIR}/marvinparanoid.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/marvinparanoid.${EXT}~"
-
-	msgtest 'Test key removal with' 'long key ID'
-	cleanplate
-	cp -a "${KEYDIR}/joesixpack.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	${TESTSTATE} --nomsg aptkey --fakeroot del 5A90D141DBAC8DAE
-	"${TESTSTATE}empty" aptkey list
-	testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	testsuccess cmp "${KEYDIR}/joesixpack.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}~"
-
-	msgtest 'Test key removal with' 'fingerprint'
-	cleanplate
-	cp -a "${KEYDIR}/joesixpack.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	${TESTSTATE} --nomsg aptkey --fakeroot del 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE
-	"${TESTSTATE}empty" aptkey list
-	testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	testsuccess cmp "${KEYDIR}/joesixpack.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}~"
-
-	msgtest 'Test key removal with' 'spaced fingerprint'
-	cleanplate
-	cp -a "${KEYDIR}/joesixpack.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	${TESTSTATE} --nomsg aptkey --fakeroot del '34A8 E9D1 8DB3 20F3 67E8 EAA0 5A90 D141 DBAC 8DAE'
-	"${TESTSTATE}empty" aptkey list
-	testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	testsuccess cmp "${KEYDIR}/joesixpack.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}~"
-
-	msgtest 'Test key removal with' 'single key in softlink'
-	cleanplate
-	ln -sf "$(readlink -f "${KEYDIR}/joesixpack.pub.${EXT}")" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	${TESTSTATE} --nomsg aptkey --fakeroot del DBAC8DAE
-	"${TESTSTATE}empty" aptkey list
-	testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	testsuccess test -L "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}~"
-
-	cleanplate
-	${TESTSTATE} aptkey --fakeroot add "${KEYDIR}/joesixpack.pub.${EXT}"
-	ln -sf "$(readlink -f "${KEYDIR}/marvinparanoid.pub.${EXT}")" "${KEYDIR}/marvin paránöid.pub.${EXT}"
-	${TESTSTATE} aptkey --fakeroot add "${KEYDIR}/marvin paránöid.pub.${EXT}"
-	testaptkeys 'Joe Sixpack' 'Marvin Paranoid'
-	cp -a "${ROOTDIR}/etc/apt/trusted.gpg" "${KEYDIR}/testcase-multikey.pub.gpg" # store for reuse
-	aptkey --keyring "${KEYDIR}/testcase-multikey.pub.gpg" export > "${KEYDIR}/testcase-multikey.pub.asc"
-
-	msgtest 'Test key removal with' 'multi key in real file'
-	cleanplate
-	cp -a "${KEYDIR}/testcase-multikey.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.${EXT}"
-	${TESTSTATE} --nomsg aptkey --fakeroot del DBAC8DAE
-	testaptkeys 'Marvin Paranoid'
-	testsuccess cmp "${KEYDIR}/testcase-multikey.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.${EXT}~"
-
-	msgtest 'Test key removal with' 'multi key in softlink'
-	cleanplate
-	ln -s "$(readlink -f "${KEYDIR}/testcase-multikey.pub.${EXT}")" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.${EXT}"
-	${TESTSTATE} --nomsg aptkey --fakeroot del DBAC8DAE
-	testaptkeys 'Marvin Paranoid'
-	testsuccess cmp "${KEYDIR}/testcase-multikey.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.${EXT}~"
-	testfailure test -L "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.${EXT}"
-	testsuccess test -L "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.${EXT}~"
-
-	msgtest 'Test key removal with' 'multiple files including key'
-	cleanplate
-	cp -a "${KEYDIR}/joesixpack.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	cp -a "${KEYDIR}/testcase-multikey.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.${EXT}"
-	${TESTSTATE} --nomsg aptkey --fakeroot del DBAC8DAE
-	testaptkeys 'Marvin Paranoid'
-	testfailure test -e "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	testsuccess cmp "${KEYDIR}/joesixpack.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}~"
-	testsuccess cmp "${KEYDIR}/testcase-multikey.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.${EXT}~"
-
-	cleanplate
-	cp -a "${KEYDIR}/joesixpack.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	cp -a "${KEYDIR}/testcase-multikey.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.${EXT}"
-	testaptkeys 'Joe Sixpack' 'Joe Sixpack' 'Marvin Paranoid'
-	msgtest 'Test merge-back of' 'added keys'
-	${TESTSTATE} --nomsg aptkey adv --batch --yes --import "${KEYDIR}/rexexpired.pub.${EXT}"
-	testaptkeys 'Rex Expired' 'Joe Sixpack' 'Joe Sixpack' 'Marvin Paranoid'
-
-	msgtest 'Test merge-back of' 'removed keys'
-	${TESTSTATE} --nomsg aptkey adv --batch --yes --delete-keys 27CE74F9
-	testaptkeys 'Joe Sixpack' 'Joe Sixpack' 'Marvin Paranoid'
-
-	msgtest 'Test merge-back of' 'removed duplicate keys'
-	${TESTSTATE} --nomsg aptkey adv --batch --yes --delete-keys DBAC8DAE
-	testaptkeys 'Marvin Paranoid'
-
-	cleanplate
-	cp -a "${KEYDIR}/joesixpack.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/joesixpack.${EXT}"
-	cp -a "${KEYDIR}/testcase-multikey.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.${EXT}"
-	local SIGNATURE="${TMPWORKINGDIRECTORY}/signature"
-	msgtest 'Test signing a file' 'with a key'
-	echo 'Verify me. This is my signature.' > "$SIGNATURE"
-	echo 'lalalalala' > "${SIGNATURE}2"
-	testsuccess --nomsg aptkey --quiet --keyring "${KEYDIR}/marvinparanoid.pub.gpg" --secret-keyring "${KEYDIR}/marvinparanoid.sec" --readonly \
-		adv --batch --yes --default-key 'Marvin' --armor --detach-sign --sign --output "${SIGNATURE}.gpg" "${SIGNATURE}"
-	testsuccess test -s "${SIGNATURE}.gpg" -a -s "${SIGNATURE}"
-
-	msgtest 'Test verify a file' 'with no sig'
-	testfailure --nomsg aptkey --quiet --readonly --keyring "${KEYDIR}/testcase-multikey.pub.${EXT}" verify "${SIGNATURE}" "${SIGNATURE}2"
-
-	for GPGV in '' 'gpgv' 'gpgv1' 'gpgv2' 'gpgv-sq' 'gpgv-g10code'; do
-		echo "APT::Key::GPGVCommand \"$GPGV\";" > "${ROOTDIR}/etc/apt/apt.conf.d/00gpgvcmd"
-		if [ -n "$GPGV" ] && ! command dpkg -l gnupg1 2>&1 | grep -q '^ii'; then continue; fi
-
-		msgtest 'Test verify a file' 'with all keys'
-		${TESTSTATE} --nomsg aptkey --quiet --readonly verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-
-		if [ "$(id -u)" != '0' ]; then
-			msgtest 'Test verify a file' 'with unreadable key'
-			echo 'foobar' > "${ROOTDIR}/etc/apt/trusted.gpg.d/unreadablekey.${EXT}"
-			chmod 000 "${ROOTDIR}/etc/apt/trusted.gpg.d/unreadablekey.${EXT}"
-			testwarning --nomsg aptkey --quiet --readonly verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-			testwarning aptkey list
-			# check that apt users see warnings, too
-			rm -rf "${ROOTDIR}/var/lib/apt/lists"
-			testwarning apt update
-
-			chmod 644 "${ROOTDIR}/etc/apt/trusted.gpg.d/unreadablekey.${EXT}"
-			rm -f "${ROOTDIR}/etc/apt/trusted.gpg.d/unreadablekey.${EXT}"
-		fi
-
-		msgtest 'Test verify a file' 'with good keyring'
-		testsuccess --nomsg aptkey --quiet --readonly --keyring "${KEYDIR}/testcase-multikey.pub.${EXT}" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-
-		msgtest 'Test verify a file' 'with good keyrings 1'
-		testsuccess --nomsg aptkey --quiet --readonly --keyring "${KEYDIR}/joesixpack.pub.${EXT}" \
-			--keyring "${KEYDIR}/marvinparanoid.pub.${EXT}" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-
-		msgtest 'Test verify a file' 'with good keyrings 2'
-		testsuccess --nomsg aptkey --quiet --readonly --keyring "${KEYDIR}/marvinparanoid.pub.${EXT}" \
-			--keyring "${KEYDIR}/joesixpack.pub.${EXT}" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-
-		msgtest 'Test fail verify a file' 'with bad keyring'
-		testfailure --nomsg aptkey --quiet --readonly --keyring "${KEYDIR}/joesixpack.pub.${EXT}" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-
-		msgtest 'Test fail verify a file' 'with non-existing keyring'
-		testfailure --nomsg aptkey --quiet --readonly --keyring "${KEYDIR}/does-not-exist.pub.${EXT}" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-		testfailure test -e "${KEYDIR}/does-not-exist.pub.${EXT}"
-
-		# note: this isn't how apts gpgv method implements keyid for verify
-		msgtest 'Test verify a file' 'with good keyid'
-		${TESTSTATE} --nomsg aptkey --quiet --readonly --keyid 'Paranoid' verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-
-		msgtest 'Test fail verify a file' 'with bad keyid'
-		testfailure --nomsg aptkey --quiet --readonly --keyid 'Sixpack' verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-
-		msgtest 'Test fail verify a file' 'with non-existing keyid'
-		testfailure --nomsg aptkey --quiet --readonly --keyid 'Kalnischkies' verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-
-		msgtest 'Test verify fails on' 'bad file'
-		testfailure --nomsg aptkey --quiet --readonly verify "${SIGNATURE}.gpg" "${SIGNATURE}2"
-
-		# try to perform an entire update with this gpgv
-		rm -rf "${ROOTDIR}/var/lib/apt/lists"
-		${TESTSTATE} apt update -o Test::Dir="${ROOTDIR}"
-	done
-	rm -f "${ROOTDIR}/etc/apt/apt.conf.d/00gpgvcmd"
-
-	msgtest 'Test verify a file' 'with good keyring'
-	testsuccess --nomsg aptkey --quiet --readonly --keyring "${KEYDIR}/testcase-multikey.pub.${EXT}" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-
-	cleanplate
-	cat "${KEYDIR}/joesixpack.pub.gpg" "${KEYDIR}/marvinparanoid.pub.gpg" > "${KEYDIR}/double.pub.gpg"
-	cat "${KEYDIR}/joesixpack.pub.asc" "${KEYDIR}/marvinparanoid.pub.asc" > "${KEYDIR}/double.pub.asc"
-	cat "${KEYDIR}/joesixpack.sec" "${KEYDIR}/marvinparanoid.sec" > "${KEYDIR}/double.sec"
-	cp -a "${KEYDIR}/double.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/double.${EXT}"
-	cp -a "${KEYDIR}/testcase-multikey.pub.${EXT}" "${ROOTDIR}/etc/apt/trusted.gpg.d/multikey.${EXT}"
-	rm -f "${SIGNATURE}.gpg"
-	testsuccess aptkey --quiet --keyring "${KEYDIR}/double.pub.gpg" --secret-keyring "${KEYDIR}/double.sec" --readonly \
-		adv --batch --yes -u 'Marvin' -u 'Joe' --armor --detach-sign --sign --output "${SIGNATURE}.gpg" "${SIGNATURE}"
-	testsuccess test -s "${SIGNATURE}.gpg" -a -s "${SIGNATURE}"
-
-	for GPGV in '' 'gpgv' 'gpgv1' 'gpgv2' 'gpgv-sq' 'gpgv-g10code'; do
-		echo "APT::Key::GPGVCommand \"$GPGV\";" > "${ROOTDIR}/etc/apt/apt.conf.d/00gpgvcmd"
-		if [ -n "$GPGV" ] && ! command dpkg -l gnupg1 2>&1 | grep -q '^ii'; then continue; fi
-
-		msgtest 'Test verify a doublesigned file' 'with all keys'
-		${TESTSTATE} --nomsg aptkey --quiet --readonly verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-
-		msgtest 'Test verify a doublesigned file' 'with good keyring joe'
-		testmultigpg --keyring "${KEYDIR}/joesixpack.pub.${EXT}" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-
-		msgtest 'Test verify a doublesigned file' 'with good keyring marvin'
-		testmultigpg --keyring "${KEYDIR}/marvinparanoid.pub.${EXT}" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-
-		msgtest 'Test fail verify a doublesigned file' 'with bad keyring'
-		testfailure --nomsg aptkey --quiet --readonly --keyring "${KEYDIR}/rexexpired.pub.${EXT}" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-
-		msgtest 'Test fail verify a doublesigned file' 'with non-existing keyring'
-		testfailure --nomsg aptkey --quiet --readonly --keyring "${KEYDIR}/does-not-exist.pub.${EXT}" verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-		testfailure test -e "${KEYDIR}/does-not-exist.pub.${EXT}"
-
-		# note: this isn't how apts gpgv method implements keyid for verify
-		msgtest 'Test verify a doublesigned file' 'with good keyid'
-		testmultigpg --keyid 'Paranoid' verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-
-		msgtest 'Test fail verify a doublesigned file' 'with bad keyid'
-		testfailure --nomsg aptkey --quiet --readonly --keyid 'Rex' verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-
-		msgtest 'Test fail verify a doublesigned file' 'with non-existing keyid'
-		testfailure --nomsg aptkey --quiet --readonly --keyid 'Kalnischkies' verify "${SIGNATURE}.gpg" "${SIGNATURE}"
-
-		msgtest 'Test verify fails on' 'bad doublesigned file'
-		testfailure --nomsg aptkey --quiet --readonly verify "${SIGNATURE}.gpg" "${SIGNATURE}2"
-	done
-	rm -f "${ROOTDIR}/etc/apt/apt.conf.d/00gpgvcmd"
-}
-
-setupgpgcommand() {
-	local GPGEXE;
-	if command dpkg -l gnupg1 2>&1 | grep -q '^ii'; then
-		if [ "$1" = '1' ]; then
-			GPGEXE='gpg1'
-		else
-			GPGEXE='gpg'
-		fi
-	else
-		if [ "$1" = '1' ]; then
-			GPGEXE='gpg'
-		else
-			GPGEXE='gpg2'
-		fi
-	fi
-	msgmsg 'Force tests to be run with' "$GPGEXE"
-	echo "APT::Key::GPGCommand \"$GPGEXE\";" > "${ROOTDIR}/etc/apt/apt.conf.d/00gpgcmd"
-	testsuccess aptkey --readonly adv --version
-	cp "${ROOTDIR}/tmp/testsuccess.output" "${TMPWORKINGDIRECTORY}/aptkey.version"
-	testsuccess grep "^gpg (GnuPG) $1\." "${TMPWORKINGDIRECTORY}/aptkey.version"
-}
-
-(cd /; find "${TMPWORKINGDIRECTORY}/keys" -name '*.pub' -type f) | while read trusted; do
-	testsuccess aptkey --keyring "$trusted" adv --armor --export --output "${trusted}.asc"
-	cp -a "$trusted" "${trusted}.gpg"
-done
-
-# run with default (whatever this is) in current CWD with relative paths
-ROOTDIR="./rootdir"
-KEYDIR="./keys"
-testrun
-
-# run with … and up the game with a strange CWD & absolute paths
-ROOTDIR="${TMPWORKINGDIRECTORY}/rootdir"
-KEYDIR="${TMPWORKINGDIRECTORY}/keys"
-mkdir inaccessible
-cd inaccessible
-chmod 600 ../inaccessible
-testfilestats "${TMPWORKINGDIRECTORY}/inaccessible" '%a' '=' '600'
-
-setupgpgcommand '1'
-testrun
-setupgpgcommand '2'
-testrun
-
-msgmsg 'Tests to be run with' 'asc files'
-rm -f "${ROOTDIR}/etc/apt/apt.conf.d/00gpgcmd"
-testrun 'asc'
-
-msgmsg 'Tests to be run with' 'bad files'
-# don't let the plate be so clean anymore
-cleanplate() {
-	rm -rf "${ROOTDIR}/etc/apt/trusted.gpg.d/" "${ROOTDIR}/etc/apt/trusted.gpg"
-	mkdir "${ROOTDIR}/etc/apt/trusted.gpg.d/"
-	touch "${ROOTDIR}/etc/apt/trusted.gpg.d/emptyfile.gpg"
-	touch "${ROOTDIR}/etc/apt/trusted.gpg.d/emptyfile.asc"
-	echo 'broken' > "${ROOTDIR}/etc/apt/trusted.gpg.d/brokenfile.gpg"
-	echo 'broken' > "${ROOTDIR}/etc/apt/trusted.gpg.d/brokenfile.asc"
-}
-testrun 'gpg' 'testwarning'
diff --git a/test/integration/test-apt-key-net-update b/test/integration/test-apt-key-net-update
deleted file mode 100755
index b9f716e10..000000000
--- a/test/integration/test-apt-key-net-update
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/bin/sh
-set -e
-
-TESTDIR="$(readlink -f "$(dirname "$0")")"
-. "$TESTDIR/framework"
-
-setupenvironment
-configarchitecture "i386"
-changetowebserver
-
-# setup env
-mkdir -p var/lib/apt/keyrings
-mkdir -p usr/share/keyrings
-
-# install the fake master keyring
-install -m0644 keys/test-master-keyring.pub usr/share/keyrings
-echo "APT::Key::MasterKeyring \"${TMPWORKINGDIRECTORY}/usr/share/keyrings/test-master-keyring.pub\";" >> ./aptconfig.conf
-
-# setup archive-keyring
-mkdir -p aptarchive/ubuntu/project
-install -m0644 keys/test-archive-keyring.pub aptarchive/ubuntu/project/
-echo "APT::Key::ArchiveKeyringURI \"http://localhost:${APTHTTPPORT}/ubuntu/project/test-archive-keyring.pub\";" >> ./aptconfig.conf
-echo 'APT::Key::Net-Update-Enabled "1";' >> ./aptconfig.conf
-
-# test against the "real" webserver
-testsuccess aptkey --fakeroot net-update
-testfailure grep 'not added' rootdir/tmp/testsuccess.output
-testaptkeys 'oldarchive' 'newarchive'
-
-# now try a different one
-# setup archive-keyring
-mkdir -p aptarchive/ubuntu/project
-install -m0644 keys/marvinparanoid.pub aptarchive/ubuntu/project/
-echo "APT::Key::ArchiveKeyringURI \"http://localhost:${APTHTTPPORT}/ubuntu/project/marvinparanoid.pub\";" >> ./aptconfig.conf
-echo 'APT::Key::Net-Update-Enabled "1";' >> ./aptconfig.conf
-
-# test against the "real" webserver
-testsuccessequal "Checking for new archive signing keys now
-Key 'DE66AECA9151AFA1877EC31DE8525D47528144E2' not added. It is not signed with a master key" aptkey --fakeroot net-update
-
-testaptkeys 'oldarchive' 'newarchive'
diff --git a/test/integration/test-bug-733028-gpg-resource-limit b/test/integration/test-bug-733028-gpg-resource-limit
index b44facda3..2fc5ed3ee 100755
--- a/test/integration/test-bug-733028-gpg-resource-limit
+++ b/test/integration/test-bug-733028-gpg-resource-limit
@@ -13,7 +13,6 @@ setupaptarchive --no-update
 for i in $(seq 1 50); do
 	touch rootdir/etc/apt/trusted.gpg.d/emptykey-${i}.gpg
 done
-testaptkeys 'Joe Sixpack'
 
 testsuccess aptget update
 msgtest 'Test for no gpg errors/warnings in' 'apt-get update'
diff --git a/test/integration/test-bug-921685-binary-detached-signature b/test/integration/test-bug-921685-binary-detached-signature
index df863197a..e9bbb809b 100755
--- a/test/integration/test-bug-921685-binary-detached-signature
+++ b/test/integration/test-bug-921685-binary-detached-signature
@@ -13,10 +13,13 @@ setupdistsaptarchive
 
 for RELEASE in $(find aptarchive -name 'Release'); do
 	# note the missing --armor
-	dosigning "keys/joesixpack" --detach-sign --sign --output "${RELEASE}.gpg" "${RELEASE}"
+	if command sq --cli-version 0.40 version 2>/dev/null; then
+		sq sign --binary --signer-file "keys/joesixpack.sec" --output "${RELEASE}.gpg" --signature-file "${RELEASE}"
+	else
+		sq sign --binary --signer-file "keys/joesixpack.sec" --signature-file "${RELEASE}.gpg" "${RELEASE}"
+	fi
 done
 
 testfailure apt show foo
 testfailure aptget update
-testsuccess grep 'W: .* Detached signature file .* is in unsupported binary format' rootdir/tmp/testfailure.output
 testfailure apt show foo
diff --git a/test/integration/test-method-gpgv b/test/integration/test-method-gpgv
index 5ce685c8b..7d0d867fe 100755
--- a/test/integration/test-method-gpgv
+++ b/test/integration/test-method-gpgv
@@ -38,61 +38,113 @@ testgpgv() {
 testrun() {
 	testgpgv 'Good signed with long keyid' 'Good: GOODSIG 5A90D141DBAC8DAE' '34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE!' '[GNUPG:] GOODSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 [GNUPG:] VALIDSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 2016-09-01 1472742625 0 4 0 1 11 00 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE'
+	testsuccess grep '^201 URI Done$' method.output
 	testgpgv 'Good signed with fingerprint' 'Good: GOODSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE' '34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE!' '[GNUPG:] GOODSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 [GNUPG:] VALIDSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 2016-09-01 1472742625 0 4 0 1 11 00 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE'
+	testsuccess grep '^201 URI Done$' method.output
 
 	testgpgv 'Good signed with long keyid and asserted' 'Good: GOODSIG 5A90D141DBAC8DAE' '34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE!' '[GNUPG:] GOODSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 [GNUPG:] VALIDSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 2016-09-01 1472742625 0 4 0 1 11 00 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE
 [GNUPG:] ASSERT_PUBKEY_ALGO 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 1 rsa1024'
+	testsuccess grep '^201 URI Done$' method.output
 	testgpgv 'Good signed with fingerprint and asserted' 'Good: GOODSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE' '34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE!' '[GNUPG:] GOODSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 [GNUPG:] VALIDSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 2016-09-01 1472742625 0 4 0 1 11 00 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE
 [GNUPG:] ASSERT_PUBKEY_ALGO 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 1 rsa1024'
+	testsuccess grep '^201 URI Done$' method.output
 
 	testgpgv 'Not asserted in the next level' 'SoonWorthless: 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE, ' '34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE!' '[GNUPG:] GOODSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 [GNUPG:] VALIDSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 2016-09-01 1472742625 0 4 0 1 11 00 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE
 [GNUPG:] ASSERT_PUBKEY_ALGO 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 1 brainpoolP256r1'
+	testsuccess grep '^201 URI Done$' method.output
 
 	testgpgv 'Not asserted in the future level' 'LaterWorthless: 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE, ' '34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE!' '[GNUPG:] GOODSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 [GNUPG:] VALIDSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 2016-09-01 1472742625 0 4 0 1 11 00 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE
 [GNUPG:] ASSERT_PUBKEY_ALGO 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 1 nistp256'
+	testsuccess grep '^201 URI Done$' method.output
 
 	testgpgv 'Good subkey signed with long keyid' 'Good: GOODSIG 5B6896415D44C43E' '34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE, 4281DEDBD466EAE8C1F4157E5B6896415D44C43E!' '[GNUPG:] GOODSIG 5B6896415D44C43E Sebastian Subkey <subkey@example.org>
 [GNUPG:] VALIDSIG 4281DEDBD466EAE8C1F4157E5B6896415D44C43E 2018-08-16 1534459673 0 4 0 1 11 00 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE'
+	testsuccess grep '^201 URI Done$' method.output
 	testgpgv 'Good subkey signed with fingerprint' 'Good: GOODSIG 4281DEDBD466EAE8C1F4157E5B6896415D44C43E' '34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE, 4281DEDBD466EAE8C1F4157E5B6896415D44C43E!' '[GNUPG:] GOODSIG 4281DEDBD466EAE8C1F4157E5B6896415D44C43E Sebastian Subkey <subkey@example.org>
 [GNUPG:] VALIDSIG 4281DEDBD466EAE8C1F4157E5B6896415D44C43E 2018-08-16 1534459673 0 4 0 1 11 00 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE'
+	testsuccess grep '^201 URI Done$' method.output
 
 	testgpgv 'Untrusted signed with long keyid' 'Worthless: 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE, ' '' '[GNUPG:] GOODSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 [GNUPG:] VALIDSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 2016-09-01 1472742625 0 4 0 1 1 00 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE'
+	testsuccess grep '^400 URI Failure$' method.output
 	testsuccess grep '^\s\+Good:\s\+$' method.output
 	testgpgv 'Untrusted signed with fingerprint' 'Worthless: 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE, ' '' '[GNUPG:] GOODSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 [GNUPG:] VALIDSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 2016-09-01 1472742625 0 4 0 1 1 00 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE'
 	testsuccess grep '^\s\+Good:\s\+$' method.output
+	testsuccess grep '^400 URI Failure$' method.output
 
 	testgpgv 'Unasserted signed with long keyid' 'Worthless: 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE, ' '' '[GNUPG:] GOODSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 [GNUPG:] VALIDSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 2016-09-01 1472742625 0 4 0 1 11 00 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE
 [GNUPG:] ASSERT_PUBKEY_ALGO 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 0 rsa1024'
 	testsuccess grep '^\s\+Good:\s\+$' method.output
+	testsuccess grep '^400 URI Failure$' method.output
 	testgpgv 'Unaserted signed with fingerprint' 'Worthless: 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE, ' '' '[GNUPG:] GOODSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 [GNUPG:] VALIDSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 2016-09-01 1472742625 0 4 0 1 11 00 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE
 [GNUPG:] ASSERT_PUBKEY_ALGO 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 0 rsa1024'
 	testsuccess grep '^\s\+Good:\s\+$' method.output
+	testsuccess grep '^400 URI Failure$' method.output
 
 	testgpgv 'Weak signed with long keyid' 'Good: GOODSIG 5A90D141DBAC8DAE' '34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE!' '[GNUPG:] GOODSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 [GNUPG:] VALIDSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 2016-09-01 1472742625 0 4 0 1 2 00 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE'
 	testsuccess grep '^Message: Signature by key 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE uses weak algorithm (SHA1)$' method.output
+	testsuccess grep '^201 URI Done$' method.output
 	testgpgv 'Weak signed with fingerprint' 'Good: GOODSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE' '34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE!' '[GNUPG:] GOODSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
 [GNUPG:] VALIDSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 2016-09-01 1472742625 0 4 0 1 2 00 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE'
 	testsuccess grep '^Message: Signature by key 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE uses weak algorithm (SHA1)$' method.output
+	testsuccess grep '^201 URI Done$' method.output
 
 	testgpgv 'No Pubkey with long keyid' 'NoPubKey: NO_PUBKEY E8525D47528144E2' '' '[GNUPG:] ERRSIG E8525D47528144E2 1 11 00 1472744666 9
 [GNUPG:] NO_PUBKEY E8525D47528144E2'
+	testsuccess grep '^\s\+Good:\s\+$' method.output
+	testsuccess grep '^400 URI Failure$' method.output
+	testsuccess grep 'Message: .*public key is not available' method.output
 	testgpgv 'No Pubkey with fingerprint' 'NoPubKey: NO_PUBKEY DE66AECA9151AFA1877EC31DE8525D47528144E2' '' '[GNUPG:] ERRSIG DE66AECA9151AFA1877EC31DE8525D47528144E2 1 11 00 1472744666 9
 [GNUPG:] NO_PUBKEY DE66AECA9151AFA1877EC31DE8525D47528144E2'
+	testsuccess grep '^\s\+Good:\s\+$' method.output
+	testsuccess grep '^400 URI Failure$' method.output
+	testsuccess grep 'Message: .*public key is not available' method.output
 
 	testgpgv 'Expired key with long keyid' 'Worthless: EXPKEYSIG 4BC0A39C27CE74F9 Rex Expired <rex@example.org>, ' '' '[GNUPG:] EXPKEYSIG 4BC0A39C27CE74F9 Rex Expired <rex@example.org>
 [GNUPG:] VALIDSIG 891CC50E605796A0C6E733F74BC0A39C27CE74F9 2016-09-01 1472742629 0 4 0 1 11 00 891CC50E605796A0C6E733F74BC0A39C27CE74F9'
+	testsuccess grep '^\s\+Good:\s\+$' method.output
+	testsuccess grep '^400 URI Failure$' method.output
+	testsuccess grep 'Message: The following signatures were invalid: EXPKEYSIG' method.output
 	testgpgv 'Expired key with fingerprint' 'Worthless: EXPKEYSIG 891CC50E605796A0C6E733F74BC0A39C27CE74F9 Rex Expired <rex@example.org>, ' '' '[GNUPG:] EXPKEYSIG 891CC50E605796A0C6E733F74BC0A39C27CE74F9 Rex Expired <rex@example.org>
 [GNUPG:] VALIDSIG 891CC50E605796A0C6E733F74BC0A39C27CE74F9 2016-09-01 1472742629 0 4 0 1 11 00 891CC50E605796A0C6E733F74BC0A39C27CE74F9'
+	testsuccess grep '^\s\+Good:\s\+$' method.output
+	testsuccess grep '^400 URI Failure$' method.output
+	testsuccess grep 'Message: The following signatures were invalid: EXPKEYSIG' method.output
+
+	testgpgv 'Expired signature (gpgv-g10code)' 'Worthless: EXPSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>, ' '' '[GNUPG:] NEWSIG joe@example.org
+[GNUPG:] KEY_CONSIDERED 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 0
+[GNUPG:] SIG_ID pwbegSQxpqXn4lSZ1N4DLwyM4rc 2016-09-24 1474732092
+[GNUPG:] KEY_CONSIDERED 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 0
+[GNUPG:] EXPSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
+[GNUPG:] VALIDSIG 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 2016-09-24 1474732092 1491040800 4 0 1 11 00 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE'
+	testsuccess grep '^\s\+Good:\s\+$' method.output
+	testsuccess grep '^400 URI Failure$' method.output
+	testsuccess grep 'Message: The following signatures were invalid: EXPSIG' method.output
+
+	testgpgv 'Expired signature (gpgv-sq)' 'Bad: BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>' '' '[GNUPG:] NEWSIG joe@example.org
+[GNUPG:] KEY_CONSIDERED 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 0
+[GNUPG:] KEYEXPIRED 1491040800
+[GNUPG:] BADSIG 5A90D141DBAC8DAE Joe Sixpack (APT Testcases Dummy) <joe@example.org>
+'
+	testsuccess grep '^\s\+Good:\s\+$' method.output
+	testsuccess grep '^400 URI Failure$' method.output
+	testsuccess grep 'Message: The following signatures were invalid: BADSIG' method.output
+
+	testgpgv 'GPG-untrusted digest (MD5)' 'Worthless: ERRSIG 5A90D141DBAC8DAE, ' '' '[GNUPG:] NEWSIG joe@example.org
+[GNUPG:] KEY_CONSIDERED 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE 0
+[GNUPG:] ERRSIG 5A90D141DBAC8DAE 1 1 00 1734647007 5 34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE'
+	testsuccess grep '^\s\+Good:\s\+$' method.output
+	testsuccess grep '^400 URI Failure$' method.output
+	testsuccess grep 'Message: The following signatures were invalid: ERRSIG' method.output
 }
 
 echo 'Test' > message.data
diff --git a/test/integration/test-method-gpgv-legacy-keyring b/test/integration/test-method-gpgv-legacy-keyring
index 8afa5671b..cc7ddf097 100755
--- a/test/integration/test-method-gpgv-legacy-keyring
+++ b/test/integration/test-method-gpgv-legacy-keyring
@@ -12,8 +12,10 @@ insertpackage 'unstable' 'foo' 'all' '1'
 buildaptarchive
 setupaptarchive --no-update
 
-testsuccessequal "Get:1 file:${TMPWORKINGDIRECTORY}/aptarchive unstable InRelease [1420 B]
-Get:1 file:${TMPWORKINGDIRECTORY}/aptarchive unstable InRelease [1420 B]
+alias inrelease_size="stat -c %s aptarchive/dists/unstable/InRelease"
+
+testsuccessequal "Get:1 file:${TMPWORKINGDIRECTORY}/aptarchive unstable InRelease [$(inrelease_size) B]
+Get:1 file:${TMPWORKINGDIRECTORY}/aptarchive unstable InRelease [$(inrelease_size) B]
 Get:2 file:${TMPWORKINGDIRECTORY}/aptarchive unstable/main all Packages [246 B]
 Get:3 file:${TMPWORKINGDIRECTORY}/aptarchive unstable/main Translation-en [224 B]
 Reading package lists..." aptget update -q
@@ -21,15 +23,15 @@ Reading package lists..." aptget update -q
 cat rootdir/etc/apt/trusted.gpg.d/*.gpg > rootdir/etc/apt/trusted.gpg
 rm rootdir/etc/apt/trusted.gpg.d/*.gpg
 
-testwarningequal "Get:1 file:${TMPWORKINGDIRECTORY}/aptarchive unstable InRelease [1420 B]
-Get:1 file:${TMPWORKINGDIRECTORY}/aptarchive unstable InRelease [1420 B]
+testwarningequal "Get:1 file:${TMPWORKINGDIRECTORY}/aptarchive unstable InRelease [$(inrelease_size) B]
+Get:1 file:${TMPWORKINGDIRECTORY}/aptarchive unstable InRelease [$(inrelease_size) B]
 Reading package lists...
 W: file:${TMPWORKINGDIRECTORY}/aptarchive/dists/unstable/InRelease: Key is stored in legacy trusted.gpg keyring (${TMPWORKINGDIRECTORY}/rootdir/etc/apt/trusted.gpg). Use Signed-By instead. See the USER CONFIGURATION section in apt-secure(8) for details." aptget update -q
 
 # 2.4.0 regression: If the InRelease file was signed with two keys, fallback to trusted.gpg did not
 # work: It ran the fallback, but then ignored the result, as keys were still missing.
 signreleasefiles 'Joe Sixpack,Marvin Paranoid'
-testwarningequal "Get:1 file:${TMPWORKINGDIRECTORY}/aptarchive unstable InRelease [1867 B]
-Get:1 file:${TMPWORKINGDIRECTORY}/aptarchive unstable InRelease [1867 B]
+testwarningequal "Get:1 file:${TMPWORKINGDIRECTORY}/aptarchive unstable InRelease [$(inrelease_size) B]
+Get:1 file:${TMPWORKINGDIRECTORY}/aptarchive unstable InRelease [$(inrelease_size) B]
 Reading package lists...
 W: file:${TMPWORKINGDIRECTORY}/aptarchive/dists/unstable/InRelease: Key is stored in legacy trusted.gpg keyring (${TMPWORKINGDIRECTORY}/rootdir/etc/apt/trusted.gpg). Use Signed-By instead. See the USER CONFIGURATION section in apt-secure(8) for details." aptget update -q -omsg=with-two-signatures
diff --git a/test/integration/test-releasefile-verification b/test/integration/test-releasefile-verification
index 171792a10..1392a05d1 100755
--- a/test/integration/test-releasefile-verification
+++ b/test/integration/test-releasefile-verification
@@ -153,28 +153,6 @@ runtest() {
 	failaptold
 	rm -f rootdir/etc/apt/trusted.gpg.d/rexexpired.gpg
 
-	msgmsg 'Cold archive expired signed by' 'Joe Sixpack'
-	if dpkg --compare-versions "$(aptkey adv --version | head -n 2 | tail -n 1 | cut -d' ' -f 3)" '>=' '2.1' >/dev/null 2>&1; then
-		touch rootdir/etc/apt/apt.conf.d/99gnupg2
-	elif gpg2 --version >/dev/null 2>&1; then
-		echo 'Apt::Key::gpgcommand "gpg2";' > rootdir/etc/apt/apt.conf.d/99gnupg2
-		if ! dpkg --compare-versions "$(aptkey adv --version | head -n 2 | tail -n 1 | cut -d' ' -f 3)" '>=' '2.1' >/dev/null 2>&1; then
-			rm rootdir/etc/apt/apt.conf.d/99gnupg2
-		fi
-	fi
-	if [ -e rootdir/etc/apt/apt.conf.d/99gnupg2 ]; then
-		prepare "${PKGFILE}"
-		rm -rf rootdir/var/lib/apt/lists
-		signreleasefiles 'Joe Sixpack' 'aptarchive' --faked-system-time "20160924T154812" --default-sig-expire 2017-04-01
-		updatewithwarnings '^W: .* (BADSIG|EXPSIG)'
-		testsuccessequal "$(cat "${PKGFILE}")
-" aptcache show apt
-		failaptold
-		rm -f rootdir/etc/apt/apt.conf.d/99gnupg2
-	else
-		msgskip 'Not a new enough gpg available providing --fake-system-time'
-	fi
-
 	msgmsg 'Cold archive signed by' 'Joe Sixpack,Marvin Paranoid'
 	prepare "${PKGFILE}"
 	rm -rf rootdir/var/lib/apt/lists
@@ -282,7 +260,7 @@ runtest() {
 	installaptold
 	sed -i "s# \[signed-by=[^]]\+\] # #" rootdir/etc/apt/sources.list.d/*
 
-	local MARVIN="$(aptkey --keyring $MARVIN finger --with-colons | grep '^fpr' | cut -d':' -f 10)"
+	local MARVIN="DE66AECA9151AFA1877EC31DE8525D47528144E2"
 	msgmsg 'Cold archive signed by bad keyid' 'Joe Sixpack'
 	rm -rf rootdir/var/lib/apt/lists
 	signreleasefiles 'Joe Sixpack'
@@ -306,7 +284,7 @@ runtest() {
 " aptcache show apt
 	installaptold
 
-	local SIXPACK="$(aptkey --keyring keys/joesixpack.pub finger --with-colons | grep '^fpr' | cut -d':' -f 10)"
+	local SIXPACK="34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE"
 	msgmsg 'Cold archive signed by good keyids' 'Joe Sixpack'
 	rm -rf rootdir/var/lib/apt/lists
 	signreleasefiles 'Joe Sixpack'
@@ -376,7 +354,7 @@ Signed-By: ${MARVIN} ${MARVIN}, \\
 	installaptnew
 
 	cp -a keys/sebastiansubkey.pub rootdir/etc/apt/trusted.gpg.d/sebastiansubkey.gpg
-	local SEBASTIAN="$(aptkey --keyring keys/sebastiansubkey.pub finger --with-colons | grep -m 1 '^fpr' | cut -d':' -f 10)"
+	local SEBASTIAN="648E6A33FDE5CB5BA2D896A3CA3E1DFF1E6BE149"
 	msgmsg 'Warm archive with subkey signing' 'Sebastian Subkey'
 	rm -rf rootdir/var/lib/apt/lists
 	cp -a rootdir/var/lib/apt/lists-bak rootdir/var/lib/apt/lists
@@ -400,7 +378,7 @@ Signed-By: ${SEBASTIAN}!" rootdir/var/lib/apt/lists/*Release
 " aptcache show apt
 	installaptold
 
-	local SUBKEY="$(aptkey --keyring keys/sebastiansubkey.pub finger --with-colons | grep -m 2 '^fpr' | tail -n -1 | cut -d':' -f 10)"
+	local SUBKEY="4281DEDBD466EAE8C1F4157E5B6896415D44C43E"
 	msgmsg 'Warm archive with correct exact subkey signing' 'Sebastian Subkey'
 	rm -rf rootdir/var/lib/apt/lists
 	cp -a rootdir/var/lib/apt/lists-bak rootdir/var/lib/apt/lists
@@ -482,7 +460,7 @@ Acquire::AllowInsecureRepositories "1";
 Acquire::AllowDowngradeToInsecureRepositories "1";
 EOF
 # the hash marked as configurable in our gpgv method
-export APT_TESTS_DIGEST_ALGO='SHA224'
+export APT_TESTS_DIGEST_ALGO='SHA512'
 
 successfulaptgetupdate() {
 	testsuccess aptget update -o Debug::pkgAcquire::Worker=1 -o Debug::Acquire::gpgv=1
@@ -536,7 +514,3 @@ runfailure() {
 	done
 }
 foreachgpg runfailure
-
-msgmsg "Running test with gpgv-untrusted digest"
-export APT_TESTS_DIGEST_ALGO='MD5'
-foreachgpg runfailure
diff --git a/test/integration/test-releasefile-verification-noflat b/test/integration/test-releasefile-verification-noflat
index 3953c6492..d1b1d845f 100755
--- a/test/integration/test-releasefile-verification-noflat
+++ b/test/integration/test-releasefile-verification-noflat
@@ -12,7 +12,7 @@ insertpackage 'unstable' 'foo' 'i386' '1.0'
 setupaptarchive "now" "now + 1 year"
 changetowebserver
 
-SIXPACK="$(aptkey --keyring keys/joesixpack.pub finger | grep 'Key fingerprint' | cut -d'=' -f 2 | tr -d ' ')"
+SIXPACK="34A8E9D18DB320F367E8EAA05A90D141DBAC8DAE"
 
 testsuccess aptget update