From 5b63d2a9a2e088bb7df7c703e9452af7efc88210 Mon Sep 17 00:00:00 2001
From: Michael Vogt <michael.vogt@ubuntu.com>
Date: Wed, 8 May 2013 17:50:15 +0200
Subject: merged patch from Daniel Hartwig to fix URI and proxy releated issues

---
 test/integration/test-releasefile-verification | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'test/integration/test-releasefile-verification')

diff --git a/test/integration/test-releasefile-verification b/test/integration/test-releasefile-verification
index 01fb2e529..fba7ab290 100755
--- a/test/integration/test-releasefile-verification
+++ b/test/integration/test-releasefile-verification
@@ -37,7 +37,7 @@ The following NEW packages will be installed:
   apt
 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
 After this operation, 5370 kB of additional disk space will be used.
-Get:1 http://localhost/  apt 0.7.25.3
+Get:1 http://localhost:8080/  apt 0.7.25.3
 Download complete and in download only mode' aptget install apt -dy
 }
 
@@ -50,7 +50,7 @@ The following NEW packages will be installed:
   apt
 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
 After this operation, 5808 kB of additional disk space will be used.
-Get:1 http://localhost/  apt 0.8.0~pre1
+Get:1 http://localhost:8080/  apt 0.8.0~pre1
 Download complete and in download only mode' aptget install apt -dy
 }
 
-- 
cgit v1.2.3-70-g09d2


From e3c62328abbd548bb0da42fdbad954b3ce4f7102 Mon Sep 17 00:00:00 2001
From: David Kalnischkies <kalnischkies@gmail.com>
Date: Mon, 24 Jun 2013 16:34:38 +0200
Subject: simple fork and pidfile aptwebserver
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Forking only after being ready to accept clients avoids running races
with the tests which sometimes failed on the first 'apt-get update'
(or similar) with the previous background-start and hope for the best…

The commit fixes also some oversight output-order changes in regards to
Description-md5 and (I-M-S) race conditions in various tests.

Git-Dch: Ignore
---
 test/integration/Packages-pdiff-usage              |  2 ++
 test/integration/Packages-pdiff-usage-new          |  2 ++
 test/integration/Packages-releasefile-verification |  1 +
 .../Packages-releasefile-verification-new          |  1 +
 test/integration/framework                         | 18 ++++++++---
 .../test-bug-590041-prefer-non-virtual-packages    |  2 ++
 .../test-bug-601016-description-translation        | 31 +++++++++++-------
 .../test-cve-2013-1051-InRelease-parsing           |  2 +-
 test/integration/test-pdiff-usage                  |  2 +-
 test/integration/test-releasefile-verification     |  4 +--
 test/interactive-helper/aptwebserver.cc            | 37 ++++++++++++++++++++++
 11 files changed, 83 insertions(+), 19 deletions(-)

(limited to 'test/integration/test-releasefile-verification')

diff --git a/test/integration/Packages-pdiff-usage b/test/integration/Packages-pdiff-usage
index d1530a95c..ac962f29a 100644
--- a/test/integration/Packages-pdiff-usage
+++ b/test/integration/Packages-pdiff-usage
@@ -19,6 +19,7 @@ Description: Advanced front-end for dpkg
  .
  APT features complete installation ordering, multiple source capability
  and several other unique features, see the Users Guide in apt-doc.
+Description-md5: d41ee493aa9fcc6cbc9ce4eb7069959c
 
 Package: oldstuff
 Version: 1.0
@@ -32,3 +33,4 @@ SHA1: 3c695e028f74d5c544deeddaaa1242desa81088c
 SHA256: b46fd1546151c545fe4bfa56a5cc0e7deaef23e2da3e4f129727fd660f28f050
 Description: some cool but old stuff
  This package will disappear in the next mirror update
+Description-md5: 1948af60eda0a41dfa9fe83f60eb8389
diff --git a/test/integration/Packages-pdiff-usage-new b/test/integration/Packages-pdiff-usage-new
index 4f374b37f..f8d7b1958 100644
--- a/test/integration/Packages-pdiff-usage-new
+++ b/test/integration/Packages-pdiff-usage-new
@@ -22,6 +22,7 @@ Description: Advanced front-end for dpkg
  .
  APT features complete installation ordering, multiple source capability
  and several other unique features, see the Users Guide in apt-doc.
+Description-md5: d41ee493aa9fcc6cbc9ce4eb7069959c
 
 Package: newstuff
 Version: 1.0
@@ -35,3 +36,4 @@ SHA1: 3c695e028f7a1ae324deeddaaa1242desa81088c
 SHA256: b46fd154615edefab321cc56a5cc0e7deaef23e2da3e4f129727fd660f28f050
 Description: some cool and shiny new stuff
  This package will appear in the next mirror update
+Description-md5: d5f89fbbc2ac69c43d7e4c9b67d82b6b
diff --git a/test/integration/Packages-releasefile-verification b/test/integration/Packages-releasefile-verification
index 29a385f4f..eb7327279 100644
--- a/test/integration/Packages-releasefile-verification
+++ b/test/integration/Packages-releasefile-verification
@@ -16,3 +16,4 @@ Description: Advanced front-end for dpkg
  .
  APT features complete installation ordering, multiple source capability
  and several other unique features, see the Users Guide in apt-doc.
+Description-md5: d41ee493aa9fcc6cbc9ce4eb7069959c
diff --git a/test/integration/Packages-releasefile-verification-new b/test/integration/Packages-releasefile-verification-new
index e3b2edf1f..61509d157 100644
--- a/test/integration/Packages-releasefile-verification-new
+++ b/test/integration/Packages-releasefile-verification-new
@@ -19,3 +19,4 @@ Description: Advanced front-end for dpkg
  .
  APT features complete installation ordering, multiple source capability
  and several other unique features, see the Users Guide in apt-doc.
+Description-md5: d41ee493aa9fcc6cbc9ce4eb7069959c
diff --git a/test/integration/framework b/test/integration/framework
index 3a02cfb76..7dd7c20a7 100644
--- a/test/integration/framework
+++ b/test/integration/framework
@@ -605,9 +605,12 @@ buildaptarchivefromfiles() {
 		cat ${line} | bzip2 > ${line}.bz2
 		cat ${line} | xz --format=lzma > ${line}.lzma
 		cat ${line} | xz > ${line}.xz
+		if [ -n "$1" ]; then
+			touch -d "$1" ${line}.gz ${line}.bz2 ${line}.lzma ${line}.xz
+		fi
 		msgdone "info"
 	done
-	generatereleasefiles
+	generatereleasefiles "$@"
 }
 
 # can be overridden by testcases for their pleasure
@@ -719,7 +722,10 @@ signreleasefiles() {
 	done
 	for RELEASE in $(find aptarchive/ -name Release); do
 		gpg --yes --no-default-keyring $SECKEYS $PUBKEYS --default-key "$SIGNER" -abs -o ${RELEASE}.gpg ${RELEASE}
-		gpg --yes --no-default-keyring $SECKEYS $PUBKEYS --default-key "$SIGNER" --clearsign -o "$(echo "${RELEASE}" | sed 's#/Release$#/InRelease#')" $RELEASE
+		local INRELEASE="$(echo "${RELEASE}" | sed 's#/Release$#/InRelease#')"
+		gpg --yes --no-default-keyring $SECKEYS $PUBKEYS --default-key "$SIGNER" --clearsign -o $INRELEASE $RELEASE
+		# we might have set a specific date for the Release file, so copy it
+		touch -d "$(stat --format "%y" ${RELEASE})" ${RELEASE}.gpg ${INRELEASE}
 	done
 	msgdone "info"
 }
@@ -728,8 +734,12 @@ changetowebserver() {
 	local LOG='/dev/null'
 	if test -x ${BUILDDIRECTORY}/aptwebserver; then
 		cd aptarchive
-		LD_LIBRARY_PATH=${BUILDDIRECTORY} ${BUILDDIRECTORY}/aptwebserver "$@" >$LOG 2>&1 &
-		addtrap "kill $!;"
+		LD_LIBRARY_PATH=${BUILDDIRECTORY} ${BUILDDIRECTORY}/aptwebserver -o aptwebserver::fork=1 "$@" >$LOG 2>&1
+		local PID="$(cat aptwebserver.pid)"
+		if [ -z "$PID" ]; then
+			msgdie 'Could not fork aptwebserver successfully'
+		fi
+		addtrap "kill $PID;"
 		cd - > /dev/null
 	elif [ $# -gt 0 ]; then
 		msgdie 'Need the aptwebserver when passing arguments for the webserver'
diff --git a/test/integration/test-bug-590041-prefer-non-virtual-packages b/test/integration/test-bug-590041-prefer-non-virtual-packages
index e0dd7737f..0ce4c1413 100755
--- a/test/integration/test-bug-590041-prefer-non-virtual-packages
+++ b/test/integration/test-bug-590041-prefer-non-virtual-packages
@@ -9,6 +9,7 @@ pkglibc6="Package: libc6
 Architecture: armel
 Version: 2.11.2-2~0.3
 Description: Embedded GNU C Library: Shared libraries
+Description-md5: b8c1e0561b75e2dc6b6482a99079c3e4
 Filename: pool/main/e/eglibc/libc6_2.11.2-2_armel.deb
 Installed-Size: 9740
 MD5sum: f5b878ce5fb8aa01a7927fa1460df537
@@ -25,6 +26,7 @@ Architecture: i386
 Version: 2.1.3-13~0.3
 Replaces: libc6 (<< 2.2.5-13~0.3)
 Description: The Berkeley database routines [glibc 2.0/2.1 compatibility]
+Description-md5: de1876f7fe7f7709a110875e145e38a8
 Filename: pool/main/d/db1-compat/libdb1-compat_2.1.3-13_armel.deb
 Installed-Size: 136
 MD5sum: 4043f176ab2b40b0c01bc1211b8c103c
diff --git a/test/integration/test-bug-601016-description-translation b/test/integration/test-bug-601016-description-translation
index 03fddbfda..33c209e9d 100755
--- a/test/integration/test-bug-601016-description-translation
+++ b/test/integration/test-bug-601016-description-translation
@@ -9,8 +9,9 @@ configarchitecture 'i386' 'amd64'
 # we need a valid locale here, otherwise the language configuration
 # will be overridden by LC_ALL=C
 LOCALE="$(echo "$LANG" | cut -d'_' -f 1)"
+MD5Sum='Description-md5: d41ee493aa9fcc6cbc9ce4eb7069959c'
 
-PACKAGESTANZA="Package: apt
+PACKAGESTANZA='Package: apt
 Priority: important
 Section: admin
 Installed-Size: 5984
@@ -19,8 +20,7 @@ Architecture: i386
 Version: 0.8.7
 Filename: pool/main/a/apt/apt_0.8.7_i386.deb
 Size: 2140230
-MD5sum: 74769bfbcef9ebc4fa74f7a5271b9c08
-Description-md5: d41ee493aa9fcc6cbc9ce4eb7069959c"
+MD5sum: 74769bfbcef9ebc4fa74f7a5271b9c08'
 
 PACKAGESTANZA2='Package: apt
 Priority: important
@@ -31,22 +31,23 @@ Architecture: amd64
 Version: 0.8.7
 Filename: pool/main/a/apt/apt_0.8.7_amd64.deb
 Size: 2210342
-MD5sum: 4a869bfbdef9ebc9fa74f7a5271e8d1a
-Description-md5: d41ee493aa9fcc6cbc9ce4eb7069959c'
+MD5sum: 4a869bfbdef9ebc9fa74f7a5271e8d1a'
 
 echo "$PACKAGESTANZA
 Description: Advanced front-end for dpkg
+$MD5Sum
 
 $PACKAGESTANZA2
-Description: Advanced front-end for dpkg" > aptarchive/Packages
+Description: Advanced front-end for dpkg
+$MD5Sum" > aptarchive/Packages
 
 echo "Package: apt
-Description-md5: d41ee493aa9fcc6cbc9ce4eb7069959c
 Description-${LOCALE}: Mächtige Oberfläche für dpkg
  Das Paket bietet dem Nutzer technisch führende Methoden für den Zugriff
  auf den dpkg-Paketmanager. Es beinhaltet das apt-get-Werkzeug und die
  APT-Dselect-Methode. Beides sind einfache und sicherere Wege,
- um Pakete zu installieren und Upgrades durchzuführen." | bzip2 > aptarchive/${LOCALE}.bz2
+ um Pakete zu installieren und Upgrades durchzuführen.
+$MD5Sum" | bzip2 > aptarchive/${LOCALE}.bz2
 
 # the $LOCALE translation file will not be included as it is a flat archive it came from and therefore
 # its name can not be guessed correctly… (in non-flat archives the files are called Translation-*)
@@ -54,10 +55,12 @@ echo 'APT::Cache::Generate "false";' > rootdir/etc/apt/apt.conf.d/00nogenerate
 
 NOLONGSTANZA="$PACKAGESTANZA
 Description: Advanced front-end for dpkg
+$MD5Sum
 "
 
 ENGLISHSTANZA="$PACKAGESTANZA
 Description: Advanced front-end for dpkg
+$MD5Sum
 "
 
 LOCALESTANZA="$PACKAGESTANZA
@@ -66,6 +69,7 @@ Description-${LOCALE}: Mächtige Oberfläche für dpkg
  auf den dpkg-Paketmanager. Es beinhaltet das apt-get-Werkzeug und die
  APT-Dselect-Methode. Beides sind einfache und sicherere Wege,
  um Pakete zu installieren und Upgrades durchzuführen.
+$MD5Sum
 "
 LOCALESTANZA2="$PACKAGESTANZA2
 Description-${LOCALE}: Mächtige Oberfläche für dpkg
@@ -73,6 +77,7 @@ Description-${LOCALE}: Mächtige Oberfläche für dpkg
  auf den dpkg-Paketmanager. Es beinhaltet das apt-get-Werkzeug und die
  APT-Dselect-Methode. Beides sind einfache und sicherere Wege,
  um Pakete zu installieren und Upgrades durchzuführen.
+$MD5Sum
 "
 
 testrun() {
@@ -97,28 +102,32 @@ testrun
 
 echo "$PACKAGESTANZA
 Description: Advanced front-end for dpkg
+$MD5Sum
 
 $PACKAGESTANZA2
-Description: Advanced front-end for dpkg" > aptarchive/Packages
+Description: Advanced front-end for dpkg
+$MD5Sum" > aptarchive/Packages
 
 echo "Package: apt
-Description-md5: d41ee493aa9fcc6cbc9ce4eb7069959c
 Description-en: Advanced front-end for dpkg
  This is Debian's next generation front-end for the dpkg package manager.
  It provides the apt-get utility and APT dselect method that provides a
- simpler, safer way to install and upgrade packages." | bzip2 > aptarchive/en.bz2
+ simpler, safer way to install and upgrade packages.
+$MD5Sum" | bzip2 > aptarchive/en.bz2
 
 ENGLISHSTANZA="$PACKAGESTANZA
 Description-en: Advanced front-end for dpkg
  This is Debian's next generation front-end for the dpkg package manager.
  It provides the apt-get utility and APT dselect method that provides a
  simpler, safer way to install and upgrade packages.
+$MD5Sum
 "
 ENGLISHSTANZA2="$PACKAGESTANZA2
 Description-en: Advanced front-end for dpkg
  This is Debian's next generation front-end for the dpkg package manager.
  It provides the apt-get utility and APT dselect method that provides a
  simpler, safer way to install and upgrade packages.
+$MD5Sum
 "
 
 testrun
diff --git a/test/integration/test-cve-2013-1051-InRelease-parsing b/test/integration/test-cve-2013-1051-InRelease-parsing
index 853da5ff6..6764fefff 100755
--- a/test/integration/test-cve-2013-1051-InRelease-parsing
+++ b/test/integration/test-cve-2013-1051-InRelease-parsing
@@ -37,7 +37,7 @@ sed -i '/^-----BEGIN PGP SIGNATURE-----/,/^-----END PGP SIGNATURE-----/ s/^$/  /
 
 # we append the (evil unsigned) Release file to the (good signed) InRelease
 cat aptarchive/dists/stable/Release >> aptarchive/dists/stable/InRelease
-
+touch -d '+1hour' aptarchive/dists/stable/InRelease
 
 # ensure the update fails
 # useful for debugging to add "-o Debug::pkgAcquire::auth=true"
diff --git a/test/integration/test-pdiff-usage b/test/integration/test-pdiff-usage
index 29301d07d..e45326970 100755
--- a/test/integration/test-pdiff-usage
+++ b/test/integration/test-pdiff-usage
@@ -35,7 +35,7 @@ SHA1-History:
 SHA1-Patches:
  7651fc0ac57cd83d41c63195a9342e2db5650257 19722 2010-08-18-0814.28
  $(sha1sum $PATCHFILE | cut -d' ' -f 1) $(stat -c%s $PATCHFILE) $(basename $PATCHFILE)" > $PATCHINDEX
-generatereleasefiles
+generatereleasefiles '+1hour'
 signreleasefiles
 find aptarchive -name 'Packages*' -type f -delete
 aptget update -qq
diff --git a/test/integration/test-releasefile-verification b/test/integration/test-releasefile-verification
index fba7ab290..e56f458d3 100755
--- a/test/integration/test-releasefile-verification
+++ b/test/integration/test-releasefile-verification
@@ -184,5 +184,5 @@ runtest2
 
 DELETEFILE="InRelease"
 runtest
-#DELETEFILE="Release.gpg"
-#runtest
+DELETEFILE="Release.gpg"
+runtest
diff --git a/test/interactive-helper/aptwebserver.cc b/test/interactive-helper/aptwebserver.cc
index 05b875673..a8d191d0e 100644
--- a/test/interactive-helper/aptwebserver.cc
+++ b/test/interactive-helper/aptwebserver.cc
@@ -387,6 +387,41 @@ int main(int const argc, const char * argv[])
       return 2;
    }
 
+   FileFd pidfile;
+   if (_config->FindB("aptwebserver::fork", false) == true)
+   {
+      std::string const pidfilename = _config->Find("aptwebserver::pidfile", "aptwebserver.pid");
+      int const pidfilefd = GetLock(pidfilename);
+      if (pidfilefd < 0 || pidfile.OpenDescriptor(pidfilefd, FileFd::WriteOnly) == false)
+      {
+	 _error->Errno("aptwebserver", "Couldn't acquire lock on pidfile '%s'", pidfilename.c_str());
+	 _error->DumpErrors(std::cerr);
+	 return 3;
+      }
+
+      pid_t child = fork();
+      if (child < 0)
+      {
+	 _error->Errno("aptwebserver", "Forking failed");
+	 _error->DumpErrors(std::cerr);
+	 return 4;
+      }
+      else if (child != 0)
+      {
+	 // successfully forked: ready to serve!
+	 std::string pidcontent;
+	 strprintf(pidcontent, "%d", child);
+	 pidfile.Write(pidcontent.c_str(), pidcontent.size());
+	 if (_error->PendingError() == true)
+	 {
+	    _error->DumpErrors(std::cerr);
+	    return 5;
+	 }
+	 std::cout << "Successfully forked as " << child << std::endl;
+	 return 0;
+      }
+   }
+
    std::clog << "Serving ANY file on port: " << port << std::endl;
 
    listen(sock, 1);
@@ -502,5 +537,7 @@ int main(int const argc, const char * argv[])
 		<< " on socket " << sock << std::endl;
       close(client);
    }
+   pidfile.Close();
+
    return 0;
 }
-- 
cgit v1.2.3-70-g09d2


From 29a59c460403820d0f039398194e321b7e0921fc Mon Sep 17 00:00:00 2001
From: David Kalnischkies <kalnischkies@gmail.com>
Date: Fri, 9 Aug 2013 22:20:27 +0200
Subject: test Release file handling with expired keys

Signing files with expired keys is not as easy as it sounds, so the
framework jumps a few loops to do it, but it might come in handy to have
an expired key around for later tests even if it is not that different
from having no key in regards to APT behaviour.

Git-Dch: Ignore
---
 test/integration/framework                     |  35 ++++++++++++++++++++-----
 test/integration/rexexpired.pub                | Bin 0 -> 1200 bytes
 test/integration/rexexpired.sec                | Bin 0 -> 2502 bytes
 test/integration/test-releasefile-verification |  35 +++++++++++++++++++++++--
 4 files changed, 62 insertions(+), 8 deletions(-)
 create mode 100644 test/integration/rexexpired.pub
 create mode 100644 test/integration/rexexpired.sec

(limited to 'test/integration/test-releasefile-verification')

diff --git a/test/integration/framework b/test/integration/framework
index 7dd7c20a7..f64b8482c 100644
--- a/test/integration/framework
+++ b/test/integration/framework
@@ -711,22 +711,45 @@ setupaptarchive() {
 
 signreleasefiles() {
 	local SIGNER="${1:-Joe Sixpack}"
+	local GPG="gpg --batch --yes --no-default-keyring --trustdb-name rootdir/etc/apt/trustdb.gpg"
 	msgninfo "\tSign archive with $SIGNER key… "
-	local SECKEYS=""
+	local REXKEY='keys/rexexpired'
+	local SECEXPIREBAK="${REXKEY}.sec.bak"
+	local PUBEXPIREBAK="${REXKEY}.pub.bak"
+	if [ "${SIGNER}" = 'Rex Expired' ]; then
+		# the key is expired, so gpg doesn't allow to sign with and the --faked-system-time
+		# option doesn't exist anymore (and using faketime would add a new obscure dependency)
+		# therefore we 'temporary' make the key not expired and restore a backup after signing
+		cp ${REXKEY}.sec $SECEXPIREBAK
+		cp ${REXKEY}.pub $PUBEXPIREBAK
+		local SECUNEXPIRED="${REXKEY}.sec.unexpired"
+		local PUBUNEXPIRED="${REXKEY}.pub.unexpired"
+		if [ -f "$SECUNEXPIRED" ] && [ -f "$PUBUNEXPIRED" ]; then
+			cp $SECUNEXPIRED ${REXKEY}.sec
+			cp $PUBUNEXPIRED ${REXKEY}.pub
+		else
+			printf "expire\n1w\nsave\n" | $GPG --keyring ${REXKEY}.pub --secret-keyring ${REXKEY}.sec --command-fd 0 --edit-key "${SIGNER}" >/dev/null 2>&1 || true
+			cp ${REXKEY}.sec $SECUNEXPIRED
+			cp ${REXKEY}.pub $PUBUNEXPIRED
+		fi
+	fi
 	for KEY in $(find keys/ -name '*.sec'); do
-		SECKEYS="$SECKEYS --secret-keyring $KEY"
+		GPG="$GPG --secret-keyring $KEY"
 	done
-	local PUBKEYS=""
 	for KEY in $(find keys/ -name '*.pub'); do
-		PUBKEYS="$PUBKEYS --keyring $KEY"
+		GPG="$GPG --keyring $KEY"
 	done
 	for RELEASE in $(find aptarchive/ -name Release); do
-		gpg --yes --no-default-keyring $SECKEYS $PUBKEYS --default-key "$SIGNER" -abs -o ${RELEASE}.gpg ${RELEASE}
+		$GPG --default-key "$SIGNER" --armor --detach-sign --sign --output ${RELEASE}.gpg ${RELEASE}
 		local INRELEASE="$(echo "${RELEASE}" | sed 's#/Release$#/InRelease#')"
-		gpg --yes --no-default-keyring $SECKEYS $PUBKEYS --default-key "$SIGNER" --clearsign -o $INRELEASE $RELEASE
+		$GPG --default-key "$SIGNER" --clearsign --output $INRELEASE $RELEASE
 		# we might have set a specific date for the Release file, so copy it
 		touch -d "$(stat --format "%y" ${RELEASE})" ${RELEASE}.gpg ${INRELEASE}
 	done
+	if [ -f "$SECEXPIREBAK" ] && [ -f "$PUBEXPIREBAK" ]; then
+		mv -f $SECEXPIREBAK ${REXKEY}.sec
+		mv -f $PUBEXPIREBAK ${REXKEY}.pub
+	fi
 	msgdone "info"
 }
 
diff --git a/test/integration/rexexpired.pub b/test/integration/rexexpired.pub
new file mode 100644
index 000000000..5ab2e489a
Binary files /dev/null and b/test/integration/rexexpired.pub differ
diff --git a/test/integration/rexexpired.sec b/test/integration/rexexpired.sec
new file mode 100644
index 000000000..dc00168cd
Binary files /dev/null and b/test/integration/rexexpired.sec differ
diff --git a/test/integration/test-releasefile-verification b/test/integration/test-releasefile-verification
index e56f458d3..daba3919b 100755
--- a/test/integration/test-releasefile-verification
+++ b/test/integration/test-releasefile-verification
@@ -107,13 +107,24 @@ runtest() {
 " aptcache show apt
 	installaptnew
 
+	prepare ${PKGFILE}
+	rm -rf rootdir/var/lib/apt/lists
+	cp keys/rexexpired.pub rootdir/etc/apt/trusted.gpg.d/rexexpired.gpg
+	signreleasefiles 'Rex Expired'
+	find aptarchive/ -name "$DELETEFILE" -delete
+	msgtest 'Cold archive signed by' 'Rex Expired'
+	aptget update 2>&1 | grep -E '^W: .* KEYEXPIRED' > /dev/null && msgpass || msgfail
+	testequal "$(cat ${PKGFILE})
+" aptcache show apt
+	failaptold
+	rm rootdir/etc/apt/trusted.gpg.d/rexexpired.gpg
 
 	prepare ${PKGFILE}
 	rm -rf rootdir/var/lib/apt/lists
 	signreleasefiles 'Marvin Paranoid'
 	find aptarchive/ -name "$DELETEFILE" -delete
 	msgtest 'Cold archive signed by' 'Marvin Paranoid'
-	aptget update 2>&1 | grep -E '^(W|E): ' > /dev/null && msgpass || msgfail
+	aptget update 2>&1 | grep -E '^W: .* NO_PUBKEY' > /dev/null && msgpass || msgfail
 	testequal "$(cat ${PKGFILE})
 " aptcache show apt
 	failaptold
@@ -147,10 +158,30 @@ runtest() {
 	signreleasefiles 'Marvin Paranoid'
 	find aptarchive/ -name "$DELETEFILE" -delete
 	msgtest 'Good warm archive signed by' 'Marvin Paranoid'
-	aptget update 2>&1 | grep -E '^(W|E): ' > /dev/null && msgpass || msgfail
+	aptget update 2>&1 | grep -E '^W: .* NO_PUBKEY' > /dev/null && msgpass || msgfail
+	testequal "$(cat ${PKGFILE})
+" aptcache show apt
+	installaptold
+
+	prepare ${PKGFILE}-new
+	cp keys/rexexpired.pub rootdir/etc/apt/trusted.gpg.d/rexexpired.gpg
+	signreleasefiles 'Rex Expired'
+	find aptarchive/ -name "$DELETEFILE" -delete
+	msgtest 'Good warm archive signed by' 'Rex Expired'
+	aptget update 2>&1 | grep -E '^W: .* KEYEXPIRED' > /dev/null && msgpass || msgfail
 	testequal "$(cat ${PKGFILE})
 " aptcache show apt
 	installaptold
+	rm rootdir/etc/apt/trusted.gpg.d/rexexpired.gpg
+
+	prepare ${PKGFILE}-new
+	signreleasefiles
+	find aptarchive/ -name "$DELETEFILE" -delete
+	msgtest 'Good warm archive signed by' 'Joe Sixpack'
+	aptget update 2>&1 | grep -E '^(W|E): ' > /dev/null && msgfail || msgpass
+	testequal "$(cat ${PKGFILE}-new)
+" aptcache show apt
+	installaptnew
 }
 
 runtest2() {
-- 
cgit v1.2.3-70-g09d2