From 9d7a660611e9e134cd6d74a594bde59cad77c8d8 Mon Sep 17 00:00:00 2001 From: Julian Andres Klode Date: Mon, 27 Jan 2025 15:51:24 +0100 Subject: apt: Introduce the modernize-sources command This handles rewriting .list entries to .sources ones; the only options handled are - signed-by => Signed-By - trusted => Trusted The options to specify architectures, check-valid-until, etc. are not supported as they are not exposed in the code. We probably should refactor the parser at some point so we can actually read the parsed entry rather than the abstract objects we create from it. This can be improved further: - Keyrings from /etc/apt/trusted.gpg.d should be moved to /etc/apt/keyrings. - automatic detection by trying to verify using each keyring in trusted.gpg.d until we find the right one and then using that for Signed-By rather than leave some sources empty. --- test/integration/test-apt-modernize-sources | 85 +++++++++++++++++++++++++++++ 1 file changed, 85 insertions(+) create mode 100755 test/integration/test-apt-modernize-sources (limited to 'test') diff --git a/test/integration/test-apt-modernize-sources b/test/integration/test-apt-modernize-sources new file mode 100755 index 000000000..26fd8055a --- /dev/null +++ b/test/integration/test-apt-modernize-sources @@ -0,0 +1,85 @@ +#!/bin/sh +set -e + +TESTDIR="$(readlink -f "$(dirname "$0")")" +. "$TESTDIR/framework" + +setupenvironment +configarchitecture 'native' + +echo 'deb http://example.org/debian stable rocks' > rootdir/etc/apt/sources.list.d/rocks.list +echo 'deb http://deb.debian.org/debian stable main' >> rootdir/etc/apt/sources.list +echo 'deb-src http://deb.debian.org/debian stable main' >> rootdir/etc/apt/sources.list +echo 'deb-src http://deb.debian.org/debian unstable main' >> rootdir/etc/apt/sources.list +echo 'deb http://example.org/debian stable bananas' >> rootdir/etc/apt/sources.list +echo 'deb [trusted=yes] http://example.org/debian trusted bananas' >> rootdir/etc/apt/sources.list + + +mkdir -p rootdir/usr/share/keyrings/ +mkdir -p rootdir/var/lib/apt/lists +echo > rootdir/etc/apt/trusted.gpg.d/rocks.gpg +echo > rootdir/usr/share/keyrings/debian-archive-keyring.gpg +echo "Date: $(date -ud '-2 weeks' '+%a, %d %b %Y %H:%M:%S %Z')" > rootdir/var/lib/apt/lists/deb.debian.org_debian_dists_unstable_InRelease +echo "Date: $(date -ud '-2 weeks' '+%a, %d %b %Y %H:%M:%S %Z')" > rootdir/var/lib/apt/lists/deb.debian.org_debian_dists_stable_InRelease +echo "Origin: Debian" >> rootdir/var/lib/apt/lists/deb.debian.org_debian_dists_unstable_InRelease +echo "Origin: Debian" >> rootdir/var/lib/apt/lists/deb.debian.org_debian_dists_stable_InRelease + +# We test that appending produces valid output here, so we already configure a source in here. +echo "Types: deb" >> rootdir/etc/apt/sources.list.d/debian.sources +echo "URIs: https://deb.debian.org/debian/" >> rootdir/etc/apt/sources.list.d/debian.sources +echo "Suites: experimental" >> rootdir/etc/apt/sources.list.d/debian.sources +echo "Components: contrib" >> rootdir/etc/apt/sources.list.d/debian.sources +echo "Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg" >> rootdir/etc/apt/sources.list.d/debian.sources + +testwarning apt modernize-sources -y + +testsuccessequal "rootdir/etc/apt/sources.list.bak + +rootdir/etc/apt/sources.list.d: +debian.sources +moved-from-main.sources +rocks.list.bak +rocks.sources" ls -1 rootdir/etc/apt/sources.list* + +testfileequal rootdir/etc/apt/sources.list.d/debian.sources "Types: deb +URIs: https://deb.debian.org/debian/ +Suites: experimental +Components: contrib +Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg + +# Modernized from ${TMPWORKINGDIRECTORY}/rootdir/etc/apt/sources.list +Types: deb deb-src +URIs: http://deb.debian.org/debian/ +Suites: stable +Components: main +Signed-By: ${TMPWORKINGDIRECTORY}/rootdir/usr/share/keyrings/debian-archive-keyring.gpg + +# Modernized from ${TMPWORKINGDIRECTORY}/rootdir/etc/apt/sources.list +Types: deb-src +URIs: http://deb.debian.org/debian/ +Suites: unstable +Components: main +Signed-By: ${TMPWORKINGDIRECTORY}/rootdir/usr/share/keyrings/debian-archive-keyring.gpg" + +testfileequal rootdir/etc/apt/sources.list.d/rocks.sources "Types: deb +URIs: http://example.org/debian/ +Suites: stable +Components: rocks +Signed-By: ${TMPWORKINGDIRECTORY}/rootdir/etc/apt/trusted.gpg.d/rocks.gpg" + +testfileequal rootdir/etc/apt/sources.list.d/moved-from-main.sources "# Modernized from ${TMPWORKINGDIRECTORY}/rootdir/etc/apt/sources.list +Types: deb +URIs: http://example.org/debian/ +Suites: stable +Components: bananas +Signed-By: + +# Modernized from ${TMPWORKINGDIRECTORY}/rootdir/etc/apt/sources.list +Types: deb +URIs: http://example.org/debian/ +Suites: trusted +Components: bananas +Signed-By: +Trusted: yes" + +testsuccessequal "All sources are modern." apt modernize-sources -- cgit v1.2.3-70-g09d2 From 4059a1544323b945a81e5ef0faea4a3b109f36bf Mon Sep 17 00:00:00 2001 From: Julian Andres Klode Date: Mon, 27 Jan 2025 17:34:45 +0100 Subject: Make notices about .list sources without signed-by less obnoxious --- apt-private/private-update.cc | 41 +++++++++++++++------- .../test-apt-get-update-sourceslist-warning | 20 ++++++----- 2 files changed, 41 insertions(+), 20 deletions(-) (limited to 'test') diff --git a/apt-private/private-update.cc b/apt-private/private-update.cc index 2b96f48fb..bd8823568 100644 --- a/apt-private/private-update.cc +++ b/apt-private/private-update.cc @@ -106,23 +106,40 @@ bool DoUpdate() if (_config->FindB("APT::Get::Update::SourceListWarnings::SignedBy", SLWarnings)) { - bool allDeb822 = true; + bool modernize = false; for (auto *S : *List) { - if (not S->GetSignedBy().empty()) - continue; - URI uri(S->GetURI()); - // TRANSLATOR: the first is manpage reference, the last the URI from a sources.list - _error->Notice(_("Missing Signed-By in the %s entry for '%s'"), - "sources.list(5)", URI::ArchiveOnly(uri).c_str()); - allDeb822 &= S->HasFlag(metaIndex::Flag::DEB822); + + if (not S->HasFlag(metaIndex::Flag::DEB822)) + { + // TRANSLATOR: the first is manpage reference, the last the URI from a sources.list + _error->Audit(_("The %s entry for '%s' should be upgraded to deb822 .sources"), + "sources.list(5)", URI::ArchiveOnly(uri).c_str()); + } + if (S->GetSignedBy().empty()) + { + if (S->HasFlag(metaIndex::Flag::DEB822)) + { + // TRANSLATOR: the first is manpage reference, the last the URI from a sources.list + _error->Notice(_("Missing Signed-By in the %s entry for '%s'"), + "sources.list(5)", URI::ArchiveOnly(uri).c_str()); + } + else + { + // TRANSLATOR: the first is manpage reference, the last the URI from a sources.list + _error->Audit(_("Missing Signed-By in the %s entry for '%s'"), + "sources.list(5)", URI::ArchiveOnly(uri).c_str()); + modernize = true; + } + } } - if (not allDeb822) + if (modernize) { - _error->Notice(_("Consider migrating all sources.list(5) entries to the deb822 .sources format")); - _error->Notice(_("The deb822 .sources format supports both embedded as well as external OpenPGP keys")); - _error->Notice(_("See apt-secure(8) for best practices in configuring repository signing.")); + _error->Audit(_("Consider migrating all sources.list(5) entries to the deb822 .sources format")); + _error->Audit(_("The deb822 .sources format supports both embedded as well as external OpenPGP keys")); + _error->Audit(_("See apt-secure(8) for best practices in configuring repository signing.")); + _error->Notice(_("Some sources can be modernized. Run 'apt modernize-sources' to do so.")); } } diff --git a/test/integration/test-apt-get-update-sourceslist-warning b/test/integration/test-apt-get-update-sourceslist-warning index 7e27e4825..5a941dae6 100755 --- a/test/integration/test-apt-get-update-sourceslist-warning +++ b/test/integration/test-apt-get-update-sourceslist-warning @@ -46,14 +46,18 @@ msgmsg 'Detect login info embedded in sources.list' echo 'deb http://apt:debian@example.org/debian bookworm main' > rootdir/etc/apt/sources.list.d/example.list testsuccessequal "$BOILERPLATE N: Usage of apt_auth.conf(5) should be preferred over embedding login information directly in the sources.list(5) entry for 'http://example.org/debian' -N: Missing Signed-By in the sources.list(5) entry for 'http://example.org/debian' -N: Consider migrating all sources.list(5) entries to the deb822 .sources format -N: The deb822 .sources format supports both embedded as well as external OpenPGP keys -N: See apt-secure(8) for best practices in configuring repository signing." apt update --no-download +A: The sources.list(5) entry for 'http://example.org/debian' should be upgraded to deb822 .sources +A: Missing Signed-By in the sources.list(5) entry for 'http://example.org/debian' +A: Consider migrating all sources.list(5) entries to the deb822 .sources format +A: The deb822 .sources format supports both embedded as well as external OpenPGP keys +A: See apt-secure(8) for best practices in configuring repository signing. +N: Some sources can be modernized. Run 'apt modernize-sources' to do so." apt update --no-download --audit echo 'deb tor+https://apt:debian@example.org/debian bookworm main' > rootdir/etc/apt/sources.list.d/example.list testsuccessequal "$BOILERPLATE N: Usage of apt_auth.conf(5) should be preferred over embedding login information directly in the sources.list(5) entry for 'tor+https://example.org/debian' -N: Missing Signed-By in the sources.list(5) entry for 'tor+https://example.org/debian' -N: Consider migrating all sources.list(5) entries to the deb822 .sources format -N: The deb822 .sources format supports both embedded as well as external OpenPGP keys -N: See apt-secure(8) for best practices in configuring repository signing." apt update --no-download +A: The sources.list(5) entry for 'tor+https://example.org/debian' should be upgraded to deb822 .sources +A: Missing Signed-By in the sources.list(5) entry for 'tor+https://example.org/debian' +A: Consider migrating all sources.list(5) entries to the deb822 .sources format +A: The deb822 .sources format supports both embedded as well as external OpenPGP keys +A: See apt-secure(8) for best practices in configuring repository signing. +N: Some sources can be modernized. Run 'apt modernize-sources' to do so." apt update --no-download --audit -- cgit v1.2.3-70-g09d2