gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: Enforce effective repository trust preflight

Browse Source
This commit is contained in:
Gabriel Brown
2026-08-27 07:10:11 -04:00
parent 8652f92aae
commit 1c3cd7ac72
4 changed files with 362 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/setup/package-provenance-contract
+121 -3
View File
@@ -445,6 +445,71 @@ STUB
cat > "$case_root/bin/dnf" <<'STUB'
#!/usr/bin/env bash
set -euo pipefail
if [[ "$*" == '--quiet --no-plugins --dump-repo-config=terra*' ]]; then
printf 'dnf:dump-terra\n' >> "$COMMAND_LOG"
mode="${STUB_TERRA_EFFECTIVE_MODE:-auto}"
if [[ "$mode" == auto ]]; then
case "${STUB_TERRA_REPO_MODE:-absent}" in
trusted|wrong-key) mode=trusted ;;
nogpg) mode=legacy ;;
wrong-url) mode=override-url ;;
esac
if [[ "$mode" == auto && -f "$STUB_ETC/yum.repos.d/terra.repo" ]] \
&& grep -q '^baseurl=https://repos.fyralabs.com/terra44$' "$STUB_ETC/yum.repos.d/terra.repo"; then
mode=trusted
elif [[ "$mode" == auto ]]; then
mode=absent
fi
fi
case "$mode" in
absent) exit 0 ;;
trusted)
printf '======== "terra" repository configuration: ========\n'
printf 'baseurl = https://repos.fyralabs.com/terra44\n'
printf 'enabled = 1\n'
printf 'gpgcheck = 1\n'
printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama\n'
printf 'metalink = \nmirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 1\n'
;;
legacy)
printf '======== "terra" repository configuration: ========\n'
printf 'baseurl = \nenabled = 1\ngpgcheck = 0\n'
printf 'gpgkey = https://repos.fyralabs.com/terra44.key\n'
printf 'metalink = https://tetsudou.fyralabs.com/terra44\nmirrorlist = \n'
printf 'pkg_gpgcheck = 0\nrepo_gpgcheck = 0\n'
;;
override-url)
printf '======== "terra" repository configuration: ========\n'
printf 'baseurl = https://evil.invalid/terra44\nenabled = 1\ngpgcheck = 1\n'
printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama\n'
printf 'metalink = \nmirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 1\n'
;;
override-gpg)
printf '======== "terra" repository configuration: ========\n'
printf 'baseurl = https://repos.fyralabs.com/terra44\nenabled = 1\ngpgcheck = 0\n'
printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama\n'
printf 'metalink = \nmirrorlist = \npkg_gpgcheck = 0\nrepo_gpgcheck = 0\n'
;;
duplicate)
for id in terra terra; do
printf '======== "%s" repository configuration: ========\n' "$id"
printf 'baseurl = https://repos.fyralabs.com/terra44\nenabled = 1\ngpgcheck = 1\n'
printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama\n'
printf 'metalink = \nmirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 1\n'
done
;;
alternate)
for id in terra terra-legacy; do
printf '======== "%s" repository configuration: ========\n' "$id"
printf 'baseurl = https://repos.fyralabs.com/terra44\nenabled = 1\ngpgcheck = 1\n'
printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama\n'
printf 'metalink = \nmirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 1\n'
done
;;
esac
exit 0
fi
exit 69
STUB
@@ -537,6 +602,23 @@ run_installer_function() {
cp "$installer_fixture/setup/provenance/keys/flathub.asc" \
"$case_root/flatpak-repo/flathub.trustedkeys.gpg"
;;
alternate-key)
printf '[core]\nrepo_version=1\n\n[remote "flathub"]\nurl=https://dl.flathub.org/repo/\ngpg-verify=true\ngpg-verify-summary=true\ngpgkeypath=/unreviewed/keyring.gpg\n' \
> "$case_root/flatpak-repo/config"
cp "$installer_fixture/setup/provenance/keys/flathub.asc" \
"$case_root/flatpak-repo/flathub.trustedkeys.gpg"
;;
empty-alternate-key|duplicate-alternate-key|malformed-alternate-key)
printf '[core]\nrepo_version=1\n\n[remote "flathub"]\nurl=https://dl.flathub.org/repo/\ngpg-verify=true\ngpg-verify-summary=true\n' \
> "$case_root/flatpak-repo/config"
case "$STUB_FLATPAK_REMOTE_MODE" in
empty-alternate-key) printf 'gpgkeypath=\n' ;;
duplicate-alternate-key) printf 'gpgkeypath=\ngpgkeypath=/unreviewed/keyring.gpg\n' ;;
malformed-alternate-key) printf 'gpgkeypath /unreviewed/keyring.gpg\n' ;;
esac >> "$case_root/flatpak-repo/config"
cp "$installer_fixture/setup/provenance/keys/flathub.asc" \
"$case_root/flatpak-repo/flathub.trustedkeys.gpg"
;;
esac
case "${STUB_CLAUDE_DESKTOP_REPO_MODE:-absent}" in
trusted)
@@ -602,11 +684,13 @@ reset_installer_fixture
expect_success run_installer_function terra install_terra_repository
assert_log terra "$(cat <<'EXPECTED'
rpm:release
dnf:dump-terra
rpm:query:terra-release
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
sudo:install:terra44.asc:/etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama
sudo:dnf install -y --repofrompath terra,https://repos.fyralabs.com/terra44 --setopt=terra.pkg_gpgcheck=1 --setopt=terra.repo_gpgcheck=1 --setopt=terra.gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama terra-release
sudo:install:terra.repo:/etc/yum.repos.d/terra.repo
dnf:dump-terra
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
EXPECTED
@@ -713,7 +797,8 @@ EXPECTED
)"
assert_file_bytes "$test_tmp/cases/flathub-existing-trusted/flatpak-state" 'preserved'
for mode in wrong-url wrong-key no-gpg; do
for mode in wrong-url wrong-key no-gpg alternate-key empty-alternate-key \
duplicate-alternate-key malformed-alternate-key; do
reset_installer_fixture
name="flathub-existing-$mode"
STUB_FLATPAK_REMOTE_MODE="$mode" \
@@ -729,7 +814,7 @@ STUB_TERRA_INSTALLED=1 STUB_TERRA_REPO_MODE=trusted \
expect_success run_installer_function terra-existing-trusted install_terra_repository
assert_log terra-existing-trusted "$(cat <<'EXPECTED'
rpm:release
rpm:query:terra-release
dnf:dump-terra
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
EXPECTED
@@ -748,7 +833,11 @@ done
# when one copy looks safe. These cases catch the absent/duplicate conflation.
for duplicate_case in \
$'duplicate-no-gpg NoGPGVerify=false\nNoGPGVerify=true' \
$'duplicate-gpg-verify GPGVerify=true\nGPGVerify=false'; do
$'duplicate-gpg-verify GPGVerify=true\nGPGVerify=false' \
'alternate-gpg-key-path GPGKeyPath=/unreviewed/keyring.gpg' \
'empty-gpg-key-path GPGKeyPath=' \
$'duplicate-gpg-key-path GPGKeyPath=\nGPGKeyPath=/unreviewed/keyring.gpg' \
'malformed-gpg-key-path GPGKeyPath /unreviewed/keyring.gpg'; do
name="${duplicate_case%% *}"
lines="${duplicate_case#* }"
reset_installer_fixture
@@ -759,6 +848,35 @@ for duplicate_case in \
|| fail "$name descriptor reached remote activation"
done
# DNF's non-networking effective configuration dump, rather than any one repo
# file, decides whether Terra is absent, trusted, overridden, or duplicated.
reset_installer_fixture
STUB_TERRA_EFFECTIVE_MODE=absent \
expect_success run_installer_function terra-effective-absent preflight_terra_trust
assert_log terra-effective-absent 'dnf:dump-terra'
reset_installer_fixture
STUB_TERRA_EFFECTIVE_MODE=trusted STUB_TERRA_REPO_MODE=trusted \
expect_success run_installer_function terra-effective-trusted preflight_terra_trust
assert_log terra-effective-trusted "$(cat <<'EXPECTED'
dnf:dump-terra
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
EXPECTED
)"
for mode in legacy override-url override-gpg duplicate alternate; do
reset_installer_fixture
name="terra-effective-$mode"
status=0
STUB_TERRA_EFFECTIVE_MODE="$mode" STUB_TERRA_REPO_MODE=trusted \
run_installer_function "$name" preflight_terra_trust || status=$?
[[ "$status" -eq 78 ]] \
|| fail "effective Terra $mode returned $status instead of hard trust status 78"
[[ "$(<"$test_tmp/cases/$name/commands.log")" != *'sudo:'* ]] \
|| fail "effective Terra $mode reached a transaction"
done
assert_pair_rollback() {
local name="$1" pair="$2" prior="$3" key repo
case "$pair" in