Pin Terra through repos.override.d so terra-release updates stop undoing it

tests/setup/package-provenance-contract

@@ -901,17 +901,26 @@ if [[ -n "$query" ]]; then
             wrong-url) mode=override-url ;;
             stock|stock-wrong-key) mode=stock ;;
         esac
-        # Adoption rewrites the repository file. Once it is the pinned form the
-        # dump has to say so, or the re-verification adoption performs on itself
-        # could never pass.
-        if [[ "$mode" == stock && -f "$STUB_ETC/yum.repos.d/terra.repo" ]] \
-            && grep -q '^gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama$' \
-                "$STUB_ETC/yum.repos.d/terra.repo"; then
+        # Adoption and a fresh install write the pin as a repos.override.d
+        # drop-in, which dnf lays over the repository file. Once it is there
+        # the dump has to say so, or the re-verification each performs on
+        # itself could never pass.
+        override="$STUB_ETC/dnf/repos.override.d/80-panama-terra.repo"
+        pinned_override=0
+        if [[ -f "$override" ]] \
+            && grep -q '^gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama$' "$override" \
+            && grep -q '^baseurl=https://repos.fyralabs.com/terra44$' "$override" \
+            && grep -qx 'metalink=' "$override"; then
+            pinned_override=1
+        fi
+        if [[ "$mode" == stock && "$pinned_override" == 1 ]]; then
             mode=trusted
         fi
         if [[ "$mode" == auto && -f "$STUB_ETC/yum.repos.d/terra.repo" ]] \
             && grep -q '^baseurl=https://repos.fyralabs.com/terra44$' "$STUB_ETC/yum.repos.d/terra.repo"; then
             mode=trusted
+        elif [[ "$mode" == auto && "$pinned_override" == 1 ]]; then
+            mode=trusted
         elif [[ "$mode" == auto ]]; then
             mode=absent
         fi
@@ -945,7 +954,7 @@ if [[ -n "$query" ]]; then
             printf 'baseurl = \nenabled = 1\ngpgcheck = 1\n'
             printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44\n'
             printf 'metalink = https://tetsudou.fyralabs.com/metalink?repo=terra44&arch=x86_64\n'
-            printf 'mirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 1\n'
+            printf 'mirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 0\n'
             ;;
         override-url)
             printf '======== "terra" repository configuration: ========\n'
@@ -1150,7 +1159,7 @@ run_installer_function() {
                 cp "$installer_fixture/setup/provenance/keys/flathub.asc" \
                     "$case_root/etc/pki/rpm-gpg/RPM-GPG-KEY-terra44"
             fi
-            printf '[terra]\nmetalink=https://tetsudou.fyralabs.com/metalink?repo=terra44&arch=$basearch\nenabled=1\ngpgcheck=1\nrepo_gpgcheck=1\ngpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44\n' \
+            printf '[terra]\nmetalink=https://tetsudou.fyralabs.com/metalink?repo=terra44&arch=$basearch\nenabled=1\ngpgcheck=1\nrepo_gpgcheck=0\ngpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44\n' \
                 > "$case_root/etc/yum.repos.d/terra.repo"
             ;;
         wrong-key)
@@ -1663,7 +1672,8 @@ rpm:query:terra-release
 gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
 sudo:install:terra44.asc:/etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama
 sudo:dnf install -y --repofrompath terra,https://repos.fyralabs.com/terra44 --setopt=terra.pkg_gpgcheck=1 --setopt=terra.repo_gpgcheck=1 --setopt=terra.gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama terra-release
-sudo:install:terra.repo:/etc/yum.repos.d/terra.repo
+sudo:mkdir -p -- /etc/dnf/repos.override.d
+sudo:install:80-panama-terra.repo:/etc/dnf/repos.override.d/80-panama-terra.repo
 dnf:dump-all:locale=C
 gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
 gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
@@ -1672,10 +1682,12 @@ EXPECTED
 cmp -s "$installer_fixture/setup/provenance/keys/terra44.asc" \
     "$test_tmp/cases/terra/etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama" \
     || fail 'Terra privileged install did not preserve the fully staged reviewed key'
-assert_file_bytes "$test_tmp/cases/terra/etc/yum.repos.d/terra.repo" "$(cat <<'EXPECTED'
+assert_file_bytes "$test_tmp/cases/terra/etc/dnf/repos.override.d/80-panama-terra.repo" "$(cat <<'EXPECTED'
 [terra]
 name=Panama reviewed Terra 44
 baseurl=https://repos.fyralabs.com/terra44
+metalink=
+mirrorlist=
 enabled=1
 gpgcheck=1
 repo_gpgcheck=1
@@ -1804,9 +1816,12 @@ for mode in nogpg wrong-url wrong-key absent; do
 done
 
 # A machine that installed Terra the way Terra documents it. The repository file
-# is terra-release's own -- a metalink, and the key at its stock path -- so it is
-# not Panama's pinned form, but it IS the fingerprint this repository reviewed,
-# with every signature check on. That is an adoption, not a compromise.
+# is terra-release's own -- a metalink, the key at its stock path, and
+# repo_gpgcheck=0 as terra-release 44-11 ships it -- so it is not Panama's
+# pinned form, but it IS the fingerprint this repository reviewed, with package
+# signature checks on. That is an adoption, not a compromise. The pin goes in a
+# repos.override.d drop-in, because terra-release replaces its own repo file on
+# every update and a pin written there did not survive the next one.
 #
 # Refusing it was a gate with no door: the ordinary Fedora desktop could never
 # reach the pinned state, and status 78 then stopped every stage of every run,
@@ -1818,13 +1833,17 @@ STUB_TERRA_INSTALLED=1 STUB_TERRA_REPO_MODE=stock \
 reset_installer_fixture
 STUB_TERRA_INSTALLED=1 STUB_TERRA_REPO_MODE=stock \
     expect_success run_installer_function terra-stock-adopt install_terra_repository
-terra_adopted="$test_tmp/cases/terra-stock-adopt/etc/yum.repos.d/terra.repo"
+terra_adopted="$test_tmp/cases/terra-stock-adopt/etc/dnf/repos.override.d/80-panama-terra.repo"
 grep -qx 'baseurl=https://repos.fyralabs.com/terra44' "$terra_adopted" \
     || fail 'adoption left Terra off the reviewed baseurl'
 grep -qx 'gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' "$terra_adopted" \
     || fail 'adoption left Terra off the reviewed key path'
-grep -q 'metalink' "$terra_adopted" \
-    && fail 'adoption kept the metalink it was supposed to replace'
+grep -qx 'metalink=' "$terra_adopted" \
+    || fail 'adoption did not clear the metalink it was supposed to replace'
+grep -qx 'repo_gpgcheck=1' "$terra_adopted" \
+    || fail 'adoption did not turn repository metadata checks back on'
+grep -q 'RPM-GPG-KEY-terra44$' "$test_tmp/cases/terra-stock-adopt/etc/yum.repos.d/terra.repo" \
+    || fail "adoption rewrote terra-release's own repository file"
 [[ "$(<"$test_tmp/cases/terra-stock-adopt/commands.log")" != *'dnf:install'* ]] \
     || fail 'adoption opened a DNF transaction it does not need'