From eab428096942420ecd4d4a60b3197eb29c07b8af Mon Sep 17 00:00:00 2001 From: Gabriel Brown Date: Thu, 27 Aug 2026 07:25:25 -0400 Subject: [PATCH] Fix: Parse complete Terra repository state --- setup/scripts/install-packages | 40 ++++++++---- tests/setup/package-provenance-contract | 83 +++++++++++++++++++++++-- 2 files changed, 107 insertions(+), 16 deletions(-) diff --git a/setup/scripts/install-packages b/setup/scripts/install-packages index b74cb0f..5338dd7 100755 --- a/setup/scripts/install-packages +++ b/setup/scripts/install-packages @@ -383,9 +383,10 @@ _effective_terra_key() { delete seen in_block = 0 id = "" + terra_like = 0 } function finish_block( key) { - if (!in_block) return + if (!in_block || !terra_like) return if (seen["enabled"] != 1) { bad = 1 return @@ -410,29 +411,46 @@ _effective_terra_key() { /^======== ".*" repository configuration: ========$/ { finish_block() reset_block() + saw_nonempty = 1 + header_count++ id = $0 sub(/^======== "/, "", id) sub(/" repository configuration: ========$/, "", id) - if (id == "" || id !~ /^terra/) bad = 1 + if (id == "") bad = 1 + terra_like = (tolower(id) ~ /^terra/) in_block = 1 next } { - if (!in_block || $0 == "") next + if ($0 == "") next + saw_nonempty = 1 + if (!in_block || $0 ~ /^========/) { + bad = 1 + next + } separator = index($0, " = ") if (separator > 0) { key = substr($0, 1, separator - 1) - if (key in required) { - seen[key]++ - values[key] = substr($0, separator + 3) - } - } else if ($0 == "mirrorlist") { - seen["mirrorlist"]++ - values["mirrorlist"] = "" + value = substr($0, separator + 3) + } else if ($0 ~ /^[[:alnum:]_.-]+$/) { + key = $0 + value = "" + } else { + bad = 1 + next + } + if (key !~ /^[[:alnum:]_.-]+$/) { + bad = 1 + next + } + if (terra_like && key in required) { + seen[key]++ + values[key] = value } } END { finish_block() + if (saw_nonempty && header_count == 0) bad = 1 if (bad || enabled_count > 1) exit 2 if (enabled_count == 0) exit 1 print trusted_key @@ -444,7 +462,7 @@ _effective_terra_key() { # identity, and 2 is an unsafe, duplicated, or unreadable effective state. _terra_effective_status() { local dump gpgkey parse_status=0 local_key - dump="$(dnf --quiet --no-plugins --dump-repo-config='terra*')" || return 2 + dump="$(LC_ALL=C dnf --quiet --no-plugins --dump-repo-config='*')" || return 2 gpgkey="$(printf '%s\n' "$dump" | _effective_terra_key)" || parse_status=$? (( parse_status == 0 )) || return "$parse_status" [[ "$gpgkey" == 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' ]] || return 2 diff --git a/tests/setup/package-provenance-contract b/tests/setup/package-provenance-contract index a0902f2..c4c35c5 100755 --- a/tests/setup/package-provenance-contract +++ b/tests/setup/package-provenance-contract @@ -446,8 +446,15 @@ STUB cat > "$case_root/bin/dnf" <<'STUB' #!/usr/bin/env bash set -euo pipefail +query='' if [[ "$*" == '--quiet --no-plugins --dump-repo-config=terra*' ]]; then + query=filtered printf 'dnf:dump-terra\n' >> "$COMMAND_LOG" +elif [[ "$*" == '--quiet --no-plugins --dump-repo-config=*' ]]; then + query=full + printf 'dnf:dump-all:locale=%s\n' "${LC_ALL:-unset}" >> "$COMMAND_LOG" +fi +if [[ -n "$query" ]]; then mode="${STUB_TERRA_EFFECTIVE_MODE:-auto}" if [[ "$mode" == auto ]]; then case "${STUB_TERRA_REPO_MODE:-absent}" in @@ -462,6 +469,13 @@ if [[ "$*" == '--quiet --no-plugins --dump-repo-config=terra*' ]]; then mode=absent fi fi + if [[ "$query" == full ]]; then + printf '======== "fedora" repository configuration: ========\n' + printf 'baseurl = \nenabled = 1\ngpgcheck = 1\n' + printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-primary\n' + printf 'metalink = https://mirrors.fedoraproject.org/metalink\nmirrorlist\n' + printf 'pkg_gpgcheck = 0\nrepo_gpgcheck = 0\n' + fi case "$mode" in absent) exit 0 ;; trusted) @@ -507,6 +521,39 @@ if [[ "$*" == '--quiet --no-plugins --dump-repo-config=terra*' ]]; then printf 'metalink = \nmirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 1\n' done ;; + locale-unsafe) + if [[ "${LC_ALL:-}" == C ]]; then + printf '======== "terra" repository configuration: ========\n' + else + printf '======== "terra" Repository-Konfiguration: ========\n' + fi + printf 'baseurl = \nenabled = 1\ngpgcheck = 0\n' + printf 'gpgkey = https://repos.fyralabs.com/terra44.key\n' + printf 'metalink = https://tetsudou.fyralabs.com/terra44\nmirrorlist = \n' + printf 'pkg_gpgcheck = 0\nrepo_gpgcheck = 0\n' + ;; + localized-output) + printf '======== "terra" Repository-Konfiguration: ========\n' + printf 'baseurl = \nenabled = 1\ngpgcheck = 0\n' + ;; + uppercase|mixed-case) + [[ "$query" == full ]] || exit 0 + [[ "$mode" == uppercase ]] && id=TERRA || id=TeRrA + printf '======== "%s" repository configuration: ========\n' "$id" + printf 'baseurl = https://repos.fyralabs.com/terra44\nenabled = 1\ngpgcheck = 1\n' + printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama\n' + printf 'metalink = \nmirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 1\n' + ;; + mixed-alternate) + ids=(terra) + [[ "$query" == filtered ]] || ids+=(TeRrA-legacy) + for id in "${ids[@]}"; do + printf '======== "%s" repository configuration: ========\n' "$id" + printf 'baseurl = https://repos.fyralabs.com/terra44\nenabled = 1\ngpgcheck = 1\n' + printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama\n' + printf 'metalink = \nmirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 1\n' + done + ;; esac exit 0 fi @@ -646,6 +693,7 @@ run_installer_function() { STUB_FLATPAK_STATE="$case_root/flatpak-state" \ STUB_FLATPAK_REPO="$case_root/flatpak-repo" \ STUB_INSTALL_COUNTER="$case_root/install-counter" \ + LC_ALL="${STUB_CALLER_LOCALE:-C}" \ HOME="$case_root/home" \ TMPDIR="$case_root/tmp" \ PANAMA_PATH="$installer_fixture" \ @@ -684,13 +732,13 @@ reset_installer_fixture expect_success run_installer_function terra install_terra_repository assert_log terra "$(cat <<'EXPECTED' rpm:release -dnf:dump-terra +dnf:dump-all:locale=C rpm:query:terra-release gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F sudo:install:terra44.asc:/etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama sudo:dnf install -y --repofrompath terra,https://repos.fyralabs.com/terra44 --setopt=terra.pkg_gpgcheck=1 --setopt=terra.repo_gpgcheck=1 --setopt=terra.gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama terra-release sudo:install:terra.repo:/etc/yum.repos.d/terra.repo -dnf:dump-terra +dnf:dump-all:locale=C gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F EXPECTED @@ -814,7 +862,7 @@ STUB_TERRA_INSTALLED=1 STUB_TERRA_REPO_MODE=trusted \ expect_success run_installer_function terra-existing-trusted install_terra_repository assert_log terra-existing-trusted "$(cat <<'EXPECTED' rpm:release -dnf:dump-terra +dnf:dump-all:locale=C gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F EXPECTED @@ -853,13 +901,13 @@ done reset_installer_fixture STUB_TERRA_EFFECTIVE_MODE=absent \ expect_success run_installer_function terra-effective-absent preflight_terra_trust -assert_log terra-effective-absent 'dnf:dump-terra' +assert_log terra-effective-absent 'dnf:dump-all:locale=C' reset_installer_fixture STUB_TERRA_EFFECTIVE_MODE=trusted STUB_TERRA_REPO_MODE=trusted \ expect_success run_installer_function terra-effective-trusted preflight_terra_trust assert_log terra-effective-trusted "$(cat <<'EXPECTED' -dnf:dump-terra +dnf:dump-all:locale=C gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F EXPECTED @@ -877,6 +925,31 @@ for mode in legacy override-url override-gpg duplicate alternate; do || fail "effective Terra $mode reached a transaction" done +# The full effective configuration must reveal case variants and mixed-case +# alternate identities that a lowercase terra* selector omits. +for identity_case in uppercase mixed-case mixed-alternate; do + reset_installer_fixture + name="terra-effective-$identity_case" + status=0 + STUB_TERRA_EFFECTIVE_MODE="$identity_case" STUB_TERRA_REPO_MODE=trusted \ + run_installer_function "$name" preflight_terra_trust || status=$? + [[ "$status" -eq 78 ]] \ + || fail "effective Terra $identity_case returned $status instead of hard trust status 78" +done + +# DNF output must be locale-stable, and nonempty output that does not match the +# machine format is unsafe rather than equivalent to a fresh host. +for locale_case in locale-unsafe localized-output; do + reset_installer_fixture + name="terra-effective-$locale_case" + status=0 + STUB_CALLER_LOCALE=C.UTF-8 STUB_TERRA_EFFECTIVE_MODE="$locale_case" \ + run_installer_function "$name" preflight_terra_trust || status=$? + [[ "$status" -eq 78 ]] \ + || fail "effective Terra $locale_case returned $status instead of hard trust status 78" + assert_log "$name" 'dnf:dump-all:locale=C' +done + assert_pair_rollback() { local name="$1" pair="$2" prior="$3" key repo case "$pair" in