Fix: Parse complete Terra repository state

setup/scripts/install-packages

@@ -383,9 +383,10 @@ _effective_terra_key() {
 			delete seen
 			in_block = 0
 			id = ""
+			terra_like = 0
 		}
 		function finish_block( key) {
-			if (!in_block) return
+			if (!in_block || !terra_like) return
 			if (seen["enabled"] != 1) {
 				bad = 1
 				return
@@ -410,29 +411,46 @@ _effective_terra_key() {
 		/^======== ".*" repository configuration: ========$/ {
 			finish_block()
 			reset_block()
+			saw_nonempty = 1
+			header_count++
 			id = $0
 			sub(/^======== "/, "", id)
 			sub(/" repository configuration: ========$/, "", id)
-			if (id == "" || id !~ /^terra/) bad = 1
+			if (id == "") bad = 1
+			terra_like = (tolower(id) ~ /^terra/)
 			in_block = 1
 			next
 		}
 		{
-			if (!in_block || $0 == "") next
+			if ($0 == "") next
+			saw_nonempty = 1
+			if (!in_block || $0 ~ /^========/) {
+				bad = 1
+				next
+			}
 			separator = index($0, " = ")
 			if (separator > 0) {
 				key = substr($0, 1, separator - 1)
-				if (key in required) {
+				value = substr($0, separator + 3)
-					seen[key]++
+			} else if ($0 ~ /^[[:alnum:]_.-]+$/) {
-					values[key] = substr($0, separator + 3)
+				key = $0
-				}
+				value = ""
-			} else if ($0 == "mirrorlist") {
+			} else {
-				seen["mirrorlist"]++
+				bad = 1
-				values["mirrorlist"] = ""
+				next
+			}
+			if (key !~ /^[[:alnum:]_.-]+$/) {
+				bad = 1
+				next
+			}
+			if (terra_like && key in required) {
+				seen[key]++
+				values[key] = value
 			}
 		}
 		END {
 			finish_block()
+			if (saw_nonempty && header_count == 0) bad = 1
 			if (bad || enabled_count > 1) exit 2
 			if (enabled_count == 0) exit 1
 			print trusted_key
@@ -444,7 +462,7 @@ _effective_terra_key() {
 # identity, and 2 is an unsafe, duplicated, or unreadable effective state.
 _terra_effective_status() {
 	local dump gpgkey parse_status=0 local_key
-	dump="$(dnf --quiet --no-plugins --dump-repo-config='terra*')" || return 2
+	dump="$(LC_ALL=C dnf --quiet --no-plugins --dump-repo-config='*')" || return 2
 	gpgkey="$(printf '%s\n' "$dump" | _effective_terra_key)" || parse_status=$?
 	(( parse_status == 0 )) || return "$parse_status"
 	[[ "$gpgkey" == 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' ]] || return 2

tests/setup/package-provenance-contract

@@ -446,8 +446,15 @@ STUB
     cat > "$case_root/bin/dnf" <<'STUB'
 #!/usr/bin/env bash
 set -euo pipefail
+query=''
 if [[ "$*" == '--quiet --no-plugins --dump-repo-config=terra*' ]]; then
+    query=filtered
     printf 'dnf:dump-terra\n' >> "$COMMAND_LOG"
+elif [[ "$*" == '--quiet --no-plugins --dump-repo-config=*' ]]; then
+    query=full
+    printf 'dnf:dump-all:locale=%s\n' "${LC_ALL:-unset}" >> "$COMMAND_LOG"
+fi
+if [[ -n "$query" ]]; then
     mode="${STUB_TERRA_EFFECTIVE_MODE:-auto}"
     if [[ "$mode" == auto ]]; then
         case "${STUB_TERRA_REPO_MODE:-absent}" in
@@ -462,6 +469,13 @@ if [[ "$*" == '--quiet --no-plugins --dump-repo-config=terra*' ]]; then
             mode=absent
         fi
     fi
+    if [[ "$query" == full ]]; then
+        printf '======== "fedora" repository configuration: ========\n'
+        printf 'baseurl = \nenabled = 1\ngpgcheck = 1\n'
+        printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-primary\n'
+        printf 'metalink = https://mirrors.fedoraproject.org/metalink\nmirrorlist\n'
+        printf 'pkg_gpgcheck = 0\nrepo_gpgcheck = 0\n'
+    fi
     case "$mode" in
         absent) exit 0 ;;
         trusted)
@@ -507,6 +521,39 @@ if [[ "$*" == '--quiet --no-plugins --dump-repo-config=terra*' ]]; then
                 printf 'metalink = \nmirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 1\n'
             done
             ;;
+        locale-unsafe)
+            if [[ "${LC_ALL:-}" == C ]]; then
+                printf '======== "terra" repository configuration: ========\n'
+            else
+                printf '======== "terra" Repository-Konfiguration: ========\n'
+            fi
+            printf 'baseurl = \nenabled = 1\ngpgcheck = 0\n'
+            printf 'gpgkey = https://repos.fyralabs.com/terra44.key\n'
+            printf 'metalink = https://tetsudou.fyralabs.com/terra44\nmirrorlist = \n'
+            printf 'pkg_gpgcheck = 0\nrepo_gpgcheck = 0\n'
+            ;;
+        localized-output)
+            printf '======== "terra" Repository-Konfiguration: ========\n'
+            printf 'baseurl = \nenabled = 1\ngpgcheck = 0\n'
+            ;;
+        uppercase|mixed-case)
+            [[ "$query" == full ]] || exit 0
+            [[ "$mode" == uppercase ]] && id=TERRA || id=TeRrA
+            printf '======== "%s" repository configuration: ========\n' "$id"
+            printf 'baseurl = https://repos.fyralabs.com/terra44\nenabled = 1\ngpgcheck = 1\n'
+            printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama\n'
+            printf 'metalink = \nmirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 1\n'
+            ;;
+        mixed-alternate)
+            ids=(terra)
+            [[ "$query" == filtered ]] || ids+=(TeRrA-legacy)
+            for id in "${ids[@]}"; do
+                printf '======== "%s" repository configuration: ========\n' "$id"
+                printf 'baseurl = https://repos.fyralabs.com/terra44\nenabled = 1\ngpgcheck = 1\n'
+                printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama\n'
+                printf 'metalink = \nmirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 1\n'
+            done
+            ;;
     esac
     exit 0
 fi
@@ -646,6 +693,7 @@ run_installer_function() {
     STUB_FLATPAK_STATE="$case_root/flatpak-state" \
     STUB_FLATPAK_REPO="$case_root/flatpak-repo" \
     STUB_INSTALL_COUNTER="$case_root/install-counter" \
+    LC_ALL="${STUB_CALLER_LOCALE:-C}" \
     HOME="$case_root/home" \
     TMPDIR="$case_root/tmp" \
     PANAMA_PATH="$installer_fixture" \
@@ -684,13 +732,13 @@ reset_installer_fixture
 expect_success run_installer_function terra install_terra_repository
 assert_log terra "$(cat <<'EXPECTED'
 rpm:release
-dnf:dump-terra
+dnf:dump-all:locale=C
 rpm:query:terra-release
 gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
 sudo:install:terra44.asc:/etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama
 sudo:dnf install -y --repofrompath terra,https://repos.fyralabs.com/terra44 --setopt=terra.pkg_gpgcheck=1 --setopt=terra.repo_gpgcheck=1 --setopt=terra.gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama terra-release
 sudo:install:terra.repo:/etc/yum.repos.d/terra.repo
-dnf:dump-terra
+dnf:dump-all:locale=C
 gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
 gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
 EXPECTED
@@ -814,7 +862,7 @@ STUB_TERRA_INSTALLED=1 STUB_TERRA_REPO_MODE=trusted \
     expect_success run_installer_function terra-existing-trusted install_terra_repository
 assert_log terra-existing-trusted "$(cat <<'EXPECTED'
 rpm:release
-dnf:dump-terra
+dnf:dump-all:locale=C
 gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
 gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
 EXPECTED
@@ -853,13 +901,13 @@ done
 reset_installer_fixture
 STUB_TERRA_EFFECTIVE_MODE=absent \
     expect_success run_installer_function terra-effective-absent preflight_terra_trust
-assert_log terra-effective-absent 'dnf:dump-terra'
+assert_log terra-effective-absent 'dnf:dump-all:locale=C'
 
 reset_installer_fixture
 STUB_TERRA_EFFECTIVE_MODE=trusted STUB_TERRA_REPO_MODE=trusted \
     expect_success run_installer_function terra-effective-trusted preflight_terra_trust
 assert_log terra-effective-trusted "$(cat <<'EXPECTED'
-dnf:dump-terra
+dnf:dump-all:locale=C
 gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
 gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
 EXPECTED
@@ -877,6 +925,31 @@ for mode in legacy override-url override-gpg duplicate alternate; do
         || fail "effective Terra $mode reached a transaction"
 done
 
+# The full effective configuration must reveal case variants and mixed-case
+# alternate identities that a lowercase terra* selector omits.
+for identity_case in uppercase mixed-case mixed-alternate; do
+    reset_installer_fixture
+    name="terra-effective-$identity_case"
+    status=0
+    STUB_TERRA_EFFECTIVE_MODE="$identity_case" STUB_TERRA_REPO_MODE=trusted \
+        run_installer_function "$name" preflight_terra_trust || status=$?
+    [[ "$status" -eq 78 ]] \
+        || fail "effective Terra $identity_case returned $status instead of hard trust status 78"
+done
+
+# DNF output must be locale-stable, and nonempty output that does not match the
+# machine format is unsafe rather than equivalent to a fresh host.
+for locale_case in locale-unsafe localized-output; do
+    reset_installer_fixture
+    name="terra-effective-$locale_case"
+    status=0
+    STUB_CALLER_LOCALE=C.UTF-8 STUB_TERRA_EFFECTIVE_MODE="$locale_case" \
+        run_installer_function "$name" preflight_terra_trust || status=$?
+    [[ "$status" -eq 78 ]] \
+        || fail "effective Terra $locale_case returned $status instead of hard trust status 78"
+    assert_log "$name" 'dnf:dump-all:locale=C'
+done
+
 assert_pair_rollback() {
     local name="$1" pair="$2" prior="$3" key repo
     case "$pair" in