gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: Parse complete Terra repository state

Browse Source
This commit is contained in:
Gabriel Brown
2026-08-27 07:25:25 -04:00
parent 1c3cd7ac72
commit eab4280969
2 changed files with 107 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
setup/scripts/install-packages
+28 -10
View File
@@ -383,9 +383,10 @@ _effective_terra_key() {
delete seen
in_block = 0
id = ""
terra_like = 0
}
function finish_block( key) {
if (!in_block) return
if (!in_block || !terra_like) return
if (seen["enabled"] != 1) {
bad = 1
return
@@ -410,29 +411,46 @@ _effective_terra_key() {
/^======== ".*" repository configuration: ========$/ {
finish_block()
reset_block()
saw_nonempty = 1
header_count++
id = $0
sub(/^======== "/, "", id)
sub(/" repository configuration: ========$/, "", id)
if (id == "" || id !~ /^terra/) bad = 1
if (id == "") bad = 1
terra_like = (tolower(id) ~ /^terra/)
in_block = 1
next
}
{
if (!in_block || $0 == "") next
if ($0 == "") next
saw_nonempty = 1
if (!in_block || $0 ~ /^========/) {
bad = 1
next
}
separator = index($0, " = ")
if (separator > 0) {
key = substr($0, 1, separator - 1)
if (key in required) {
seen[key]++
values[key] = substr($0, separator + 3)
value = substr($0, separator + 3)
} else if ($0 ~ /^[[:alnum:]_.-]+$/) {
key = $0
value = ""
} else {
bad = 1
next
}
} else if ($0 == "mirrorlist") {
seen["mirrorlist"]++
values["mirrorlist"] = ""
if (key !~ /^[[:alnum:]_.-]+$/) {
bad = 1
next
}
if (terra_like && key in required) {
seen[key]++
values[key] = value
}
}
END {
finish_block()
if (saw_nonempty && header_count == 0) bad = 1
if (bad || enabled_count > 1) exit 2
if (enabled_count == 0) exit 1
print trusted_key
@@ -444,7 +462,7 @@ _effective_terra_key() {
# identity, and 2 is an unsafe, duplicated, or unreadable effective state.
_terra_effective_status() {
local dump gpgkey parse_status=0 local_key
dump="$(dnf --quiet --no-plugins --dump-repo-config='terra*')" || return 2
dump="$(LC_ALL=C dnf --quiet --no-plugins --dump-repo-config='*')" || return 2
gpgkey="$(printf '%s\n' "$dump" | _effective_terra_key)" || parse_status=$?
(( parse_status == 0 )) || return "$parse_status"
[[ "$gpgkey" == 'file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama' ]] || return 2
tests/setup/package-provenance-contract
+78 -5
View File
@@ -446,8 +446,15 @@ STUB
cat > "$case_root/bin/dnf" <<'STUB'
#!/usr/bin/env bash
set -euo pipefail
query=''
if [[ "$*" == '--quiet --no-plugins --dump-repo-config=terra*' ]]; then
query=filtered
printf 'dnf:dump-terra\n' >> "$COMMAND_LOG"
elif [[ "$*" == '--quiet --no-plugins --dump-repo-config=*' ]]; then
query=full
printf 'dnf:dump-all:locale=%s\n' "${LC_ALL:-unset}" >> "$COMMAND_LOG"
fi
if [[ -n "$query" ]]; then
mode="${STUB_TERRA_EFFECTIVE_MODE:-auto}"
if [[ "$mode" == auto ]]; then
case "${STUB_TERRA_REPO_MODE:-absent}" in
@@ -462,6 +469,13 @@ if [[ "$*" == '--quiet --no-plugins --dump-repo-config=terra*' ]]; then
mode=absent
fi
fi
if [[ "$query" == full ]]; then
printf '======== "fedora" repository configuration: ========\n'
printf 'baseurl = \nenabled = 1\ngpgcheck = 1\n'
printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-44-primary\n'
printf 'metalink = https://mirrors.fedoraproject.org/metalink\nmirrorlist\n'
printf 'pkg_gpgcheck = 0\nrepo_gpgcheck = 0\n'
fi
case "$mode" in
absent) exit 0 ;;
trusted)
@@ -507,6 +521,39 @@ if [[ "$*" == '--quiet --no-plugins --dump-repo-config=terra*' ]]; then
printf 'metalink = \nmirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 1\n'
done
;;
locale-unsafe)
if [[ "${LC_ALL:-}" == C ]]; then
printf '======== "terra" repository configuration: ========\n'
else
printf '======== "terra" Repository-Konfiguration: ========\n'
fi
printf 'baseurl = \nenabled = 1\ngpgcheck = 0\n'
printf 'gpgkey = https://repos.fyralabs.com/terra44.key\n'
printf 'metalink = https://tetsudou.fyralabs.com/terra44\nmirrorlist = \n'
printf 'pkg_gpgcheck = 0\nrepo_gpgcheck = 0\n'
;;
localized-output)
printf '======== "terra" Repository-Konfiguration: ========\n'
printf 'baseurl = \nenabled = 1\ngpgcheck = 0\n'
;;
uppercase|mixed-case)
[[ "$query" == full ]] || exit 0
[[ "$mode" == uppercase ]] && id=TERRA || id=TeRrA
printf '======== "%s" repository configuration: ========\n' "$id"
printf 'baseurl = https://repos.fyralabs.com/terra44\nenabled = 1\ngpgcheck = 1\n'
printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama\n'
printf 'metalink = \nmirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 1\n'
;;
mixed-alternate)
ids=(terra)
[[ "$query" == filtered ]] || ids+=(TeRrA-legacy)
for id in "${ids[@]}"; do
printf '======== "%s" repository configuration: ========\n' "$id"
printf 'baseurl = https://repos.fyralabs.com/terra44\nenabled = 1\ngpgcheck = 1\n'
printf 'gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama\n'
printf 'metalink = \nmirrorlist = \npkg_gpgcheck = 1\nrepo_gpgcheck = 1\n'
done
;;
esac
exit 0
fi
@@ -646,6 +693,7 @@ run_installer_function() {
STUB_FLATPAK_STATE="$case_root/flatpak-state" \
STUB_FLATPAK_REPO="$case_root/flatpak-repo" \
STUB_INSTALL_COUNTER="$case_root/install-counter" \
LC_ALL="${STUB_CALLER_LOCALE:-C}" \
HOME="$case_root/home" \
TMPDIR="$case_root/tmp" \
PANAMA_PATH="$installer_fixture" \
@@ -684,13 +732,13 @@ reset_installer_fixture
expect_success run_installer_function terra install_terra_repository
assert_log terra "$(cat <<'EXPECTED'
rpm:release
dnf:dump-terra
dnf:dump-all:locale=C
rpm:query:terra-release
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
sudo:install:terra44.asc:/etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama
sudo:dnf install -y --repofrompath terra,https://repos.fyralabs.com/terra44 --setopt=terra.pkg_gpgcheck=1 --setopt=terra.repo_gpgcheck=1 --setopt=terra.gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-terra44-panama terra-release
sudo:install:terra.repo:/etc/yum.repos.d/terra.repo
dnf:dump-terra
dnf:dump-all:locale=C
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
EXPECTED
@@ -814,7 +862,7 @@ STUB_TERRA_INSTALLED=1 STUB_TERRA_REPO_MODE=trusted \
expect_success run_installer_function terra-existing-trusted install_terra_repository
assert_log terra-existing-trusted "$(cat <<'EXPECTED'
rpm:release
dnf:dump-terra
dnf:dump-all:locale=C
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
EXPECTED
@@ -853,13 +901,13 @@ done
reset_installer_fixture
STUB_TERRA_EFFECTIVE_MODE=absent \
expect_success run_installer_function terra-effective-absent preflight_terra_trust
assert_log terra-effective-absent 'dnf:dump-terra'
assert_log terra-effective-absent 'dnf:dump-all:locale=C'
reset_installer_fixture
STUB_TERRA_EFFECTIVE_MODE=trusted STUB_TERRA_REPO_MODE=trusted \
expect_success run_installer_function terra-effective-trusted preflight_terra_trust
assert_log terra-effective-trusted "$(cat <<'EXPECTED'
dnf:dump-terra
dnf:dump-all:locale=C
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
gpg:fingerprint:AE09157A4DE88B497EA1D5D300CDAB43DE226D6F
EXPECTED
@@ -877,6 +925,31 @@ for mode in legacy override-url override-gpg duplicate alternate; do
|| fail "effective Terra $mode reached a transaction"
done
# The full effective configuration must reveal case variants and mixed-case
# alternate identities that a lowercase terra* selector omits.
for identity_case in uppercase mixed-case mixed-alternate; do
reset_installer_fixture
name="terra-effective-$identity_case"
status=0
STUB_TERRA_EFFECTIVE_MODE="$identity_case" STUB_TERRA_REPO_MODE=trusted \
run_installer_function "$name" preflight_terra_trust || status=$?
[[ "$status" -eq 78 ]] \
|| fail "effective Terra $identity_case returned $status instead of hard trust status 78"
done
# DNF output must be locale-stable, and nonempty output that does not match the
# machine format is unsafe rather than equivalent to a fresh host.
for locale_case in locale-unsafe localized-output; do
reset_installer_fixture
name="terra-effective-$locale_case"
status=0
STUB_CALLER_LOCALE=C.UTF-8 STUB_TERRA_EFFECTIVE_MODE="$locale_case" \
run_installer_function "$name" preflight_terra_trust || status=$?
[[ "$status" -eq 78 ]] \
|| fail "effective Terra $locale_case returned $status instead of hard trust status 78"
assert_log "$name" 'dnf:dump-all:locale=C'
done
assert_pair_rollback() {
local name="$1" pair="$2" prior="$3" key repo
case "$pair" in