From 9cc9576116418b8907e9cbae476791d9c3681221 Mon Sep 17 00:00:00 2001
From: codex-bot-andresmgsl
 <codex-bot-andresmgsl@noreply.forgejo.heavyduty.builders>
Date: Mon, 31 Aug 2026 10:57:32 +0000
Subject: [PATCH] fix: limit apt opt-in to known sqv failure

---
 scripts/install-apt.sh   |  5 +++++
 test/install-apt.test.js | 18 ++++++++++++++++--
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/scripts/install-apt.sh b/scripts/install-apt.sh
index 867c3be..8da2021 100755
--- a/scripts/install-apt.sh
+++ b/scripts/install-apt.sh
@@ -147,6 +147,11 @@ else
     printf '%s\n' "$update_output" >&2
     exit "$update_status"
   fi
+  if ! grep -Fqi '/usr/bin/sqv' <<<"$update_output" \
+    || ! grep -Fqi 'Malformed MPI' <<<"$update_output"; then
+    printf '%s\n' "$update_output" >&2
+    exit "$update_status"
+  fi
   if [ "$ALLOW_UNVERIFIED" != "1" ]; then
     $SUDO rm -f "$LIST"
     echo "error: apt could not verify the Forgejo registry signature." >&2
diff --git a/test/install-apt.test.js b/test/install-apt.test.js
index fdcae15..04ef646 100644
--- a/test/install-apt.test.js
+++ b/test/install-apt.test.js
@@ -199,7 +199,7 @@ test('registry Release file present: proceeds with the install', () => {
 test('signature verification failure refuses by default and removes the forge source', () => {
   const s = runScenario({
     candInitial: '22.23.1-1nodesource1',
-    sourceUpdateError: 'W: GPG error: signatures could not be verified: NO_PUBKEY DEADBEEF\nE: The repository is not signed.',
+    sourceUpdateError: 'W: OpenPGP signature verification failed: Sub-process /usr/bin/sqv returned an error code (1), error message is: Verifying signature: Malformed MPI: leading bit is not set',
   });
   assert.notEqual(s.res.status, 0);
   assert.equal(s.forgeList, null);
@@ -211,7 +211,7 @@ test('signature verification failure refuses by default and removes the forge so
 test('exact opt-in permits an HTTPS-only forge source after signature failure', () => {
   const s = runScenario({
     candInitial: '22.23.1-1nodesource1',
-    sourceUpdateError: 'W: GPG error: signatures could not be verified: NO_PUBKEY DEADBEEF\nE: The repository is not signed.',
+    sourceUpdateError: 'W: OpenPGP signature verification failed: Sub-process /usr/bin/sqv returned an error code (1), error message is: Verifying signature: Malformed MPI: leading bit is not set',
     allowUnverified: '1',
   });
   assert.equal(s.res.status, 0, s.res.stderr);
@@ -221,6 +221,20 @@ test('exact opt-in permits an HTTPS-only forge source after signature failure',
   assert.match(s.aptGetLog, /install -y stoke/);
 });
 
+test('opt-in cannot bypass a missing signing key', () => {
+  const failure = 'W: GPG error: signatures could not be verified: NO_PUBKEY DEADBEEF\nE: The repository is not signed.';
+  const s = runScenario({
+    candInitial: '22.23.1-1nodesource1',
+    sourceUpdateError: failure,
+    allowUnverified: '1',
+  });
+  assert.notEqual(s.res.status, 0);
+  assert.match(s.res.stderr, new RegExp(failure.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
+  assert.match(s.forgeList, /\[signed-by=/);
+  assert.doesNotMatch(s.forgeList, /trusted=yes/);
+  assert.doesNotMatch(s.aptGetLog, /install -y stoke/);
+});
+
 test('unrecognized opt-in value is rejected before configuring apt', () => {
   const s = runScenario({
     candInitial: '22.23.1-1nodesource1',