heavy-duty/stoke
7
1
Fork 1
Code Issues 1 Pull requests Projects Releases 3 Packages Wiki Activity Actions

fix: limit apt opt-in to known sqv failure
All checks were successful
labels / labels (pull_request) Successful in 12s
Details
ci / test (pull_request) Successful in 17s
Details

Browse source
This commit is contained in:
codex-bot-andresmgsl 2026-08-31 10:57:32 +00:00
parent a89eafaebc
commit 9cc9576116
2 changed files with 21 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
scripts/install-apt.sh
View file

@ -147,6 +147,11 @@ else
printf '%s\n' "$update_output" >&2 printf '%s\n' "$update_output" >&2
exit "$update_status" exit "$update_status"
fi fi
if ! grep -Fqi '/usr/bin/sqv' <<<"$update_output" \
|| ! grep -Fqi 'Malformed MPI' <<<"$update_output"; then
printf '%s\n' "$update_output" >&2
exit "$update_status"
fi
if [ "$ALLOW_UNVERIFIED" != "1" ]; then if [ "$ALLOW_UNVERIFIED" != "1" ]; then
$SUDO rm -f "$LIST" $SUDO rm -f "$LIST"
echo "error: apt could not verify the Forgejo registry signature." >&2 echo "error: apt could not verify the Forgejo registry signature." >&2

18
test/install-apt.test.js
View file

@ -199,7 +199,7 @@ test('registry Release file present: proceeds with the install', () => {
test('signature verification failure refuses by default and removes the forge source', () => { test('signature verification failure refuses by default and removes the forge source', () => {
const s = runScenario({ const s = runScenario({
candInitial: '22.23.1-1nodesource1', candInitial: '22.23.1-1nodesource1',
sourceUpdateError: 'W: GPG error: signatures could not be verified: NO_PUBKEY DEADBEEF\nE: The repository is not signed.', sourceUpdateError: 'W: OpenPGP signature verification failed: Sub-process /usr/bin/sqv returned an error code (1), error message is: Verifying signature: Malformed MPI: leading bit is not set',
}); });
assert.notEqual(s.res.status, 0); assert.notEqual(s.res.status, 0);
assert.equal(s.forgeList, null); assert.equal(s.forgeList, null);
@ -211,7 +211,7 @@ test('signature verification failure refuses by default and removes the forge so
test('exact opt-in permits an HTTPS-only forge source after signature failure', () => { test('exact opt-in permits an HTTPS-only forge source after signature failure', () => {
const s = runScenario({ const s = runScenario({
candInitial: '22.23.1-1nodesource1', candInitial: '22.23.1-1nodesource1',
sourceUpdateError: 'W: GPG error: signatures could not be verified: NO_PUBKEY DEADBEEF\nE: The repository is not signed.', sourceUpdateError: 'W: OpenPGP signature verification failed: Sub-process /usr/bin/sqv returned an error code (1), error message is: Verifying signature: Malformed MPI: leading bit is not set',
allowUnverified: '1', allowUnverified: '1',
}); });
assert.equal(s.res.status, 0, s.res.stderr); assert.equal(s.res.status, 0, s.res.stderr);
@ -221,6 +221,20 @@ test('exact opt-in permits an HTTPS-only forge source after signature failure',
assert.match(s.aptGetLog, /install -y stoke/); assert.match(s.aptGetLog, /install -y stoke/);
}); });
test('opt-in cannot bypass a missing signing key', () => {
const failure = 'W: GPG error: signatures could not be verified: NO_PUBKEY DEADBEEF\nE: The repository is not signed.';
const s = runScenario({
candInitial: '22.23.1-1nodesource1',
sourceUpdateError: failure,
allowUnverified: '1',
});
assert.notEqual(s.res.status, 0);
assert.match(s.res.stderr, new RegExp(failure.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
assert.match(s.forgeList, /\[signed-by=/);
assert.doesNotMatch(s.forgeList, /trusted=yes/);
assert.doesNotMatch(s.aptGetLog, /install -y stoke/);
});
test('unrecognized opt-in value is rejected before configuring apt', () => { test('unrecognized opt-in value is rejected before configuring apt', () => {
const s = runScenario({ const s = runScenario({
candInitial: '22.23.1-1nodesource1', candInitial: '22.23.1-1nodesource1',