From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id EAB951FF15C for ; Fri, 17 Oct 2025 12:59:49 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id CD6CB26D70; Fri, 17 Oct 2025 13:00:09 +0200 (CEST) From: Nicolas Frey To: pve-devel@lists.proxmox.com Date: Fri, 17 Oct 2025 13:00:04 +0200 Message-ID: <20251017110004.146470-1-n.frey@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.042 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Subject: [pve-devel] [PATCH proxmox-apt] fix #5207: apt: check signage of repos with gpgv for POM X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" If POM is set up to mirror the PVE repository and only this repository is added on a PVE host, the `Repositories` panel will show an `Error` status with the message: `No Proxmox VE repository is enabled, you do not get any updates!` This is because the current implementation only checks if the uri of the repo matches that of one of the standard repos. This patch aims to fix this issue by verifying it through signage info via gpgv. Checking against the cached InRelease file at `/var/lib/apt/lists/` with the help of the function `release_filename` to encode the uri into the filename generated by APT's URItoFileName in contrib/strutl.cc. Added tests to ensure common file paths for POM would be encoded correctly. Changes since v1: * rewrite test so it compiles Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=5207 Signed-off-by: Nicolas Frey --- proxmox-apt/src/repositories/repository.rs | 50 ++++++++++++++++++++-- 1 file changed, 46 insertions(+), 4 deletions(-) diff --git a/proxmox-apt/src/repositories/repository.rs b/proxmox-apt/src/repositories/repository.rs index 24e7943b..5bfc2fb3 100644 --- a/proxmox-apt/src/repositories/repository.rs +++ b/proxmox-apt/src/repositories/repository.rs @@ -122,18 +122,20 @@ impl APTRepositoryImpl for APTRepository { product: &str, suite: &str, ) -> bool { - let (package_type, handle_uris, component, _key) = handle.info(product); + let (package_type, handle_uris, component, key) = handle.info(product); - let mut found_uri = false; + let mut found_uri_or_signed = false; for uri in self.uris.iter() { let uri = uri.trim_end_matches('/'); - found_uri = found_uri || handle_uris.iter().any(|handle_uri| handle_uri == uri); + found_uri_or_signed = found_uri_or_signed + || handle_uris.iter().any(|handle_uri| handle_uri == uri) + || gpg_signed(uri, suite, key); } self.types.contains(&package_type) - && found_uri + && found_uri_or_signed // using contains would require a &String && self.suites.iter().any(|self_suite| self_suite == suite) && self.components.contains(&component) @@ -389,8 +391,48 @@ fn write_stanza(repo: &APTRepository, w: &mut dyn Write) -> Result<(), Error> { Ok(()) } +fn gpg_signed(uri: &str, suite: &str, key: &str) -> bool { + release_filename(Path::new("/var/lib/apt/lists"), uri, suite, false) + .to_str() + .is_some_and(|cached_file| { + std::process::Command::new("gpgv") + .args(["--keyring", key, cached_file]) + .output() + .is_ok_and(|output| output.status.success()) + }) +} + #[test] fn test_uri_to_filename() { let filename = uri_to_filename("https://some_host/some/path"); assert_eq!(filename, "some%5fhost_some_path".to_string()); } + +#[test] +fn test_release_filename() { + let data = [ + // testcase for proxmox offline mirror (mounted) + ( + Path::new("/var/lib/apt/lists"), + "file:///mnt/mirror/pve-no-subscription/2025-10-16T08:07:41Z", + "trixie", + false, + // expected + "/var/lib/apt/lists/_mnt_mirror_pve-no-subscription_2025-10-16T08:07:41Z_dists_trixie_InRelease" + ), + // testcase for proxmox offline mirror (local http server) + ( + Path::new("/var/lib/apt/lists"), + "http://proxmox-offline-mirror.domain.example/pve-subscription/2025-10-16T08:07:41Z", + "trixie", + false, + // expected + "/var/lib/apt/lists/proxmox-offline-mirror.domain.example_pve-subscription_2025-10-16T08:07:41Z_dists_trixie_InRelease" + ), + ]; + + for d in data { + let filename = release_filename(d.0, d.1, d.2, d.3).display().to_string(); + assert_eq!(filename, d.4); + } +} -- 2.47.3 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel