New upstream version 2021.4

tests/basic-test.sh

@@ -29,10 +29,8 @@ COMMIT_ARGS=""
 DIFF_ARGS=""
 if is_bare_user_only_repo repo; then
     # In bare-user-only repos we can only represent files with uid/gid 0, no
-    # xattrs and canonical permissions, so we need to commit them as such, or
-    # we end up with repos that don't pass fsck
-    COMMIT_ARGS="--canonical-permissions"
-    DIFF_ARGS="--owner-uid=0 --owner-gid=0 --no-xattrs"
+    # xattrs and canonical permissions.
+    DIFF_ARGS="--owner-uid=0 --owner-gid=0"
     # Also, since we can't check out uid=0 files we need to check out in user mode
     CHECKOUT_U_ARG="-U"
     CHECKOUT_H_ARGS="-U -H"
@@ -314,7 +312,7 @@ echo "ok diff revisions"
 
 cd ${test_tmpdir}/checkout-test2-4
 echo afile > oh-look-a-file
-$OSTREE diff test2 ./ > ${test_tmpdir}/diff-test2-2
+$OSTREE diff ${DIFF_ARGS} test2 ./ > ${test_tmpdir}/diff-test2-2
 rm oh-look-a-file
 cd ${test_tmpdir}
 assert_file_has_content diff-test2-2 'A *oh-look-a-file$'
@@ -437,7 +435,7 @@ echo "ok user checkout"
 $OSTREE commit ${COMMIT_ARGS} -b test2 -s "Another commit" --tree=ref=test2
 echo "ok commit from ref"
 
-$OSTREE commit ${COMMIT_ARGS} -b test2 -s "Another commit with modifier" --tree=ref=test2 --owner-uid=`id -u`
+$OSTREE commit ${COMMIT_ARGS} -b test2 -s "Another commit with modifier" --tree=ref=test2 --mode-ro-executables
 echo "ok commit from ref with modifier"
 
 $OSTREE commit ${COMMIT_ARGS} -b trees/test2 -s 'ref with / in it' --tree=ref=test2
@@ -457,11 +455,18 @@ $OSTREE commit ${COMMIT_ARGS} --skip-if-unchanged -b trees/test2 -s 'should not
 $OSTREE ls -R -C test2
 new_rev=$($OSTREE rev-parse test2)
 assert_streq "${old_rev}" "${new_rev}"
+$OSTREE fsck
 echo "ok commit --skip-if-unchanged"
 
 cd ${test_tmpdir}/checkout-test2-4
+# Unfortunately later tests depend on this right now, so commit anyways
 $OSTREE commit ${COMMIT_ARGS} -b test2 -s "no xattrs" --no-xattrs
-echo "ok commit with no xattrs"
+if have_selinux_relabel; then
+    echo "ok # SKIP we get an injected security.selinux xattr regardless, so we can't do this"
+else
+    $OSTREE fsck
+    echo "ok commit with no xattrs"
+fi
 
 mkdir tree-A tree-B
 touch tree-A/file-a tree-B/file-b
@@ -706,7 +711,7 @@ for x in $(seq 3); do
     # But they share the GPL
     echo 'this is the GPL' > pkg${x}/usr/share/licenses/COPYING
     ln -s COPYING pkg${x}/usr/share/licenses/LICENSE
-    $OSTREE commit -b union-identical-pkg${x} --tree=dir=pkg${x}
+    $OSTREE commit ${COMMIT_ARGS} -b union-identical-pkg${x} --tree=dir=pkg${x}
 done
 rm union-identical-test -rf
 for x in $(seq 3); do
@@ -756,7 +761,7 @@ cd ${test_tmpdir}
 rm files -rf && mkdir files
 touch files/anemptyfile
 touch files/anotheremptyfile
-$CMD_PREFIX ostree --repo=repo commit --consume -b tree-with-empty-files --tree=dir=files
+$CMD_PREFIX ostree --repo=repo commit ${COMMIT_ARGS} --consume -b tree-with-empty-files --tree=dir=files
 $CMD_PREFIX ostree --repo=repo checkout ${CHECKOUT_H_ARGS} tree-with-empty-files tree-with-empty-files
 if files_are_hardlinked tree-with-empty-files/an{,other}emptyfile; then
     fatal "--force-copy-zerosized failed"
@@ -773,7 +778,7 @@ echo "ok checkout zero sized files are not hardlinked"
 $CMD_PREFIX ostree --repo=repo checkout ${CHECKOUT_H_ARGS} --union-identical -z tree-with-empty-files tree-with-empty-files
 $CMD_PREFIX ostree --repo=repo checkout ${CHECKOUT_H_ARGS} --union-identical -z tree-with-empty-files tree-with-empty-files
 echo notempty > tree-with-empty-files/anemptyfile.new && mv tree-with-empty-files/anemptyfile{.new,}
-$CMD_PREFIX ostree --repo=repo commit --consume -b tree-with-conflicting-empty-files --tree=dir=tree-with-empty-files
+$CMD_PREFIX ostree --repo=repo commit ${COMMIT_ARGS} --consume -b tree-with-conflicting-empty-files --tree=dir=tree-with-empty-files
 # Reset back to base
 rm tree-with-empty-files -rf
 $CMD_PREFIX ostree --repo=repo checkout ${CHECKOUT_H_ARGS} --union-identical -z tree-with-empty-files tree-with-empty-files
@@ -787,11 +792,17 @@ cd ${test_tmpdir}
 rm files -rf && mkdir files
 mkdir files/worldwritable-dir
 chmod a+w files/worldwritable-dir
-$CMD_PREFIX ostree --repo=repo commit -b content-with-dir-world-writable --tree=dir=files
+$OSTREE commit ${COMMIT_ARGS} -b content-with-dir-world-writable --tree=dir=files
+# FIXME(lucab): this seems to fail in unprivileged bare mode.
+if ! have_selinux_relabel; then
+    $OSTREE fsck
+fi
 rm dir-co -rf
-$CMD_PREFIX ostree --repo=repo checkout -U -H -M content-with-dir-world-writable dir-co
-assert_file_has_mode dir-co/worldwritable-dir 775
-if ! is_bare_user_only_repo repo; then
+$OSTREE checkout -U -H -M content-with-dir-world-writable dir-co
+if is_bare_user_only_repo repo; then
+    assert_file_has_mode dir-co/worldwritable-dir 755
+else
+    assert_file_has_mode dir-co/worldwritable-dir 775
     rm dir-co -rf
     $CMD_PREFIX ostree --repo=repo checkout -U -H content-with-dir-world-writable dir-co
     assert_file_has_mode dir-co/worldwritable-dir 777

tests/libtest.sh

@@ -69,6 +69,10 @@ if ! test -f .testtmp; then
     touch .testtmp
 fi
 
+# Some distribution builds set this, but some of our build-time tests
+# assume this won't be used when committing
+unset SOURCE_DATE_EPOCH
+
 # Also, unbreak `tar` inside `make check`...Automake will inject
 # TAR_OPTIONS: --owner=0 --group=0 --numeric-owner presumably so that
 # tarballs are predictable, except we don't want this in our tests.
@@ -605,7 +609,7 @@ have_systemd_and_libmount() {
 # https://github.com/ostreedev/ostree/pull/1217
 skip_without_no_selinux_or_relabel () {
     if ! have_selinux_relabel; then
-        skip "this test requires xattr support"
+        skip "this test requires SELinux relabeling support"
     fi
 }
 

tests/pull-test.sh

@@ -55,10 +55,10 @@ function verify_initial_contents() {
 }
 
 if has_gpgme; then
-    echo "1..37"
+    echo "1..38"
 else
     # 3 tests needs GPG support
-    echo "1..34"
+    echo "1..35"
 fi
 
 # Try both syntaxes
@@ -598,6 +598,33 @@ assert_file_has_content err.txt "ONE BILLION DOLLARS"
 
 echo "ok unconfigured"
 
+cd ${test_tmpdir}
+${CMD_PREFIX} ostree --repo=repo remote add --custom-backend=ostree-rs-ext fromcontainer
+if ${CMD_PREFIX} ostree --repo=repo pull fromcontainer 2>err.txt; then
+    assert_not_reached "pull unexpectedly succeeded?"
+fi
+assert_file_has_content err.txt "remote 'fromcontainer' uses custom backend 'ostree-rs-ext'"
+
+for x in show-url refs; do
+if ${CMD_PREFIX} ostree --repo=repo remote "$x" fromcontainer 2>err.txt; then
+assert_file_has_content err.txt "remote 'fromcontainer' uses custom backend 'ostree-rs-ext'"
+    assert_not_reached "no url expected"
+fi
+assert_file_has_content err.txt "No \"url\" option in remote"
+done
+${CMD_PREFIX} ostree --repo=repo remote delete fromcontainer
+
+${CMD_PREFIX} ostree --repo=repo remote add --custom-backend=ostree-rs-ext fromcontainer2 docker://quay.io/examplecorp/foo
+if ${CMD_PREFIX} ostree --repo=repo pull fromcontainer2 main 2>err.txt; then
+    assert_not_reached "pull unexpectedly succeeded?"
+fi
+assert_file_has_content err.txt "remote 'fromcontainer2' uses custom backend 'ostree-rs-ext'"
+${CMD_PREFIX} ostree --repo=repo remote show-url fromcontainer2 >out.txt
+assert_file_has_content out.txt docker://quay.io/examplecorp/foo
+${CMD_PREFIX} ostree --repo=repo remote delete fromcontainer2
+
+echo "ok custom backend"
+
 cd ${test_tmpdir}
 repo_init
 ${CMD_PREFIX} ostree --repo=repo remote add origin-bad $(cat httpd-address)/ostree/noent

tests/test-admin-gpg.sh

@@ -148,4 +148,9 @@ ${CMD_PREFIX} ostree admin status > status.txt
 test -f status.txt
 assert_file_has_content status.txt "GPG: Signature made"
 assert_not_file_has_content status.txt "GPG: Can't check signature: public key not found"
+rm -f status.txt
+
+${CMD_PREFIX} ostree admin status --verify > status.txt
+assert_file_has_content status.txt "GPG: Signature made"
+rm -f status.txt
 echo 'ok gpg signature'

tests/test-basic-user-only.sh

@@ -25,7 +25,7 @@ set -euo pipefail
 
 mode="bare-user-only"
 setup_test_repository "$mode"
-extra_basic_tests=5
+extra_basic_tests=6
 . $(dirname $0)/basic-test.sh
 
 $CMD_PREFIX ostree --version > version.yaml
@@ -41,6 +41,7 @@ ostree_repo_init repo init --mode=bare-user-only
 cd ${test_tmpdir}
 rm repo-input -rf
 ostree_repo_init repo-input init --mode=archive
+
 cd ${test_tmpdir}
 cat > statoverride.txt <<EOF
 2048 /some-setuid
@@ -62,8 +63,8 @@ rm files -rf && mkdir files
 echo "a group writable file" > files/some-group-writable
 chmod 0664 files/some-group-writable
 $CMD_PREFIX ostree --repo=repo-input commit -b content-with-group-writable --tree=dir=files
-$CMD_PREFIX ostree pull-local --repo=repo repo-input
-$CMD_PREFIX ostree --repo=repo checkout -U -H content-with-group-writable groupwritable-co
+$OSTREE pull-local repo-input
+$OSTREE checkout -U -H content-with-group-writable groupwritable-co
 assert_file_has_mode groupwritable-co/some-group-writable 664
 echo "ok supported group writable"
 
@@ -74,8 +75,8 @@ rm files -rf && mkdir files
 mkdir files/worldwritable-dir
 chmod a+w files/worldwritable-dir
 $CMD_PREFIX ostree --repo=repo-input commit -b content-with-dir-world-writable --tree=dir=files
-$CMD_PREFIX ostree pull-local --repo=repo repo-input
-$CMD_PREFIX ostree --repo=repo checkout -U -H content-with-dir-world-writable dir-co
+$OSTREE pull-local repo-input
+$OSTREE checkout -U -H content-with-dir-world-writable dir-co
 assert_file_has_mode dir-co/worldwritable-dir 775
 echo "ok didn't make world-writable dir"
 
@@ -99,3 +100,18 @@ if ! skip_one_without_user_xattrs; then
     $OSTREE fsck -q
     echo "ok hardlink pull from bare-user"
 fi
+
+cd ${test_tmpdir}
+rm repo -rf
+ostree_repo_init repo init --mode=bare-user-only
+rm files -rf && mkdir files
+echo afile > files/afile
+chmod 0777 files/afile
+$OSTREE commit ${COMMIT_ARGS} -b perms files
+$OSTREE fsck
+rm out -rf
+$OSTREE checkout --force-copy perms out
+assert_file_has_mode out/afile 755
+$OSTREE checkout ${CHECKOUT_H_ARGS} --union-identical perms out
+assert_file_has_mode out/afile 755
+echo "ok automatic canonical perms for bare-user-only"

tests/test-commit-sign-sh-ext.c

@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2021 Red Hat, Inc.
+ *
+ * SPDX-License-Identifier: LGPL-2.0+
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+
+#include "libglnx.h"
+#include <ostree.h>
+
+static void
+assert_error_contains (GError **error, const char *msg)
+{
+  g_assert (error != NULL);
+  GError *actual = *error;
+  g_assert (actual != NULL);
+  if (strstr (actual->message, msg) == NULL)
+    g_error ("%s does not contain %s", actual->message, msg);
+  g_clear_error (error);
+}
+
+// Perhaps in the future we hook this up to a fuzzer
+static GBytes *
+corrupt (GBytes *input)
+{
+  gsize len = 0;
+  const guint8 *buf = g_bytes_get_data (input, &len);
+  g_assert_cmpint (len, >, 0);
+  g_assert_cmpint (len, <, G_MAXINT);
+  g_autofree char *newbuf = g_memdup (buf, len);
+  int o = g_random_int_range (0, len);
+  newbuf[o] = (newbuf[0] + 1);
+
+  return g_bytes_new_take (g_steal_pointer (&newbuf), len);
+}
+
+static gboolean
+run (GError **error)
+{
+  g_autoptr(OstreeRepo) repo = ostree_repo_open_at (AT_FDCWD, "repo", NULL, error);
+  if (!repo)
+    return FALSE;
+
+  g_autofree char *rev = NULL;
+  if (!ostree_repo_resolve_rev (repo, "origin:main", FALSE, &rev, error))
+    return FALSE;
+  g_assert (rev);
+  g_autoptr(GVariant) commit = NULL;
+  if (!ostree_repo_load_variant (repo, OSTREE_OBJECT_TYPE_COMMIT, rev, &commit, error))
+    return FALSE;
+  g_assert (commit);
+
+  g_autoptr(GVariant) detached_meta = NULL;
+  if (!ostree_repo_read_commit_detached_metadata (repo, rev, &detached_meta, NULL, error))
+    return FALSE;
+  g_assert (detached_meta);
+
+  g_autoptr(GBytes) commit_bytes = g_variant_get_data_as_bytes (commit);
+  g_autoptr(GBytes) detached_meta_bytes = g_variant_get_data_as_bytes (detached_meta);
+  g_autofree char *verify_report = NULL;
+  if (!ostree_repo_signature_verify_commit_data (repo, "origin", commit_bytes, detached_meta_bytes, 0, 
+                                                 &verify_report, error))
+    return FALSE;
+
+  if (ostree_repo_signature_verify_commit_data (repo, "origin", commit_bytes, detached_meta_bytes, 
+                                                OSTREE_REPO_VERIFY_FLAGS_NO_GPG | OSTREE_REPO_VERIFY_FLAGS_NO_SIGNAPI, 
+                                                &verify_report, error))
+    g_error ("Should not have validated");
+  assert_error_contains (error, "No commit verification types enabled");
+
+  // No signatures
+  g_autoptr(GBytes) empty = g_bytes_new_static ("", 0);
+  if (ostree_repo_signature_verify_commit_data (repo, "origin", commit_bytes, empty, 0, 
+                                                 &verify_report, error))
+    g_error ("Should not have validated");
+  assert_error_contains (error, "no signatures found");
+  // No such remote
+  if (ostree_repo_signature_verify_commit_data (repo, "nosuchremote", commit_bytes, detached_meta_bytes, 0, 
+                                                 &verify_report, error))
+    g_error ("Should not have validated");
+  assert_error_contains (error, "Remote \"nosuchremote\" not found");
+
+  // Corrupted commit
+  g_autoptr(GBytes) corrupted_commit = corrupt (commit_bytes);
+  if (ostree_repo_signature_verify_commit_data (repo, "origin", corrupted_commit, detached_meta_bytes, 0, 
+                                                 &verify_report, error))
+    g_error ("Should not have validated");
+  assert_error_contains (error, "BAD signature");
+
+  return TRUE;
+}
+
+int
+main (int argc, char **argv)
+{
+  g_autoptr(GError) error = NULL;
+  if (!run (&error))
+    {
+      g_printerr ("error: %s\n", error->message);
+      exit (1);
+    }
+}

tests/test-commit-sign.sh

@@ -28,7 +28,7 @@ if ! has_gpgme; then
     exit 0
 fi
 
-echo "1..6"
+echo "1..7"
 
 keyid="472CDAFA"
 oldpwd=`pwd`
@@ -85,9 +85,15 @@ ${CMD_PREFIX} ostree --repo=repo remote add origin $(cat httpd-address)/ostree/g
 ${CMD_PREFIX} ostree --repo=repo pull origin main
 ${CMD_PREFIX} ostree --repo=repo show --gpg-verify-remote=origin main > show.txt
 assert_file_has_content_literal show.txt 'Found 1 signature'
-rm repo -rf
 echo "ok pull verify"
 
+# Run tests written in C
+${OSTREE_UNINSTALLED}/tests/test-commit-sign-sh-ext
+echo "ok extra C tests"
+
+# Clean things up and reinit
+rm repo -rf
+
 # A test with corrupted detached signature
 cd ${test_tmpdir}
 find ${test_tmpdir}/ostree-srv/gnomerepo -name '*.commitmeta' | while read fname; do

tests/test-delta-sign.sh

@@ -169,6 +169,6 @@ ostree_repo_init repo2 --mode=bare-user
 ${CMD_PREFIX} ostree --repo=repo2 pull-local repo ${origrev}
 ${CMD_PREFIX} ostree --repo=repo2 ls ${origrev} >/dev/null
 ${CMD_PREFIX} ostree --repo=repo2 static-delta apply-offline --sign-type=dummy repo/deltas/${deltaprefix}/${deltadir} badsign 2> apply-offline-bad-key.txt && exit 1
-assert_file_has_content apply-offline-bad-key.txt "signature: dummy: incorrect signature"
+assert_file_has_content apply-offline-bad-key.txt "signature: dummy: incorrect signatures found: 1"
 
 echo 'ok apply offline failed with dummy and bad key'

tests/test-remote-gpg-list-keys.sh

@@ -0,0 +1,152 @@
+#!/bin/bash
+#
+# Copyright © 2021 Endless OS Foundation LLC
+#
+# SPDX-License-Identifier: LGPL-2.0+
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+# Boston, MA 02111-1307, USA.
+
+set -euo pipefail
+
+. $(dirname $0)/libtest.sh
+
+# We don't want OSTREE_GPG_HOME used for most of these tests.
+emptydir=${test_tmpdir}/empty
+trusteddir=${OSTREE_GPG_HOME}
+mkdir ${emptydir}
+OSTREE_GPG_HOME=${emptydir}
+
+# Key listings show dates using the local timezone, so specify UTC for
+# consistency.
+export TZ=UTC
+
+# Some tests require an appropriate gpg
+num_non_gpg_tests=5
+num_gpg_tests=2
+num_tests=$((num_non_gpg_tests + num_gpg_tests))
+
+echo "1..${num_tests}"
+
+setup_test_repository "archive"
+
+cd ${test_tmpdir}
+${OSTREE} remote add R1 http://example.com/repo
+
+# No remote keyring should list no keys.
+${OSTREE} remote gpg-list-keys R1 > result
+assert_file_empty result
+
+echo "ok remote no keyring"
+
+# Make the global keyring available and make sure there are still no
+# keys found for a specified remote.
+OSTREE_GPG_HOME=${trusteddir}
+${OSTREE} remote gpg-list-keys R1 > result
+OSTREE_GPG_HOME=${emptydir}
+assert_file_empty result
+
+echo "ok remote with global keyring"
+
+# Import a key and check that it's listed
+${OSTREE} remote gpg-import --keyring ${TEST_GPG_KEYHOME}/key1.asc R1
+${OSTREE} remote gpg-list-keys R1 > result
+cat > expected <<"EOF"
+Key: 5E65DE75AB1C501862D476347FCA23D8472CDAFA
+  Created: Tue Sep 10 02:29:42 2013
+  UID: Ostree Tester <test@test.com>
+  Advanced update URL: https://openpgpkey.test.com/.well-known/openpgpkey/test.com/hu/iffe93qcsgp4c8ncbb378rxjo6cn9q6u?l=test
+  Direct update URL: https://test.com/.well-known/openpgpkey/hu/iffe93qcsgp4c8ncbb378rxjo6cn9q6u?l=test
+  Subkey: CC47B2DFB520AEF231180725DF20F58B408DEA49
+    Created: Tue Sep 10 02:29:42 2013
+EOF
+assert_files_equal result expected
+
+echo "ok remote with keyring"
+
+# Check the global keys with no keyring
+OSTREE_GPG_HOME=${emptydir}
+${OSTREE} remote gpg-list-keys > result
+assert_file_empty result
+
+echo "ok global no keyring"
+
+# Now check the global keys with a keyring
+OSTREE_GPG_HOME=${trusteddir}
+${OSTREE} remote gpg-list-keys > result
+OSTREE_GPG_HOME=${emptydir}
+cat > expected <<"EOF"
+Key: 5E65DE75AB1C501862D476347FCA23D8472CDAFA
+  Created: Tue Sep 10 02:29:42 2013
+  UID: Ostree Tester <test@test.com>
+  Advanced update URL: https://openpgpkey.test.com/.well-known/openpgpkey/test.com/hu/iffe93qcsgp4c8ncbb378rxjo6cn9q6u?l=test
+  Direct update URL: https://test.com/.well-known/openpgpkey/hu/iffe93qcsgp4c8ncbb378rxjo6cn9q6u?l=test
+  Subkey: CC47B2DFB520AEF231180725DF20F58B408DEA49
+    Created: Tue Sep 10 02:29:42 2013
+Key: 7B3B1020D74479687FDB2273D8228CFECA950D41
+  Created: Tue Mar 17 14:00:32 2015
+  UID: Ostree Tester II <test2@test.com>
+  Advanced update URL: https://openpgpkey.test.com/.well-known/openpgpkey/test.com/hu/nnxwsxno46ap6hw7fgphp68j76egpfa9?l=test2
+  Direct update URL: https://test.com/.well-known/openpgpkey/hu/nnxwsxno46ap6hw7fgphp68j76egpfa9?l=test2
+  Subkey: 1EFA95C06EB1EB91754575E004B69C2560D53993
+    Created: Tue Mar 17 14:00:32 2015
+Key: 7D29CF060B8269CDF63BFBDD0D15FAE7DF444D67
+  Created: Tue Mar 17 14:01:05 2015
+  UID: Ostree Tester III <test3@test.com>
+  Advanced update URL: https://openpgpkey.test.com/.well-known/openpgpkey/test.com/hu/8494gyqhmrcs6gn38tn6kgjexet117cj?l=test3
+  Direct update URL: https://test.com/.well-known/openpgpkey/hu/8494gyqhmrcs6gn38tn6kgjexet117cj?l=test3
+  Subkey: 0E45E48CBF7B360C0E04443E0C601A7402416340
+    Created: Tue Mar 17 14:01:05 2015
+EOF
+assert_files_equal result expected
+
+echo "ok global with keyring"
+
+# Tests checking for expiration and revocation listings require gpg.
+GPG=$(which_gpg)
+if [ -z "${GPG}" ]; then
+    # Print a skip message per skipped test
+    for (( i = 0; i < num_gpg_tests; i++ )); do
+        echo "ok # SKIP this test requires gpg"
+    done
+else
+    # The GPG private keyring in gpghome is in the older secring.gpg
+    # format, but we're likely using a newer gpg. Normally it's
+    # implicitly migrated to the newer format, but this test hasn't
+    # signed anything, so the private keys haven't been loaded. Force
+    # the migration by listing the private keys.
+    ${GPG} --homedir=${test_tmpdir}/gpghome -K >/dev/null
+
+    # Expire key1, wait for it to be expired and re-import it.
+    ${GPG} --homedir=${test_tmpdir}/gpghome --quick-set-expire ${TEST_GPG_KEYFPR_1} seconds=1
+    sleep 2
+    ${GPG} --homedir=${test_tmpdir}/gpghome --armor --export ${TEST_GPG_KEYID_1} > ${test_tmpdir}/key1expired.asc
+    ${OSTREE} remote gpg-import --keyring ${test_tmpdir}/key1expired.asc R1
+    ${OSTREE} remote gpg-list-keys R1 > result
+    assert_file_has_content result "^  Expired:"
+
+    echo "ok remote expired key"
+
+    # Revoke key1 and re-import it.
+    ${GPG} --homedir=${TEST_GPG_KEYHOME} --import ${TEST_GPG_KEYHOME}/revocations/key1.rev
+    ${GPG} --homedir=${test_tmpdir}/gpghome --armor --export ${TEST_GPG_KEYID_1} > ${test_tmpdir}/key1revoked.asc
+    ${OSTREE} remote gpg-import --keyring ${test_tmpdir}/key1revoked.asc R1
+    ${OSTREE} remote gpg-list-keys R1 > result
+    assert_file_has_content result "^Key: 5E65DE75AB1C501862D476347FCA23D8472CDAFA (revoked)"
+    assert_file_has_content result "^  UID: Ostree Tester <test@test.com> (revoked)"
+    assert_file_has_content result "^  Subkey: CC47B2DFB520AEF231180725DF20F58B408DEA49 (revoked)"
+
+    echo "ok remote revoked key"
+fi

tests/test-symbols.sh

@@ -56,7 +56,7 @@ echo 'ok documented symbols'
 
 # ONLY update this checksum in release commits!
 cat > released-sha256.txt <<EOF
-d4eb6d642150d9285b399c7a429603124aeda4215d3f62b92ad3956f04dd2dfe  ${released_syms}
+9d020c9696a6df66b32714dc1ef37d06bb90b4adf8b248558b5838f9ee18729a  ${released_syms}
 EOF
 sha256sum -c released-sha256.txt