New upstream version 2019.3

tests/admin-test.sh

@@ -21,7 +21,15 @@
 
 set -euo pipefail
 
-echo "1..$((26 + ${extra_admin_tests:-0}))"
+echo "1..$((27 + ${extra_admin_tests:-0}))"
+
+mkdir sysrootmin
+${CMD_PREFIX} ostree admin init-fs --modern sysrootmin
+assert_has_dir sysrootmin/boot
+assert_has_dir sysrootmin/ostree/repo
+assert_not_has_dir sysrootmin/home
+rm sysrootmin -rf
+echo "ok init-fs --modern"
 
 function validate_bootloader() {
     cd ${test_tmpdir};
@@ -48,7 +56,7 @@ orig_mtime=$(stat -c '%.Y' sysroot/ostree/deploy)
 ${CMD_PREFIX} ostree --repo=sysroot/ostree/repo pull-local --remote=testos testos-repo testos/buildmaster/x86_64-runtime
 rev=$(${CMD_PREFIX} ostree --repo=sysroot/ostree/repo rev-parse testos/buildmaster/x86_64-runtime)
 export rev
-# This initial deployment gets kicked off with some kernel arguments 
+# This initial deployment gets kicked off with some kernel arguments
 ${CMD_PREFIX} ostree admin deploy --karg=root=LABEL=MOO --karg=quiet --os=testos testos:testos/buildmaster/x86_64-runtime
 new_mtime=$(stat -c '%.Y' sysroot/ostree/deploy)
 assert_not_streq "${orig_mtime}" "${new_mtime}"

tests/libtest.sh

@@ -34,13 +34,24 @@ else
 fi
 . ${test_srcdir}/libtest-core.sh
 
+# Array of expressions to execute when exiting. Each expression should
+# be a single string (quoting if necessary) that will be eval'd. To add
+# a command to run on exit, append to the libtest_exit_cmds array like
+# libtest_exit_cmds+=(expr).
+libtest_exit_cmds=()
+run_exit_cmds() {
+  for expr in "${libtest_exit_cmds[@]}"; do
+    eval "${expr}" || true
+  done
+}
+trap run_exit_cmds EXIT
+
 save_core() {
   if [ -e core ]; then
     cp core "$test_srcdir/core"
   fi
 }
-
-trap save_core EXIT;
+libtest_exit_cmds+=(save_core)
 
 test_tmpdir=$(pwd)
 
@@ -594,15 +605,58 @@ skip_without_experimental () {
 }
 
 has_gpgme () {
+    local ret
     ${CMD_PREFIX} ostree --version > version.txt
-    assert_file_has_content version.txt '- gpgme'
+    grep -q -e '- gpgme' version.txt
+    ret=$?
     rm -f version.txt
-    true
+    return ${ret}
+}
+
+skip_without_gpgme() {
+    if ! has_gpgme; then
+        skip "no gpg support compiled in"
+    fi
+}
+
+# Find an appropriate gpg program to use. We want one that has the
+# --generate-key, --quick-set-expire and --quick-add-key options. The
+# gpg program to use is returend.
+which_gpg () {
+    local gpg
+    local gpg_options
+    local needed_options=(
+        --generate-key
+        --quick-set-expire
+        --quick-add-key
+    )
+    local opt
+
+    # Prefer gpg2 in case gpg refers to gpg1
+    if which gpg2 &>/dev/null; then
+        gpg=gpg2
+    elif which gpg &>/dev/null; then
+        gpg=gpg
+    else
+        # Succeed but don't return anything.
+        return 0
+    fi
+
+    # Make sure all the needed options are available
+    gpg_options=$(${gpg} --dump-options) || return 0
+    for opt in ${needed_options[*]}; do
+      grep -q -x -e "${opt}" <<< "${gpg_options}" || return 0
+    done
+
+    # Found an appropriate gpg
+    echo ${gpg}
 }
 
 libtest_cleanup_gpg () {
-    gpg-connect-agent --homedir ${test_tmpdir}/gpghome killagent /bye || true
+    local gpg_homedir=${1:-${test_tmpdir}/gpghome}
+    gpg-connect-agent --homedir "${gpg_homedir}" killagent /bye || true
 }
+libtest_exit_cmds+=(libtest_cleanup_gpg)
 
 is_bare_user_only_repo () {
   grep -q 'mode=bare-user-only' $1/config

tests/pull-test.sh

@@ -54,7 +54,12 @@ function verify_initial_contents() {
     assert_file_has_content baz/cow '^moo$'
 }
 
-echo "1..34"
+if has_gpgme; then
+    echo "1..34"
+else
+    # 3 tests needs GPG support
+    echo "1..31"
+fi
 
 # Try both syntaxes
 repo_init --no-gpg-verify
@@ -334,6 +339,12 @@ if ${CMD_PREFIX} ostree --repo=repo pull -T origin main 2>err.txt; then
 fi
 assert_file_has_content err.txt "Upgrade.*is chronologically older"
 assert_streq ${newrev} "$(${CMD_PREFIX} ostree --repo=repo rev-parse main)"
+# And also check we can't pull it when using overrides
+if ${CMD_PREFIX} ostree --repo=repo pull -T origin main@${newrev2} 2>err.txt; then
+    fatal "pulled older commit override with timestamp checking enabled?"
+fi
+assert_file_has_content err.txt "Upgrade.*is chronologically older"
+assert_streq ${newrev} "$(${CMD_PREFIX} ostree --repo=repo rev-parse main)"
 # But we can pull it without timestamp checking
 ${CMD_PREFIX} ostree --repo=repo pull origin main
 echo "ok pull timestamp checking"
@@ -537,13 +548,15 @@ fi
 assert_file_has_content err.txt "404"
 echo "ok pull repo 404"
 
-cd ${test_tmpdir}
-repo_init --set=gpg-verify=true
-if ${CMD_PREFIX} ostree --repo=repo --depth=0 pull origin main 2>err.txt; then
-    assert_not_reached "pull repo 404 succeeded?"
+if has_gpgme; then
+    cd ${test_tmpdir}
+    repo_init --set=gpg-verify=true
+    if ${CMD_PREFIX} ostree --repo=repo --depth=0 pull origin main 2>err.txt; then
+        assert_not_reached "pull repo 404 succeeded?"
+    fi
+    assert_file_has_content err.txt "GPG verification enabled, but no signatures found"
+    echo "ok pull repo 404 (gpg)"
 fi
-assert_file_has_content err.txt "GPG verification enabled, but no signatures found"
-echo "ok pull repo 404 (gpg)"
 
 cd ${test_tmpdir}
 find ostree-srv/gnomerepo/objects -name '*.dirtree' | while read f; do mv ${f}{,.orig}; done
@@ -555,29 +568,31 @@ assert_file_has_content err.txt "404"
 find ostree-srv/gnomerepo/objects -name '*.dirtree.orig' | while read f; do mv ${f} $(dirname $f)/$(basename ${f} .orig); done
 echo "ok pull repo 404 on dirtree object"
 
-cd ${test_tmpdir}
-repo_init --set=gpg-verify=true
-${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo commit ${COMMIT_ARGS} \
-  --gpg-homedir=${TEST_GPG_KEYHOME} --gpg-sign=${TEST_GPG_KEYID_1} -b main \
-  -s "A signed commit" --tree=ref=main
-${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo summary -u
-# make sure gpg verification is correctly on
-csum=$(${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo rev-parse main)
-objpath=objects/${csum::2}/${csum:2}.commitmeta
-remotesig=ostree-srv/gnomerepo/$objpath
-localsig=repo/$objpath
-mv $remotesig $remotesig.bak
-if ${CMD_PREFIX} ostree --repo=repo --depth=0 pull origin main; then
-    assert_not_reached "pull with gpg-verify unexpectedly succeeded?"
+if has_gpgme; then
+    cd ${test_tmpdir}
+    repo_init --set=gpg-verify=true
+    ${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo commit ${COMMIT_ARGS} \
+      --gpg-homedir=${TEST_GPG_KEYHOME} --gpg-sign=${TEST_GPG_KEYID_1} -b main \
+      -s "A signed commit" --tree=ref=main
+    ${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo summary -u
+    # make sure gpg verification is correctly on
+    csum=$(${CMD_PREFIX} ostree --repo=ostree-srv/gnomerepo rev-parse main)
+    objpath=objects/${csum::2}/${csum:2}.commitmeta
+    remotesig=ostree-srv/gnomerepo/$objpath
+    localsig=repo/$objpath
+    mv $remotesig $remotesig.bak
+    if ${CMD_PREFIX} ostree --repo=repo --depth=0 pull origin main; then
+        assert_not_reached "pull with gpg-verify unexpectedly succeeded?"
+    fi
+    # ok now check that we can pull correctly
+    mv $remotesig.bak $remotesig
+    ${CMD_PREFIX} ostree --repo=repo pull origin main
+    echo "ok pull signed commit"
+    rm $localsig
+    ${CMD_PREFIX} ostree --repo=repo pull origin main
+    test -f $localsig
+    echo "ok re-pull signature for stored commit"
 fi
-# ok now check that we can pull correctly
-mv $remotesig.bak $remotesig
-${CMD_PREFIX} ostree --repo=repo pull origin main
-echo "ok pull signed commit"
-rm $localsig
-${CMD_PREFIX} ostree --repo=repo pull origin main
-test -f $localsig
-echo "ok re-pull signature for stored commit"
 
 cd ${test_tmpdir}
 repo_init --no-gpg-verify

tests/test-admin-deploy-2.sh

@@ -102,8 +102,7 @@ ${CMD_PREFIX} ostree admin pin -u 0
 assert_n_pinned 0
 echo "ok pin unpin"
 
-${CMD_PREFIX} ostree admin pin 0
-${CMD_PREFIX} ostree admin pin 1
+${CMD_PREFIX} ostree admin pin 0 1
 assert_n_pinned 2
 assert_n_deployments 2
 os_repository_new_commit

tests/test-commit-sign.sh

@@ -140,4 +140,3 @@ assert_not_file_has_content show.txt 'Found.*signature'
 echo "ok pull sig deleted"
 
 rm -rf repo gnomerepo-files
-libtest_cleanup_gpg

tests/test-config.sh

@@ -66,9 +66,11 @@ fi
 assert_file_has_content err.txt "error: Too many arguments given"
 echo "ok config set"
 
-# Check that "ostree config unset" works
+# Check that using `--` works and that "ostree config unset" works
 ${CMD_PREFIX} ostree config --repo=repo set core.lock-timeout-secs 60
 assert_file_has_content repo/config "lock-timeout-secs=60"
+${CMD_PREFIX} ostree config --repo=repo -- set core.lock-timeout-secs -1
+assert_file_has_content repo/config "lock-timeout-secs=-1"
 ${CMD_PREFIX} ostree config --repo=repo unset core.lock-timeout-secs
 assert_not_file_has_content repo/config "lock-timeout-secs="
 

tests/test-create-usb.sh

@@ -26,6 +26,8 @@ set -euo pipefail
 
 . $(dirname $0)/libtest.sh
 
+skip_without_gpgme
+
 echo "1..5"
 
 cd ${test_tmpdir}

tests/test-find-remotes.sh

@@ -23,6 +23,8 @@ set -euo pipefail
 
 . $(dirname $0)/libtest.sh
 
+skip_without_gpgme
+
 echo '1..1'
 
 # Create two upstream collection repositories with some example commits

tests/test-gpg-signed-commit.sh

@@ -29,7 +29,16 @@ if ! has_gpgme; then
     exit 0
 fi
 
-echo "1..1"
+num_tests=1
+
+# Run some more tests if an appropriate GPG is available
+num_gpg_tests=8
+GPG=$(which_gpg)
+if [ -n "${GPG}" ]; then
+  let num_tests+=num_gpg_tests
+fi
+
+echo "1..${num_tests}"
 
 setup_test_repository "archive"
 
@@ -80,6 +89,241 @@ if ${OSTREE} show test2 | grep -o 'Found [[:digit:]] signature'; then
   assert_not_reached
 fi
 
-libtest_cleanup_gpg
-
 echo "ok"
+
+# Remaining tests require gpg
+if [ -z "${GPG}" ]; then
+  exit 0
+fi
+
+# Although we have the gpg --set-expire option, we want to use it to set
+# the expiration date for subkeys below. That was only added in gnupg
+# 2.1.22. Check if SUBKEY-FPRS is in the usage output.
+# (https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=NEWS;hb=HEAD)
+if (${GPG} --quick-set-expire 2>&1 || :) | grep -q SUBKEY-FPRS; then
+  GPG_CAN_EXPIRE_SUBKEYS=true
+else
+  GPG_CAN_EXPIRE_SUBKEYS=false
+fi
+
+# Create a temporary GPG homedir
+tmpgpg_home=${test_tmpdir}/tmpgpghome
+mkdir -m700 ${tmpgpg_home}
+
+# Wire up an exit hook to kill the gpg-agent in it
+cleanup_tmpgpg_home() {
+  libtest_cleanup_gpg ${tmpgpg_home}
+}
+libtest_exit_cmds+=(cleanup_tmpgpg_home)
+
+# Create an temporary trusted GPG directory
+tmpgpg_trusted=${test_tmpdir}/tmpgpgtrusted
+tmpgpg_trusted_keyring=${tmpgpg_trusted}/keyring.gpg
+export OSTREE_GPG_HOME=${tmpgpg_trusted}
+mkdir -p ${tmpgpg_trusted}
+
+# Create one normal signing key and one signing key with a subkey. See
+# https://www.gnupg.org/documentation/manuals/gnupg/Unattended-GPG-key-generation.html.
+${GPG} --homedir=${tmpgpg_home} --batch --generate-key <<"EOF"
+Key-Type: RSA
+Key-Length: 2048
+Key-Usage: sign
+Name-Real: Test Key 1
+Expire-Date: 0
+%no-protection
+%transient-key
+%commit
+Key-Type: RSA
+Key-Length: 2048
+Key-Usage: sign
+Subkey-Type: RSA
+Subkey-Length: 2048
+Subkey-Usage: sign
+Name-Real: Test Key 2
+Expire-Date: 0
+%no-protection
+%transient-key
+%commit
+EOF
+
+# Figure out the key IDs and fingerprints. Assume that the order of the
+# keys matches those specified in the generation.
+#
+# https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob_plain;f=doc/DETAILS
+key1_id=
+key1_fpr=
+key2_id=
+key2_fpr=
+key2_sub_id=
+key2_sub_fpr=
+gpg_seckey_listing=$(${GPG} --homedir=${tmpgpg_home} --list-secret-keys --with-colons)
+while IFS=: read -a fields; do
+  if [ "${fields[0]}" = sec ]; then
+    # Secret key - key ID is in field 5
+    if [ -z "${key1_id}" ]; then
+      key1_id=${fields[4]}
+    else
+      key2_id=${fields[4]}
+    fi
+  elif [ "${fields[0]}" = ssb ]; then
+    # Secret subkey - key ID is in field 5
+    key2_sub_id=${fields[4]}
+  elif [ "${fields[0]}" = fpr ]; then
+    # Fingerprint record - the fingerprint ID is in field 10
+    if [ -z "${key1_fpr}" ]; then
+      key1_fpr=${fields[9]}
+    elif [ -z "${key2_fpr}" ]; then
+      key2_fpr=${fields[9]}
+    else
+      key2_sub_fpr=${fields[9]}
+    fi
+  fi
+done <<< "${gpg_seckey_listing}"
+
+# Create a commit and sign it with both key1 and key2_sub
+${OSTREE} commit -b test2 -s "A GPG signed commit" -m "Signed commit body" \
+  --tree=dir=files --gpg-homedir=${tmpgpg_home} \
+  --gpg-sign=${key1_id} --gpg-sign=${key2_sub_id}
+${OSTREE} show test2 > test2-show
+assert_file_has_content test2-show '^Found 2 signatures'
+assert_file_has_content test2-show 'public key not found'
+assert_file_has_content test2-show "${key1_id}"
+assert_file_has_content test2-show "${key2_sub_id}"
+
+echo "ok signed with both generated keys"
+
+# Export the public keys and check again
+${GPG} --homedir=${tmpgpg_home} --export ${key1_id} ${key2_id} > ${tmpgpg_trusted_keyring}
+${OSTREE} show test2 > test2-show
+assert_file_has_content test2-show '^Found 2 signatures'
+assert_not_file_has_content test2-show 'public key not found'
+assert_file_has_content test2-show "${key1_id}"
+assert_file_has_content test2-show "${key2_sub_id}"
+assert_file_has_content test2-show 'Good signature from "Test Key 1 <>"'
+assert_file_has_content test2-show 'Good signature from "Test Key 2 <>"'
+assert_file_has_content test2-show "Primary key ID ${key2_id}"
+
+echo "ok verified both generated keys"
+
+# Make key1 expired, wait until it's expired, export the public keys and check
+# again
+${GPG} --homedir=${tmpgpg_home} --quick-set-expire ${key1_fpr} seconds=1
+sleep 2
+${GPG} --homedir=${tmpgpg_home} --export ${key1_id} ${key2_id} > ${tmpgpg_trusted_keyring}
+${OSTREE} show test2 > test2-show
+assert_file_has_content test2-show '^Found 2 signatures'
+assert_not_file_has_content test2-show 'public key not found'
+assert_file_has_content test2-show "${key1_id}"
+assert_file_has_content test2-show "${key2_sub_id}"
+assert_file_has_content test2-show 'BAD signature from "Test Key 1 <>"'
+assert_file_has_content test2-show 'Key expired'
+assert_file_has_content test2-show 'Good signature from "Test Key 2 <>"'
+assert_file_has_content test2-show "Primary key ID ${key2_id}"
+
+echo "ok verified with key1 expired"
+
+# Unexpire key1, expire key2 primary, wait until it's expired, export the
+# public keys and check again
+${GPG} --homedir=${tmpgpg_home} --quick-set-expire ${key1_fpr} seconds=0
+${GPG} --homedir=${tmpgpg_home} --quick-set-expire ${key2_fpr} seconds=1
+sleep 2
+${GPG} --homedir=${tmpgpg_home} --export ${key1_id} ${key2_id} > ${tmpgpg_trusted_keyring}
+${OSTREE} show test2 > test2-show
+assert_file_has_content test2-show '^Found 2 signatures'
+assert_not_file_has_content test2-show 'public key not found'
+assert_file_has_content test2-show "${key1_id}"
+assert_file_has_content test2-show "${key2_sub_id}"
+assert_file_has_content test2-show 'Good signature from "Test Key 1 <>"'
+assert_file_has_content test2-show 'BAD signature from "Test Key 2 <>"'
+assert_not_file_has_content test2-show 'Key expired'
+assert_file_has_content test2-show "Primary key ID ${key2_id}"
+assert_file_has_content test2-show 'Primary key expired'
+
+echo "ok verified with key2 primary expired"
+
+# If subkey expiration is available, expire key2 subkey, wait until it's
+# expired, export the public keys and check again
+if ${GPG_CAN_EXPIRE_SUBKEYS}; then
+  ${GPG} --homedir=${tmpgpg_home} --quick-set-expire ${key2_fpr} seconds=1 ${key2_sub_fpr}
+  sleep 2
+  ${GPG} --homedir=${tmpgpg_home} --export ${key1_id} ${key2_id} > ${tmpgpg_trusted_keyring}
+  ${OSTREE} show test2 > test2-show
+  assert_file_has_content test2-show '^Found 2 signatures'
+  assert_not_file_has_content test2-show 'public key not found'
+  assert_file_has_content test2-show "${key1_id}"
+  assert_file_has_content test2-show "${key2_sub_id}"
+  assert_file_has_content test2-show 'Good signature from "Test Key 1 <>"'
+  assert_file_has_content test2-show 'BAD signature from "Test Key 2 <>"'
+  assert_file_has_content test2-show 'Key expired'
+  assert_file_has_content test2-show "Primary key ID ${key2_id}"
+  assert_file_has_content test2-show 'Primary key expired'
+
+  echo "ok verified with key2 primary and subkey expired"
+else
+  echo "ok # SKIP gpg --quick-set-expire does not support expiring subkeys"
+fi
+
+# Unexpire key2 primary and export the public keys
+${GPG} --homedir=${tmpgpg_home} --quick-set-expire ${key2_fpr} seconds=0
+${GPG} --homedir=${tmpgpg_home} --export ${key1_id} ${key2_id} > ${tmpgpg_trusted_keyring}
+
+# This test expects the subkey to be expired, so skip it if that didn't happen
+if ${GPG_CAN_EXPIRE_SUBKEYS}; then
+  ${OSTREE} show test2 > test2-show
+  assert_file_has_content test2-show '^Found 2 signatures'
+  assert_not_file_has_content test2-show 'public key not found'
+  assert_file_has_content test2-show "${key1_id}"
+  assert_file_has_content test2-show "${key2_sub_id}"
+  assert_file_has_content test2-show 'Good signature from "Test Key 1 <>"'
+  assert_file_has_content test2-show 'BAD signature from "Test Key 2 <>"'
+  assert_file_has_content test2-show 'Key expired'
+  assert_file_has_content test2-show "Primary key ID ${key2_id}"
+  assert_not_file_has_content test2-show 'Primary key expired'
+
+  echo "ok verified with key2 subkey expired"
+else
+  echo "ok # SKIP gpg --quick-set-expire does not support expiring subkeys"
+fi
+
+# Add a second subkey but don't export it to the trusted keyring so that a new
+# commit signed with fails.
+${GPG} --homedir=${tmpgpg_home} --batch --passphrase '' \
+  --quick-add-key ${key2_fpr} rsa2048 sign never
+gpg_seckey_listing=$(${GPG} --homedir=${tmpgpg_home} --list-secret-keys --with-colons)
+key2_sub2_id=$(awk -F: '{if ($1 == "ssb") print $5}' <<< "${gpg_seckey_listing}" | tail -n1)
+key2_sub2_fpr=$(awk -F: '{if ($1 == "fpr") print $10}' <<< "${gpg_seckey_listing}" | tail -n1)
+${OSTREE} commit -b test2 -s "A GPG signed commit" -m "Signed commit body" \
+  --tree=dir=files --gpg-homedir=${tmpgpg_home} \
+  --gpg-sign=${key1_id} --gpg-sign=${key2_sub2_id}
+${OSTREE} show test2 > test2-show
+assert_file_has_content test2-show '^Found 2 signatures'
+assert_file_has_content test2-show "${key1_id}"
+assert_file_has_content test2-show "${key2_sub2_id}"
+assert_file_has_content test2-show 'Good signature from "Test Key 1 <>"'
+assert_file_has_content test2-show 'public key not found'
+
+echo "ok verified with key2 sub2 missing"
+
+# Revoke key1 by importing the revocation certificate created when generating
+# the key. The cert should be in $homedir/openpgp-revocs.d/$fpr.rev with
+# recent gnupg. However, it tries to prevent you from accidentally revoking
+# things by adding a : before the block, so it needs to be stripped.
+key1_rev=${tmpgpg_home}/openpgp-revocs.d/${key1_fpr}.rev
+if [ -f ${key1_rev} ]; then
+  sed -i '/BEGIN PGP PUBLIC KEY BLOCK/s/^://' ${key1_rev}
+  ${GPG} --homedir=${tmpgpg_home} --import ${key1_rev}
+  # Export both keys again
+  ${GPG} --homedir=${tmpgpg_home} --export ${key1_id} ${key2_id} > ${tmpgpg_trusted_keyring}
+  ${OSTREE} show test2 > test2-show
+  assert_file_has_content test2-show '^Found 2 signatures'
+  assert_not_file_has_content test2-show 'public key not found'
+  assert_file_has_content test2-show "${key1_id}"
+  assert_file_has_content test2-show "${key2_sub2_id}"
+  assert_file_has_content test2-show 'Key revoked'
+  assert_file_has_content test2-show 'Good signature from "Test Key 2 <>"'
+  assert_file_has_content test2-show "Primary key ID ${key2_id}"
+
+  echo "ok verified with key1 revoked"
+else
+  echo "ok # SKIP could not find key revocation certificate"
+fi

tests/test-gpg-verify-result.c

@@ -45,7 +45,8 @@ static OstreeGpgSignatureAttr some_attributes[] = {
   OSTREE_GPG_SIGNATURE_ATTR_SIG_EXPIRED,
   OSTREE_GPG_SIGNATURE_ATTR_KEY_EXPIRED,
   OSTREE_GPG_SIGNATURE_ATTR_KEY_REVOKED,
-  OSTREE_GPG_SIGNATURE_ATTR_KEY_MISSING
+  OSTREE_GPG_SIGNATURE_ATTR_KEY_MISSING,
+  OSTREE_GPG_SIGNATURE_ATTR_KEY_EXP_TIMESTAMP,
 };
 
 static void
@@ -174,7 +175,7 @@ test_attribute_basics (TestFixture *fixture,
       tuple = ostree_gpg_verify_result_get_all (fixture->result, ii);
 
       type_string = g_variant_get_type_string (tuple);
-      g_assert_cmpstr (type_string, ==, "(bbbbbsxxsssss)");
+      g_assert_cmpstr (type_string, ==, "(bbbbbsxxsssssxx)");
 
       /* Check attributes which should be common to all signatures. */
 
@@ -221,24 +222,27 @@ test_valid_signature (TestFixture *fixture,
   gboolean key_expired;
   gboolean key_revoked;
   gboolean key_missing;
+  gint64 key_exp_timestamp;
 
   tuple = ostree_gpg_verify_result_get (fixture->result,
                                         signature_index,
                                         some_attributes,
                                         G_N_ELEMENTS (some_attributes));
 
-  g_variant_get (tuple, "(bbbbb)",
+  g_variant_get (tuple, "(bbbbbx)",
                  &valid,
                  &sig_expired,
                  &key_expired,
                  &key_revoked,
-                 &key_missing);
+                 &key_missing,
+                 &key_exp_timestamp);
 
   g_assert_true (valid);
   g_assert_false (sig_expired);
   g_assert_false (key_expired);
   g_assert_false (key_revoked);
   g_assert_false (key_missing);
+  g_assert_cmpint (key_exp_timestamp, ==, 0);
 }
 
 static void
@@ -252,24 +256,27 @@ test_expired_key (TestFixture *fixture,
   gboolean key_expired;
   gboolean key_revoked;
   gboolean key_missing;
+  gint64 key_exp_timestamp;
 
   tuple = ostree_gpg_verify_result_get (fixture->result,
                                         signature_index,
                                         some_attributes,
                                         G_N_ELEMENTS (some_attributes));
 
-  g_variant_get (tuple, "(bbbbb)",
+  g_variant_get (tuple, "(bbbbbx)",
                  &valid,
                  &sig_expired,
                  &key_expired,
                  &key_revoked,
-                 &key_missing);
+                 &key_missing,
+                 &key_exp_timestamp);
 
   g_assert_false (valid);
   g_assert_false (sig_expired);
   g_assert_true (key_expired);
   g_assert_false (key_revoked);
   g_assert_false (key_missing);
+  g_assert_cmpint (key_exp_timestamp, ==, 1426782201);
 }
 
 static void
@@ -283,24 +290,27 @@ test_revoked_key (TestFixture *fixture,
   gboolean key_expired;
   gboolean key_revoked;
   gboolean key_missing;
+  gint64 key_exp_timestamp;
 
   tuple = ostree_gpg_verify_result_get (fixture->result,
                                         signature_index,
                                         some_attributes,
                                         G_N_ELEMENTS (some_attributes));
 
-  g_variant_get (tuple, "(bbbbb)",
+  g_variant_get (tuple, "(bbbbbx)",
                  &valid,
                  &sig_expired,
                  &key_expired,
                  &key_revoked,
-                 &key_missing);
+                 &key_missing,
+                 &key_exp_timestamp);
 
   g_assert_false (valid);
   g_assert_false (sig_expired);
   g_assert_false (key_expired);
   g_assert_true (key_revoked);
   g_assert_false (key_missing);
+  g_assert_cmpint (key_exp_timestamp, ==, 0);
 }
 
 static void
@@ -314,24 +324,27 @@ test_missing_key (TestFixture *fixture,
   gboolean key_expired;
   gboolean key_revoked;
   gboolean key_missing;
+  gint64 key_exp_timestamp;
 
   tuple = ostree_gpg_verify_result_get (fixture->result,
                                         signature_index,
                                         some_attributes,
                                         G_N_ELEMENTS (some_attributes));
 
-  g_variant_get (tuple, "(bbbbb)",
+  g_variant_get (tuple, "(bbbbbx)",
                  &valid,
                  &sig_expired,
                  &key_expired,
                  &key_revoked,
-                 &key_missing);
+                 &key_missing,
+                 &key_exp_timestamp);
 
   g_assert_false (valid);
   g_assert_false (sig_expired);
   g_assert_false (key_expired);
   g_assert_false (key_revoked);
   g_assert_true (key_missing);
+  g_assert_cmpint (key_exp_timestamp, ==, 0);
 }
 
 static void
@@ -345,24 +358,27 @@ test_expired_signature (TestFixture *fixture,
   gboolean key_expired;
   gboolean key_revoked;
   gboolean key_missing;
+  gint64 key_exp_timestamp;
 
   tuple = ostree_gpg_verify_result_get (fixture->result,
                                         signature_index,
                                         some_attributes,
                                         G_N_ELEMENTS (some_attributes));
 
-  g_variant_get (tuple, "(bbbbb)",
+  g_variant_get (tuple, "(bbbbbx)",
                  &valid,
                  &sig_expired,
                  &key_expired,
                  &key_revoked,
-                 &key_missing);
+                 &key_missing,
+                 &key_exp_timestamp);
 
   g_assert_true (valid);
   g_assert_true (sig_expired);
   g_assert_false (key_expired);
   g_assert_false (key_revoked);
   g_assert_false (key_missing);
+  g_assert_cmpint (key_exp_timestamp, ==, 0);
 }
 
 int

tests/test-kargs.c

@@ -0,0 +1,251 @@
+/*
+ * Copyright (C) 2015 Red Hat, Inc.
+ *
+ * SPDX-License-Identifier: LGPL-2.0+
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+#include "ostree-kernel-args.h"
+#include "otutil.h"
+
+static gboolean
+check_string_existance (OstreeKernelArgs *karg,
+                        const char *string_to_find)
+{
+  g_autofree gchar* string_with_spaces = ostree_kernel_args_to_string (karg);
+  g_auto(GStrv) string_list = g_strsplit (string_with_spaces, " ", -1);
+  return g_strv_contains ((const char* const*) string_list, string_to_find);
+}
+
+static void
+test_kargs_delete (void)
+{
+  g_autoptr(GError) error = NULL;
+  gboolean ret;
+  __attribute__((cleanup(ostree_kernel_args_cleanup))) OstreeKernelArgs *karg = ostree_kernel_args_new ();
+
+  ostree_kernel_args_append (karg, "single_key=test");
+  ostree_kernel_args_append (karg, "test=firstval");
+  ostree_kernel_args_append (karg, "test=secondval");
+  ostree_kernel_args_append (karg, "test=");
+  ostree_kernel_args_append (karg, "test");
+
+  /* Delete a non-existant key should fail */
+  ret = ostree_kernel_args_delete (karg, "non_existant_key", &error);
+  g_assert (!ret);
+  g_assert_error (error, G_IO_ERROR, G_IO_ERROR_FAILED);
+  g_clear_error (&error);
+
+  /* Delete a key with multiple values when only specifying key should work if a no-value
+   * variant exists */
+  ret = ostree_kernel_args_delete (karg, "test", &error);
+  g_assert_no_error (error);
+  g_assert (ret);
+  g_assert (!check_string_existance (karg, "test"));
+
+  /* Trying again now should fail since there are only kargs with various values */
+  ret = ostree_kernel_args_delete (karg, "test", &error);
+  g_assert (!ret);
+  g_assert_error (error, G_IO_ERROR, G_IO_ERROR_FAILED);
+  g_clear_error (&error);
+
+  /* Delete a key with a non existant value should fail */
+  ret = ostree_kernel_args_delete (karg, "test=non_existant_value", &error);
+  g_assert (!ret);
+  g_assert_error (error, G_IO_ERROR, G_IO_ERROR_FAILED);
+  g_clear_error (&error);
+
+  /* Delete a key with only one value should fail if the value doesn't match */
+  ret = ostree_kernel_args_delete (karg, "single_key=non_existent_value", &error);
+  g_assert (!ret);
+  g_assert_error (error, G_IO_ERROR, G_IO_ERROR_FAILED);
+  g_clear_error (&error);
+
+  /* Delete a key with only one value should succeed by only specifying key */
+  ret = ostree_kernel_args_delete (karg, "single_key", &error);
+  g_assert_no_error (error);
+  g_assert (ret);
+  /* verify the value array is properly updated */
+  GPtrArray *kargs_array = _ostree_kernel_arg_get_key_array (karg);
+  g_assert (!ot_ptr_array_find_with_equal_func (kargs_array, "single_key", g_str_equal, NULL));
+  g_assert (!check_string_existance (karg, "single_key"));
+
+  /* Delete specific key/value pair */
+  ret = ostree_kernel_args_delete (karg, "test=secondval", &error);
+  g_assert_no_error (error);
+  g_assert (ret);
+  g_assert (!check_string_existance (karg, "test=secondval"));
+
+  /* Delete key/value pair with empty string value */
+  ret = ostree_kernel_args_delete (karg, "test=", &error);
+  g_assert_no_error (error);
+  g_assert (ret);
+  g_assert (!check_string_existance (karg, "test="));
+
+  ret = ostree_kernel_args_delete (karg, "test=firstval", &error);
+  g_assert_no_error (error);
+  g_assert (ret);
+  g_assert (!check_string_existance (karg, "test=firstval"));
+
+  /* Check that we can delete duplicate keys */
+  ostree_kernel_args_append (karg, "test=foo");
+  ostree_kernel_args_append (karg, "test=foo");
+  check_string_existance (karg, "test=foo");
+  ret = ostree_kernel_args_delete (karg, "test=foo", &error);
+  g_assert_no_error (error);
+  g_assert (ret);
+  g_assert (check_string_existance (karg, "test=foo"));
+  ret = ostree_kernel_args_delete (karg, "test=foo", &error);
+  g_assert_no_error (error);
+  g_assert (ret);
+  g_assert (!check_string_existance (karg, "test=foo"));
+
+  /* Make sure we also gracefully do this for key-only args */
+  ostree_kernel_args_append (karg, "nosmt");
+  ostree_kernel_args_append (karg, "nosmt");
+  check_string_existance (karg, "nosmt");
+  ret = ostree_kernel_args_delete (karg, "nosmt", &error);
+  g_assert_no_error (error);
+  g_assert (ret);
+  g_assert (check_string_existance (karg, "nosmt"));
+  ret = ostree_kernel_args_delete (karg, "nosmt", &error);
+  g_assert_no_error (error);
+  g_assert (ret);
+  g_assert (!check_string_existance (karg, "nosmt"));
+}
+
+static void
+test_kargs_replace (void)
+{
+  g_autoptr(GError) error = NULL;
+  gboolean ret;
+  __attribute__((cleanup(ostree_kernel_args_cleanup))) OstreeKernelArgs *karg = ostree_kernel_args_new ();
+
+  ostree_kernel_args_append (karg, "single_key");
+  ostree_kernel_args_append (karg, "test=firstval");
+  ostree_kernel_args_append (karg, "test=secondval");
+
+  /* Replace when the input key is non-existant should fail */
+  ret = ostree_kernel_args_new_replace (karg, "nonexistantkey", &error);
+  g_assert (!ret);
+  g_assert_error (error, G_IO_ERROR, G_IO_ERROR_FAILED);
+  g_clear_error (&error);
+
+  /* Replace non-existant value with input key=nonexistantvalue=newvalue should fail */
+  ret = ostree_kernel_args_new_replace (karg, "single_key=nonexistantval=newval", &error);
+  g_assert (!ret);
+  g_assert_error (error, G_IO_ERROR, G_IO_ERROR_FAILED);
+  g_clear_error (&error);
+
+  /* Replace with input key=value will fail for a key with multiple values */
+  ret = ostree_kernel_args_new_replace (karg, "test=newval", &error);
+  g_assert (!ret);
+  g_assert_error (error, G_IO_ERROR, G_IO_ERROR_FAILED);
+  g_clear_error (&error);
+
+  /* Replace with input key=value for a key with single value should succeed
+   * Also note, we also allow ''(empty string) valid to be a value
+   */
+  ret = ostree_kernel_args_new_replace (karg, "single_key=newvalue", &error);
+  g_assert_no_error (error);
+  g_assert (ret);
+  g_assert (!check_string_existance (karg, "single_key"));
+  g_assert (check_string_existance (karg, "single_key=newvalue"));
+
+  /* Replace with input key=value=newvalue if key and value both
+   * exist, the action should succeed
+   */
+  ret = ostree_kernel_args_new_replace (karg, "test=firstval=newval", &error);
+  g_assert_no_error (error);
+  g_assert (ret);
+  g_assert (!check_string_existance (karg, "test=firstval"));
+  g_assert (check_string_existance (karg, "test=newval"));
+}
+
+static gboolean
+strcmp0_equal (gconstpointer v1,
+               gconstpointer v2)
+{
+  return g_strcmp0 (v1, v2) == 0;
+}
+
+/* In this function, we want to verify that ostree_kernel_args_append
+ * and ostree_kernel_args_to_string is correct. After that
+ * we will use these two functions(append and tostring) in other tests: delete and replace
+ */
+static void
+test_kargs_append (void)
+{
+  __attribute__((cleanup(ostree_kernel_args_cleanup))) OstreeKernelArgs *append_arg = ostree_kernel_args_new ();
+  /* Some valid cases (key=value) pair */
+  ostree_kernel_args_append (append_arg, "test=valid");
+  ostree_kernel_args_append (append_arg, "test=secondvalid");
+  ostree_kernel_args_append (append_arg, "test=");
+  ostree_kernel_args_append (append_arg, "test");
+  ostree_kernel_args_append (append_arg, "second_test");
+
+  /* We loops through the kargs inside table to verify
+   * the functionality of append because at this stage
+   * we have yet to find the conversion kargs to string fully "functional"
+   */
+  GHashTable *kargs_table = _ostree_kernel_arg_get_kargs_table (append_arg);
+  GLNX_HASH_TABLE_FOREACH_KV (kargs_table, const char*, key, GPtrArray*, value_array)
+    {
+      if (g_str_equal (key, "test"))
+        {
+          g_assert (ot_ptr_array_find_with_equal_func (value_array, "valid", strcmp0_equal, NULL));
+          g_assert (ot_ptr_array_find_with_equal_func (value_array, "secondvalid", strcmp0_equal, NULL));
+          g_assert (ot_ptr_array_find_with_equal_func (value_array, "", strcmp0_equal, NULL));
+          g_assert (ot_ptr_array_find_with_equal_func (value_array, NULL, strcmp0_equal, NULL));
+        }
+      else
+        {
+          g_assert_cmpstr (key, ==, "second_test");
+          g_assert (ot_ptr_array_find_with_equal_func (value_array, NULL, strcmp0_equal, NULL));
+        }
+    }
+
+  /* verify the value array is properly updated */
+  GPtrArray *kargs_array = _ostree_kernel_arg_get_key_array (append_arg);
+  g_assert (ot_ptr_array_find_with_equal_func (kargs_array, "test", g_str_equal, NULL));
+  g_assert (ot_ptr_array_find_with_equal_func (kargs_array, "second_test", g_str_equal, NULL));
+
+  /* Up till this point, we verified that the above was all correct, we then
+   * check ostree_kernel_args_to_string has the right result
+   */
+  g_autofree gchar* kargs_str = ostree_kernel_args_to_string (append_arg);
+  g_auto(GStrv) kargs_list = g_strsplit(kargs_str, " ", -1);
+  g_assert (g_strv_contains ((const char* const *)kargs_list, "test=valid"));
+  g_assert (g_strv_contains ((const char* const *)kargs_list, "test=secondvalid"));
+  g_assert (g_strv_contains ((const char* const *)kargs_list, "test="));
+  g_assert (g_strv_contains ((const char* const *)kargs_list, "test"));
+  g_assert (g_strv_contains ((const char* const *)kargs_list, "second_test"));
+  g_assert_cmpint (5, ==, g_strv_length (kargs_list));
+}
+
+int
+main (int argc,
+      char *argv[])
+{
+  g_test_init (&argc, &argv, NULL);
+
+  g_test_add_func ("/kargs/kargs_append", test_kargs_append);
+  g_test_add_func ("/kargs/kargs_delete", test_kargs_delete);
+  g_test_add_func ("/kargs/kargs_replace", test_kargs_replace);
+  return g_test_run ();
+}

tests/test-libarchive.sh

@@ -28,7 +28,7 @@ fi
 
 . $(dirname $0)/libtest.sh
 
-echo "1..13"
+echo "1..17"
 
 setup_test_repository "bare"
 
@@ -75,6 +75,16 @@ $OSTREE commit -s "from cpio" -b test-cpio \
   --skip-list=skiplist.txt \
   --tree=tar=foo.cpio
 echo "ok cpio commit"
+cat foo.tar.gz | $OSTREE commit -s "from tar" -b test-tar-stdin \
+  --statoverride=statoverride.txt \
+  --skip-list=skiplist.txt \
+  --tree=tar=-
+echo "ok tar commit from stdin"
+cat foo.cpio | $OSTREE commit -s "from cpio" -b test-cpio-stdin \
+  --statoverride=statoverride.txt \
+  --skip-list=skiplist.txt \
+  --tree=tar=-
+echo "ok cpio commit from stdin"
 
 assert_valid_checkout () {
   ref=$1
@@ -124,6 +134,10 @@ assert_valid_checkout tar
 echo "ok tar contents"
 assert_valid_checkout cpio
 echo "ok cpio contents"
+assert_valid_checkout tar-stdin
+echo "ok tar contents from stdin"
+assert_valid_checkout cpio-stdin
+echo "ok cpio contents from stdin"
 
 cd ${test_tmpdir}
 mkdir multicommit-files

tests/test-local-pull.sh

@@ -28,7 +28,12 @@ unset OSTREE_GPG_HOME
 
 skip_without_user_xattrs
 
-echo "1..8"
+if has_gpgme; then
+    echo "1..8"
+else
+    # Only some tests doesn't need GPG support
+    echo "1..5"
+fi
 
 setup_test_repository "archive"
 echo "ok setup"
@@ -63,6 +68,20 @@ cmp checkout1.files checkout2.files
 cmp checkout1.files checkout3.files
 echo "ok checkouts same"
 
+mkdir repo7
+ostree_repo_init repo7 --mode="archive"
+${CMD_PREFIX} ostree --repo=repo7 pull-local repo
+${CMD_PREFIX} ostree --repo=repo7 fsck
+for src_object in `find repo/objects -name '*.filez'`; do
+    dst_object=${src_object/repo/repo7}
+    assert_files_hardlinked "$src_object" "$dst_object"
+done
+echo "ok pull-local z2 to z2 default hardlink"
+
+if ! has_gpgme; then
+    exit 0
+fi
+
 mkdir repo4
 ostree_repo_init repo4 --mode="archive"
 ${CMD_PREFIX} ostree --repo=repo4 remote add --gpg-import ${test_tmpdir}/gpghome/key1.asc origin repo
@@ -97,13 +116,3 @@ ${OSTREE} summary --update --gpg-sign=${TEST_GPG_KEYID_1} --gpg-homedir=${TEST_G
 ${CMD_PREFIX} ostree --repo=repo6 pull-local --remote=origin --gpg-verify-summary repo test2 2>&1
 
 echo "ok --gpg-verify-summary"
-
-mkdir repo7
-ostree_repo_init repo7 --mode="archive"
-${CMD_PREFIX} ostree --repo=repo7 pull-local repo
-${CMD_PREFIX} ostree --repo=repo7 fsck
-for src_object in `find repo/objects -name '*.filez'`; do
-    dst_object=${src_object/repo/repo7}
-    assert_files_hardlinked "$src_object" "$dst_object"
-done
-echo "ok pull-local z2 to z2 default hardlink"

tests/test-parent.sh

@@ -25,6 +25,8 @@ set -euo pipefail
 
 skip_without_user_xattrs
 
+skip_without_gpgme
+
 echo '1..2'
 
 setup_test_repository "archive"

tests/test-pull-collections.sh

@@ -34,7 +34,11 @@ do_commit() {
 
     mkdir -p files
     pushd files
-    ${CMD_PREFIX} ostree --repo="../${repo}" commit -s "Test ${repo} commit for branch ${branch}" -b "${branch}" --gpg-homedir="${TEST_GPG_KEYHOME}" --gpg-sign="${TEST_GPG_KEYID_1}" "$@" > "../${branch}-checksum"
+    local GPG_ARGS=""
+    if has_gpgme; then
+        GPG_ARGS="--gpg-homedir=${TEST_GPG_KEYHOME} --gpg-sign=${TEST_GPG_KEYID_1}"
+    fi
+    ${CMD_PREFIX} ostree --repo="../${repo}" commit -s "Test ${repo} commit for branch ${branch}" -b "${branch}" ${GPG_ARGS} "$@" > "../${branch}-checksum"
     popd
 }
 
@@ -42,7 +46,11 @@ do_summary() {
     local repo=$1
     shift 1
 
-    ${CMD_PREFIX} ostree "--repo=${repo}" summary --update --gpg-homedir="${TEST_GPG_KEYHOME}" --gpg-sign="${TEST_GPG_KEYID_1}"
+    local GPG_ARGS=""
+    if has_gpgme; then
+        GPG_ARGS="--gpg-homedir=${TEST_GPG_KEYHOME} --gpg-sign=${TEST_GPG_KEYID_1}"
+    fi
+    ${CMD_PREFIX} ostree "--repo=${repo}" summary --update ${GPG_ARGS}
 }
 
 do_collection_ref_show() {
@@ -96,7 +104,11 @@ do_remote_add() {
     local remote_repo=$2
     shift 2
 
-    ${CMD_PREFIX} ostree "--repo=${repo}" remote add "${remote_repo}-remote" "file://$(pwd)/${remote_repo}" "$@" --gpg-import="${test_tmpdir}/gpghome/key1.asc"
+    local GPG_ARGS=""
+    if has_gpgme; then
+        GPG_ARGS="--gpg-import=${test_tmpdir}/gpghome/key1.asc"
+    fi
+    ${CMD_PREFIX} ostree "--repo=${repo}" remote add "${remote_repo}-remote" "file://$(pwd)/${remote_repo}" "$@" ${GPG_ARGS}
 }
 
 do_pull() {

tests/test-pull-mirror-summary.sh

@@ -23,9 +23,15 @@ set -euo pipefail
 
 . $(dirname $0)/libtest.sh
 
-echo "1..5"
+COMMIT_SIGN=""
+if has_gpgme; then
+    COMMIT_SIGN="--gpg-homedir=${TEST_GPG_KEYHOME} --gpg-sign=${TEST_GPG_KEYID_1}"
+    echo "1..5"
+else
+    # Only one test don't need GPG support
+    echo "1..1"
+fi
 
-COMMIT_SIGN="--gpg-homedir=${TEST_GPG_KEYHOME} --gpg-sign=${TEST_GPG_KEYID_1}"
 setup_fake_remote_repo1 "archive" "${COMMIT_SIGN}"
 
 # Now, setup multiple branches
@@ -120,5 +126,3 @@ echo "ok pull mirror with invalid summary sig and no verification"
 # assert_file_has_content deltas.txt "${origmain}-${newmain}"
 
 # echo "ok pull mirror with signed summary covering static deltas"
-
-libtest_cleanup_gpg

tests/test-pull-repeated.sh

@@ -23,9 +23,12 @@ set -euo pipefail
 
 . $(dirname $0)/libtest.sh
 
-echo "1..4"
+COMMIT_SIGN=""
+if has_gpgme; then
+    COMMIT_SIGN="--gpg-homedir=${TEST_GPG_KEYHOME} --gpg-sign=${TEST_GPG_KEYID_1}"
+fi
 
-COMMIT_SIGN="--gpg-homedir=${TEST_GPG_KEYHOME} --gpg-sign=${TEST_GPG_KEYID_1}"
+echo "1..4"
 
 # Test pulling from a repo which gives error 500 (internal server error) a lot of the time.
 setup_fake_remote_repo1 "archive" "${COMMIT_SIGN}" --random-500s=50

tests/test-pull-summary-sigs.sh

@@ -23,9 +23,15 @@ set -euo pipefail
 
 . $(dirname $0)/libtest.sh
 
-echo "1..10"
+COMMIT_SIGN=""
+if has_gpgme; then
+    COMMIT_SIGN="--gpg-homedir=${TEST_GPG_KEYHOME} --gpg-sign=${TEST_GPG_KEYID_1}"
+    echo "1..10"
+else
+    # Only one test don't need GPG support
+    echo "1..1"
+fi
 
-COMMIT_SIGN="--gpg-homedir=${TEST_GPG_KEYHOME} --gpg-sign=${TEST_GPG_KEYID_1}"
 setup_fake_remote_repo1 "archive" "${COMMIT_SIGN}"
 
 # Now, setup multiple branches
@@ -274,5 +280,3 @@ cmp repo/tmp/cache/summaries/origin ${test_tmpdir}/ostree-srv/gnomerepo/summary.
 cmp repo/tmp/cache/summaries/origin.sig ${test_tmpdir}/ostree-srv/gnomerepo/summary.sig.2 >&2
 
 echo "ok pull with signed summary broken cache"
-
-libtest_cleanup_gpg

tests/test-refs.sh

@@ -90,6 +90,11 @@ if ${CMD_PREFIX} ostree --repo=repo refs foo/ctest --create=ctest; then
     assert_not_reached "refs --create unexpectedly succeeded in overwriting an existing prefix!"
 fi
 
+# Force overwriting ctest and check the revision got updated
+foo_ctest_rev=$(${CMD_PREFIX} ostree --repo=repo rev-parse foo/ctest)
+${CMD_PREFIX} ostree --repo=repo refs foo/ctest --create=ctest --force
+assert_ref repo ctest ${foo_ctest_rev}
+
 # https://github.com/ostreedev/ostree/issues/1285
 # One tool was creating .latest_rsync files in each dir, let's ignore stuff like
 # that.

tests/test-remote-gpg-import.sh

@@ -280,5 +280,3 @@ ${CMD_PREFIX} ostree --repo=${test_tmpdir}/ostree-srv/gnomerepo summary -u --gpg
 ${OSTREE} pull --require-static-deltas R1:main
 
 echo "ok gpg trusted signed commit for delta upgrades"
-
-libtest_cleanup_gpg

tests/test-repo-finder-config.c

@@ -308,7 +308,6 @@ static void
 test_repo_finder_config_find_remotes (Fixture       *fixture,
                                       gconstpointer  test_data)
 {
-  g_autoptr(OstreeRepoFinder) finder = NULL;
   g_autoptr(GMainContext) context = NULL;
   g_autoptr(GAsyncResult) result = NULL;
   g_auto(OstreeRepoFinderResultv) results = NULL;

tests/test-repo-finder-mount-integration.sh

@@ -55,7 +55,7 @@ _mount_cleanup () {
 
 case "${TEST_SKIP_CLEANUP:-}" in
     no|"")
-        trap _mount_cleanup EXIT
+        libtest_exit_cmds+=(_mount_cleanup)
         ;;
     err)
         trap _mount_cleanup ERR

tests/test-repo-finder-mount.c

@@ -557,10 +557,13 @@ int main (int argc, char **argv)
   g_test_add_func ("/repo-finder-mount/init", test_repo_finder_mount_init);
   g_test_add ("/repo-finder-mount/no-mounts", Fixture, NULL, setup,
               test_repo_finder_mount_no_mounts, teardown);
+#ifndef OSTREE_DISABLE_GPGME
+  /*`ostree_repo_resolve_keyring_for_collection()` fail the tests if no GPG support is compiled in. */
   g_test_add ("/repo-finder-mount/mixed-mounts", Fixture, NULL, setup,
               test_repo_finder_mount_mixed_mounts, teardown);
   g_test_add ("/repo-finder-mount/well-known", Fixture, NULL, setup,
               test_repo_finder_mount_well_known, teardown);
+#endif /* OSTREE_DISABLE_GPGME */
 
   return g_test_run();
 }

tests/test-rofiles-fuse.sh

@@ -41,7 +41,7 @@ rofiles-fuse checkout-test2 mnt
 cleanup_fuse() {
     fusermount -u ${test_tmpdir}/mnt || true
 }
-trap cleanup_fuse EXIT
+libtest_exit_cmds+=(cleanup_fuse)
 assert_file_has_content mnt/firstfile first
 echo "ok mount"
 

tests/test-sizes.js

@@ -53,7 +53,7 @@ let [,dirTree] = repo.write_mtree(mtree, null);
 let [,commit] = repo.write_commit(null, 'Some subject', 'Some body', null, dirTree, null);
 print("commit => " + commit);
 
-repo.commit_transaction(null, null);
+repo.commit_transaction(null);
 
 // Test the sizes metadata
 let [,commitVariant] = repo.load_variant(OSTree.ObjectType.COMMIT, commit);
@@ -64,10 +64,10 @@ assertEquals(nSizes, 2);
 let expectedUncompressedSizes = [12, 18];
 let foundExpectedUncompressedSizes = 0;
 for (let i = 0; i < nSizes; i++) {
-    let sizeEntry = sizes.get_child_value(i).deep_unpack();
-    assertEquals(sizeEntry.length, 34);
-    let compressedSize = sizeEntry[32];
-    let uncompressedSize = sizeEntry[33];
+    let sizeEntry = sizes.get_child_value(i);
+    assertEquals(sizeEntry.n_children(), 34);
+    let compressedSize = sizeEntry.get_child_value(32).get_byte();
+    let uncompressedSize = sizeEntry.get_child_value(33).get_byte();
     print("compressed = " + compressedSize);
     print("uncompressed = " + uncompressedSize);
     for (let j = 0; j < expectedUncompressedSizes.length; j++) {

tests/test-summary-update.sh

@@ -28,6 +28,12 @@ set -euo pipefail
 
 echo "1..2"
 
+COMMIT_SIGN=""
+if has_gpgme; then
+    COMMIT_SIGN="--gpg-homedir=${TEST_GPG_KEYHOME} --gpg-sign=${TEST_GPG_KEYID_1}"
+fi
+
+
 cd ${test_tmpdir}
 mkdir repo
 ostree_repo_init repo
@@ -45,7 +51,7 @@ done
 ${CMD_PREFIX} ostree --repo=repo summary --update
 
 # Generate a signed summary file.
-${CMD_PREFIX} ostree --repo=repo summary --update --gpg-homedir=${TEST_GPG_KEYHOME} --gpg-sign=${TEST_GPG_KEYID_1}
+${CMD_PREFIX} ostree --repo=repo summary --update ${COMMIT_SIGN}
 
 # Try various ways of adding additional data.
 ${CMD_PREFIX} ostree --repo=repo summary --update --add-metadata key="'value'" --add-metadata=key2=true
@@ -77,7 +83,7 @@ done
 ${CMD_PREFIX} ostree --repo=repo summary --update
 
 # Generate a signed summary file.
-${CMD_PREFIX} ostree --repo=repo summary --update --gpg-homedir=${TEST_GPG_KEYHOME} --gpg-sign=${TEST_GPG_KEYID_1}
+${CMD_PREFIX} ostree --repo=repo summary --update ${COMMIT_SIGN}
 
 # Try various ways of adding additional data.
 ${CMD_PREFIX} ostree --repo=repo summary --update --add-metadata key="'value'" --add-metadata=key2=true

tests/test-summary-view.sh

@@ -28,7 +28,11 @@ set -euo pipefail
 
 echo "1..2"
 
-COMMIT_SIGN="--gpg-homedir=${TEST_GPG_KEYHOME} --gpg-sign=${TEST_GPG_KEYID_1}"
+COMMIT_SIGN=""
+if has_gpgme; then
+    COMMIT_SIGN="--gpg-homedir=${TEST_GPG_KEYHOME} --gpg-sign=${TEST_GPG_KEYID_1}"
+fi
+
 setup_fake_remote_repo1 "archive" "${COMMIT_SIGN}"
 
 # Set up a second branch.
@@ -62,5 +66,3 @@ assert_file_has_content_literal raw-summary.txt "('main', ("
 assert_file_has_content_literal raw-summary.txt "('other', ("
 assert_file_has_content_literal raw-summary.txt "{'ostree.summary.last-modified': <uint64"
 echo "ok view summary raw"
-
-libtest_cleanup_gpg

tests/test-symbols.sh

@@ -54,7 +54,7 @@ echo 'ok documented symbols'
 
 # ONLY update this checksum in release commits!
 cat > released-sha256.txt <<EOF
-26f500134a55d678dd8ce6ba971c9e05cd4848b50ab895abc32cde1cffb5ad28  ${released_syms}
+f2f4a0367673e84bc168c7085fec346101a0b6be1962fcca196d8a14fc6eb5c3  ${released_syms}
 EOF
 sha256sum -c released-sha256.txt