4 Commits

Author	SHA1	Message	Date
Jonathan Lebon	dc08ebda0e	tests/libvm: use rsync and add yumrepo mode ... I've been lazy about actually using using rsync instead of scp when copying new RPMs over to the VM. We do this here. Also make `vm_send_test_repo` take a mode argument that allows callers to completely skip the sending of the repo file itself. This will be needed for the `makecache` test, in which we *don't* want the repo to be local. It looks cleaner anyway for the gpgcheck use case as well. Closes: #1035 Approved by: cgwalters	2017-10-06 18:20:59 +00:00
Jonathan Lebon	8b1001c9b5	tests/vmcheck: turn on strict bash mode ... Closes: #1032 Approved by: cgwalters	2017-10-02 20:36:07 +00:00
Jonathan Lebon	2b547c2d0a	tests: transition to build_rpm ... Nuke all the previous goop that was used to create RPMs at `make check` time and transition all the tests to use the new `build_rpm` function. It definitely feels cleaner to use. It's also really nice to have the spec live in the same file as the test that uses it. Closes: #854 Approved by: cgwalters	2017-06-29 16:16:54 +00:00
Colin Walters	66425c3161	core: Do GPG verification before importing ... While reading a recent conversation about GPG checking at treecompose time, I had a sudden thought - were we actually doing verification client side? Turned out, we aren't. That happens as part of `dnf_transaction_commit()` which we don't use. That function verifies every package at one go, but for us I think it's better to do it before "importing". We shouldn't have untrusted bits that we've unpacked (they might have suid binaries, for one thing). This is an embarassing problem, but it's worth emphasizing that everyone should be retrieving repodata at a minimum over TLS, which sets a baseline. On RHEL, we already do pinned TLS, and there are discussions about extending that elsewhere. See: https://bugzilla.redhat.com/show_bug.cgi?id=1422157 Closes: #656 Approved by: jlebon	2017-03-06 15:19:43 +00:00