13 Commits

Author SHA1 Message Date
Colin Walters
5ebe43859d tests: Use "bash strict mode"
I noticed in the static deltas tests, there were some tests that
should have been under `-o pipefail` to ensure we properly propagate
errors.

There were a few places where we were referencing undefined variables.

Overall, this is clearly a good idea IMO.
2016-01-27 11:44:10 -05:00
Giuseppe Scrivano
45cee1bd70 tests: prefix invocation of ostree with where missing
And add a syntax rule to avoid this in future.

Fixed by:

sed -i -e 's|^ostree |${CMD_PREFIX} ostree |g' tests/*.sh

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2015-11-16 11:07:55 +01:00
Giuseppe Scrivano
bddb25f79e pull: honor gpg-verify-summary=false when a summary signature is present
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2015-09-10 08:59:01 -04:00
Colin Walters
0110183675 fetcher: Use 0666 (-umask) for temporary files
There's no reason to keep them hidden.  I have a hard policy that
OSTree should *not* be used to carry secrets.  Things like host ssh
private keys should be set up out of band by an OS-external
configuration mechanism such as kickstart, cloud-init, etc.

We also assume that hiding binaries is not very useful as most
attackers would be able to find them on the Internet or (for
subscribed content) acting as a customer.

This fixes a bug with mirroring because we changed to take the
unmodified upstream objects rather than uncompress <-> recompress.

https://bugzilla.gnome.org/show_bug.cgi?id=748959
2015-08-27 11:36:48 -04:00
Colin Walters
530631376e tests: Check error messages instead of "expected-fail", handle old parallel 2015-06-29 13:35:07 -04:00
Giuseppe Scrivano
0bd10eb6e2 tests: add test for check for remote add --set=gpg-verify-summary=true
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2015-06-26 11:02:25 +02:00
Giuseppe Scrivano
19ce011e1f pull: fail if GPG is enabled and the summary is not signed
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2015-06-26 11:02:25 +02:00
Giuseppe Scrivano
91d7f3fa0d tests/test-pull-mirror-summary.sh: remove empty newline
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2015-06-12 13:10:02 +02:00
Colin Walters
9acb6283d1 tests: Add a commented out test for mirroring with deltas 2015-06-02 09:07:28 -04:00
Giuseppe Scrivano
6aeeba4280 tests: add a test for signed summary file
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2015-05-07 21:58:04 +02:00
Colin Walters
1fdecbd263 pull: Copy the upstream summary file when doing a pull --mirror
While it could be regenerated downstream, there might be other
metadata upstream, and the goal here is a mirror.

https://bugzilla.gnome.org/show_bug.cgi?id=739377
2015-02-05 21:24:21 -05:00
Colin Walters
fab1e113db When mirroring, write content directly, do not verify
When doing a pull --mirror from an archive-z2 repository into another
archive-z2 repository, currently we gunzip/checksum/gzip each content
object.  The re-gzip process in particular is fairly expensive.

This does assume that the upstream content is trusted and correct.
It'd be nice in the future to do at least a CRC check, if not the full
checksum.  (Could we append CRC data to the end of filez objects?)

We could also choose to only do this optimization if fetching over
TLS.

before: 1626 metadata, 20320 content objects fetched; 299634 KiB transferred in 62 seconds
after : 1626 metadata, 20320 content objects fetched; 299634 KiB transferred in 11 seconds
2015-02-05 21:24:21 -05:00
Colin Walters
1dceb99056 Add missing file from previous commit 2014-10-03 14:38:30 -04:00