apt-pkg: add detached cms verification and integrate acquire method/metaindex

Simon Johnssonrequested to merge
bamf0/apt:bamf0/cms-verification-pkcs7-unconstrained into main

Rationale

Introduce detached PKCS#7/CMS signature verification support to APT. This is motivated by the limitations imposed by OpenPGP repository signing, as exemplified in https://wiki.debian.org/Teams/Apt/Spec/AptSign.

Changes

The merge request is comprised of three different changes:

  • Add a standalone (unconstrained) X.509 generic trust store class X509Store based on openssl/x509.h. This allows for the ability to impose constraints using subclasses in the future.

  • Add a thin cms aquire method for detached CMS signatures. This also reads and forwards the Suite and Origin headers in order to allow for future certificate policies. The method is registered as the "cms" target and is installed alongside gpgv and/or sqv.

  • Integrate the CMS verification into aquire and metaindex. The APT source determines which signature type to fetch (.gpg/InRelease or .p7s) using its Signed-By field, where a .p7s is fetched if it points to a PEM bundle. For .p7s, no fallback is used if it is missing; a source is treated as untrusted in that case.

Tests

  • test/libapt/cms_test.cc: unit tests for CMS sign/verify round-trips, intermediate chains, and cached re-verification.
  • test/integration/test-method-cms: test cases exercising the cms method directly via the acquire protocol (valid sig, tampered data, wrong CA, missing cert, empty Signed-By, malformed .p7s, Signed-By header extraction)
  • test/integration/test-releasefile-cms-verification: end-to-end scenarios. p7s-only succeeds, wrong CA fails, no p7s fails (nofallback), no sigs fails, allow-insecure-repositories proceeds untrusted, IsTrusted + cached Release.p7s, gpg repo regression guards (planted wrong-CA p7s, soft-404 body).

Merge request reports