Merge lp:click/devel into lp:click

[Colin Watson]

Click 0.4.31: "click info <file in unpacked package>", and basic support for package signing.

  [ Michael Vogt ]
  * Add "click info" interface to get manifest corresponding to file in
    installed package (LP: #1324853).
  * Add support for click package gpg signatures (LP: #1330770).

  [ Colin Watson ]
  * Ugly hack to get coverage reporting working again with gcovr 3.1.
  * Pass --allow-unauthenticated to "click install" from the PackageKit
    plugin for now. Revert this when a keyring and signing policies are in
    place on the phone images and confirmed to work.

[lp:click/devel]

501. By Michael Vogt on 2014-08-20

trivial pep8 fix

502. By Michael Vogt on 2014-08-20

bump version number for citrain

503. By Michael Vogt on 2014-08-22

tests/integration/: fix tests by adding --allow-unauthenticated

504. By Michael Vogt on 2014-08-22

bump version number

=== modified file 'Makefile.am.coverage'
--- Makefile.am.coverage	2014-07-02 16:51:32 +0000
+++ Makefile.am.coverage	2014-08-22 17:12:39 +0000
@@ -38,6 +38,7 @@
 generate-coverage-gcovr:
 	@echo Generating coverage GCOVR report
 	$(GCOVR) -x -r $(top_builddir) -o coverage-c.xml
+	sed -i 's/\(<package .*name=\)""/\1"lib.click..libs"/' coverage-c.xml
 	
 clean-coverage-gcovr: clean-gcda
 	rm -f coverage-c.xml

=== modified file 'click/commands/info.py'
--- click/commands/info.py	2014-04-03 08:52:02 +0000
+++ click/commands/info.py	2014-08-22 17:12:39 +0000
@@ -18,8 +18,10 @@
 from __future__ import print_function
 
 from contextlib import closing
+import glob
 import json
 from optparse import OptionParser
+import os
 import sys
 
 from gi.repository import Click
@@ -28,6 +30,15 @@
 from click.json_helpers import json_object_to_python
 
 
+def _load_manifest(manifest_file):
+    manifest = json.load(manifest_file)
+    keys = list(manifest)
+    for key in keys:
+        if key.startswith("_"):
+            del manifest[key]
+    return manifest
+
+
 def get_manifest(options, arg):
     if "/" not in arg:
         db = Click.DB()
@@ -38,15 +49,20 @@
         if registry.has_package_name(arg):
             return json_object_to_python(registry.get_manifest(arg))
 
-    with closing(DebFile(filename=arg)) as package:
-        with package.control.get_file(
-                "manifest", encoding="UTF-8") as manifest_file:
-            manifest = json.load(manifest_file)
-            keys = list(manifest)
-            for key in keys:
-                if key.startswith("_"):
-                    del manifest[key]
-            return manifest
+    if arg.endswith(".click"):
+        with closing(DebFile(filename=arg)) as package:
+            with package.control.get_file(
+                    "manifest", encoding="UTF-8") as manifest_file:
+                return _load_manifest(manifest_file)
+    else:
+        pkgdir = Click.find_package_directory(arg)
+        manifest_path = glob.glob(
+            os.path.join(pkgdir, ".click", "info", "*.manifest"))
+        if len(manifest_path) > 1:
+            raise Exception("Multiple manifest files found in '%s'" % (
+                manifest_path))
+        with open(manifest_path[0]) as f:
+            return _load_manifest(f)
 
 
 def run(argv):

=== modified file 'click/commands/install.py'
--- click/commands/install.py	2014-04-03 08:52:02 +0000
+++ click/commands/install.py	2014-08-22 17:12:39 +0000
@@ -43,6 +43,9 @@
     parser.add_option(
         "--all-users", default=False, action="store_true",
         help="register package for all users")
+    parser.add_option(
+        "--allow-unauthenticated", default=False, action="store_true",
+        help="allow installing packages with no sigantures")
     options, args = parser.parse_args(argv)
     if len(args) < 1:
         parser.error("need package file name")
@@ -51,7 +54,9 @@
     if options.root is not None:
         db.add(options.root)
     package_path = args[0]
-    installer = ClickInstaller(db, options.force_missing_framework)
+    installer = ClickInstaller(
+        db=db, force_missing_framework=options.force_missing_framework,
+        allow_unauthenticated=options.allow_unauthenticated)
     try:
         installer.install(
             package_path, user=options.user, all_users=options.all_users)

=== modified file 'click/commands/verify.py'
--- click/commands/verify.py	2013-09-23 21:24:37 +0000
+++ click/commands/verify.py	2014-08-22 17:12:39 +0000
@@ -29,10 +29,15 @@
     parser.add_option(
         "--force-missing-framework", action="store_true", default=False,
         help="ignore missing system framework")
+    parser.add_option(
+        "--allow-unauthenticated", action="store_true", default=False,
+        help="allow installing packages with no sigantures")
     options, args = parser.parse_args(argv)
     if len(args) < 1:
         parser.error("need package file name")
     package_path = args[0]
-    installer = ClickInstaller(None, options.force_missing_framework)
+    installer = ClickInstaller(
+        db=None, force_missing_framework=options.force_missing_framework,
+        allow_unauthenticated=options.allow_unauthenticated)
     installer.audit(package_path, slow=True)
     return 0

=== modified file 'click/install.py'
--- click/install.py	2014-05-05 13:10:19 +0000
+++ click/install.py	2014-08-22 17:12:39 +0000
@@ -30,6 +30,7 @@
 import grp
 import inspect
 import json
+import logging
 import os
 import pwd
 import shutil
@@ -74,6 +75,45 @@
 apt_pkg.init_system()
 
 
+class DebsigVerifyError(Exception):
+    pass
+
+
+class DebsigVerify:
+    """Tiny wrapper around the debsig-verify commandline"""
+    # from debsig-verify-0.9/debsigs.h
+    DS_SUCCESS = 0
+    DS_FAIL_NOSIGS = 10
+    DS_FAIL_UNKNOWN_ORIGIN = 11
+    DS_FAIL_NOPOLICIES = 12
+    DS_FAIL_BADSIG = 13
+    DS_FAIL_INTERNAL = 14
+
+    # should be a property, but python does not support support
+    # class properties easily
+    @classmethod
+    def available(cls):
+        return Click.find_on_path("debsig-verify")
+
+    @classmethod
+    def verify(cls, path, allow_unauthenticated):
+        command = ["debsig-verify"] + [path]
+        try:
+            subprocess.check_output(command, universal_newlines=True)
+        except subprocess.CalledProcessError as e:
+            if (allow_unauthenticated and
+                e.returncode in (DebsigVerify.DS_FAIL_NOSIGS,
+                                 DebsigVerify.DS_FAIL_UNKNOWN_ORIGIN,
+                                 DebsigVerify.DS_FAIL_NOPOLICIES)):
+                logging.warning(
+                    "Signature check failed, but installing anyway "
+                    "as requested")
+            else:
+                raise DebsigVerifyError(
+                    "Signature verification error: %s" % e.output)
+        return True
+
+
 class ClickInstallerError(Exception):
     pass
 
@@ -87,9 +127,11 @@
 
 
 class ClickInstaller:
-    def __init__(self, db, force_missing_framework=False):
+    def __init__(self, db, force_missing_framework=False,
+                 allow_unauthenticated=False):
         self.db = db
         self.force_missing_framework = force_missing_framework
+        self.allow_unauthenticated = allow_unauthenticated
 
     def _preload_path(self):
         if "CLICK_PACKAGE_PRELOAD" in os.environ:
@@ -125,6 +167,16 @@
             subprocess.check_call(command, env=env, **kwargs)
 
     def audit(self, path, slow=False, check_arch=False):
+        # always do the signature check first
+        if DebsigVerify.available():
+            try:
+                DebsigVerify.verify(path, self.allow_unauthenticated)
+            except DebsigVerifyError as e:
+                raise ClickInstallerAuditError(str(e))
+        else:
+            logging.warning(
+                "debsig-verify not available; cannot check signatures")
+
         with closing(DebFile(filename=path)) as package:
             control_fields = package.control.debcontrol()
 

=== modified file 'click/tests/test_install.py'
--- click/tests/test_install.py	2014-05-19 13:08:57 +0000
+++ click/tests/test_install.py	2014-08-22 17:12:39 +0000
@@ -75,6 +75,12 @@
         self.use_temp_dir()
         self.db = Click.DB()
         self.db.add(self.temp_dir)
+        # mock signature checks during the tests
+        self.debsig_patcher = mock.patch("click.install.DebsigVerify")
+        self.debsig_patcher.start()
+
+    def tearDown(self):
+        self.debsig_patcher.stop()
 
     def make_fake_package(self, control_fields=None, manifest=None,
                           control_scripts=None, data_files=None):
@@ -232,6 +238,23 @@
                 'Framework "missing" not present on system.*',
                 ClickInstaller(self.db).audit, path)
 
+    # FIXME: we really want a unit test with a valid signature too
+    def test_audit_no_signature(self):
+        if not Click.find_on_path("debsig-verify"):
+            self.skipTest("this test needs debsig-verify")
+        path = self.make_fake_package(
+            control_fields={"Click-Version": "0.4"},
+            manifest={
+                "name": "test-package",
+                "version": "1.0",
+                "framework": "",
+            })
+        self.debsig_patcher.stop()
+        self.assertRaisesRegex(
+            ClickInstallerAuditError, "Signature verification error",
+            ClickInstaller(self.db).audit, path)
+        self.debsig_patcher.start()
+
     @disable_logging
     def test_audit_missing_framework_force(self):
         with self.run_in_subprocess(

=== modified file 'debian/changelog'
--- debian/changelog	2014-08-06 23:33:23 +0000
+++ debian/changelog	2014-08-22 17:12:39 +0000
@@ -1,3 +1,15 @@
+click (0.4.31.2) UNRELEASED; urgency=medium
+
+  [ Michael Vogt ]
+  * Add "click info" interface to get manifest corresponding to file in
+    installed package (LP: #1324853).
+  * Add support for click package gpg signatures (LP: #1330770).
+
+  [ Colin Watson ]
+  * Ugly hack to get coverage reporting working again with gcovr 3.1.
+
+ -- Colin Watson <[e-mail]>  Tue, 12 Aug 2014 14:32:38 +0100
+
 click (0.4.30) utopic; urgency=medium
 
   [ Colin Watson ]

=== modified file 'debian/tests/control'
--- debian/tests/control	2014-06-30 14:03:36 +0000
+++ debian/tests/control	2014-08-22 17:12:39 +0000
@@ -1,3 +1,3 @@
 Tests: run-tests.sh
-Depends: @, iputils-ping, click-dev, schroot, debootstrap, sudo, bzr
+Depends: @, iputils-ping, click-dev, schroot, debootstrap, sudo, bzr, debsigs, debsig-verify
 Restrictions: needs-root allow-stderr

=== added directory 'tests/integration/data'
=== added directory 'tests/integration/data/evil-keyring'
=== added file 'tests/integration/data/evil-keyring/pubring.gpg'
Binary files tests/integration/data/evil-keyring/pubring.gpg	1970-01-01 00:00:00 +0000 and tests/integration/data/evil-keyring/pubring.gpg	2014-08-22 17:12:39 +0000 differ
=== added file 'tests/integration/data/evil-keyring/secring.gpg'
Binary files tests/integration/data/evil-keyring/secring.gpg	1970-01-01 00:00:00 +0000 and tests/integration/data/evil-keyring/secring.gpg	2014-08-22 17:12:39 +0000 differ
=== added file 'tests/integration/data/evil-keyring/trustdb.gpg'
Binary files tests/integration/data/evil-keyring/trustdb.gpg	1970-01-01 00:00:00 +0000 and tests/integration/data/evil-keyring/trustdb.gpg	2014-08-22 17:12:39 +0000 differ
=== added directory 'tests/integration/data/origin-keyring'
=== added file 'tests/integration/data/origin-keyring/pubring.gpg'
Binary files tests/integration/data/origin-keyring/pubring.gpg	1970-01-01 00:00:00 +0000 and tests/integration/data/origin-keyring/pubring.gpg	2014-08-22 17:12:39 +0000 differ
=== added file 'tests/integration/data/origin-keyring/secring.gpg'
Binary files tests/integration/data/origin-keyring/secring.gpg	1970-01-01 00:00:00 +0000 and tests/integration/data/origin-keyring/secring.gpg	2014-08-22 17:12:39 +0000 differ
=== added file 'tests/integration/data/origin-keyring/trustdb.gpg'
Binary files tests/integration/data/origin-keyring/trustdb.gpg	1970-01-01 00:00:00 +0000 and tests/integration/data/origin-keyring/trustdb.gpg	2014-08-22 17:12:39 +0000 differ
=== modified file 'tests/integration/test_hook.py'
--- tests/integration/test_hook.py	2014-08-03 13:10:48 +0000
+++ tests/integration/test_hook.py	2014-08-22 17:12:39 +0000
@@ -64,7 +64,8 @@
             click_pkg_name, framework="", hooks=hooks)
         user = os.environ.get("USER", "root")
         subprocess.check_call(
-            [self.click_binary, "install", "--user=%s" % user, click_pkg],
+            [self.click_binary, "install", "--allow-unauthenticated",
+             "--user=%s" % user, click_pkg],
             universal_newlines=True)
         self.addCleanup(
             subprocess.check_call,

=== modified file 'tests/integration/test_info.py'
--- tests/integration/test_info.py	2014-06-26 12:00:09 +0000
+++ tests/integration/test_info.py	2014-08-22 17:12:39 +0000
@@ -27,4 +27,20 @@
         path_to_click = self._make_click(name)
         output = subprocess.check_output([
             self.click_binary, "info", path_to_click], universal_newlines=True)
-        self.assertEqual(json.loads(output)["name"], name)
+        self.assertEqual(name, json.loads(output)["name"])
+
+    def test_info_file_in_package(self):
+        name = "org.example.info"
+        version = "1.0"
+        click_pkg = self._make_click(name=name, version=version, framework="")
+        subprocess.check_call(
+            [self.click_binary, "install", "--allow-unauthenticated",
+             "--all-users", click_pkg])
+        self.addCleanup(
+            subprocess.check_call,
+            [self.click_binary, "unregister", "--all-users", name])
+        output = subprocess.check_output(
+            [self.click_binary, "info",
+             "/opt/click.ubuntu.com/%s/%s/README" % (name, version)],
+            universal_newlines=True)
+        self.assertEqual(name, json.loads(output)["name"])

=== modified file 'tests/integration/test_install.py'
--- tests/integration/test_install.py	2014-06-26 12:02:18 +0000
+++ tests/integration/test_install.py	2014-08-22 17:12:39 +0000
@@ -60,6 +60,7 @@
         # install it
         subprocess.check_call([
             self.click_binary, "install", "--user=%s" % self.USER_1,
+            "--allow-unauthenticated",
             click_pkg], universal_newlines=True)
         self.addCleanup(self.click_unregister, self.USER_1, "foo-1")
         # ensure that user-1 has it
@@ -82,7 +83,8 @@
         click_pkg = self._make_click(name="foo-2", framework="")
         # install it
         subprocess.check_call(
-            [self.click_binary, "install", "--all-users",  click_pkg],
+            [self.click_binary, "install", "--all-users",
+            "--allow-unauthenticated", click_pkg],
             universal_newlines=True)
         self.addCleanup(self.click_unregister, "@all", "foo-2")
         # ensure all users see it
@@ -95,7 +97,8 @@
     def test_pkgdir_after_install(self):
         click_pkg = self._make_click(name="foo-2", version="1.2", framework="")
         subprocess.check_call(
-            [self.click_binary, "install", "--all-users",  click_pkg],
+            [self.click_binary, "install", "--all-users",
+            "--allow-unauthenticated", click_pkg],
             universal_newlines=True)
         self.addCleanup(self.click_unregister, "@all", "foo-2")
         # from the path

=== added file 'tests/integration/test_signatures.py'
--- tests/integration/test_signatures.py	1970-01-01 00:00:00 +0000
+++ tests/integration/test_signatures.py	2014-08-22 17:12:39 +0000
@@ -0,0 +1,348 @@
+# Copyright (C) 2014 Canonical Ltd.
+# Author: Michael Vogt <[e-mail]>
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+"""Integration tests for the click signature checking."""
+
+import copy
+import os
+import shutil
+import subprocess
+import tarfile
+import unittest
+from textwrap import dedent
+
+from .helpers import (
+    is_root,
+    ClickTestCase,
+)
+
+def makedirs(path):
+    try:
+        os.makedirs(path)
+    except OSError:
+        pass
+
+def get_keyid_from_gpghome(gpg_home):
+    """Return the public keyid of a given gpg home dir"""
+    output = subprocess.check_output(
+        ["gpg", "--home", gpg_home, "--list-keys", "--with-colons"],
+        universal_newlines=True)
+    for line in output.splitlines():
+        if not line.startswith("pub:"):
+            continue
+        return line.split(":")[4]
+    raise ValueError("Cannot find public key in output: '%s'" % output)
+
+
+class Debsigs:
+    """Tiny wrapper around the debsigs CLI"""
+    def __init__(self, gpghome, keyid):
+        self.keyid = keyid
+        self.gpghome = gpghome
+        self.policy = "/etc/debsig/policies/%s/generic.pol" % self.keyid
+
+    def sign(self, filepath, signature_type="origin"):
+        """Sign the click at filepath"""
+        env = copy.copy(os.environ)
+        env["GNUPGHOME"] = os.path.abspath(self.gpghome)        
+        subprocess.check_call(
+            ["debsigs",
+             "--sign=%s" % signature_type,
+             "--default-key=%s" % self.keyid,
+             filepath], env=env)
+
+    def install_signature_policy(self):
+        """Install/update the system-wide signature policy"""
+        xmls = dedent("""\
+        <?xml version="1.0"?>
+        <!DOCTYPE Policy SYSTEM "http://www.debian.org/debsig/1.0/policy.dtd">
+        <Policy xmlns="http://www.debian.org/debsig/1.0/">
+
+        <Origin Name="test-origin" id="{keyid}" Description="Example policy"/>
+        <Selection>
+        <Required Type="origin" File="{filename}" id="{keyid}"/>
+        </Selection>
+  
+        <Verification>
+        <Required Type="origin" File="{filename}" id="{keyid}"/>
+        </Verification>
+        </Policy>
+        """.format(keyid=self.keyid, filename="origin.pub"))
+        makedirs(os.path.dirname(self.policy))
+        with open(self.policy, "w") as f:
+            f.write(xmls)
+        self.pubkey_path = (
+            "/usr/share/debsig/keyrings/%s/origin.pub" % self.keyid)
+        makedirs(os.path.dirname(self.pubkey_path))
+        shutil.copy(os.path.join(self.gpghome, "pubring.gpg"), self.pubkey_path)
+
+    def uninstall_signature_policy(self):
+        # FIXME: update debsig-verify so that it can work from a different
+        #        root than "/" so that the tests do not have to use the
+        #        system root
+        os.remove(self.policy)
+        os.remove(self.pubkey_path)
+
+
[e-mail](not is_root(), "This tests needs to run as root")
+class ClickSignaturesTestCase(ClickTestCase):
+    def assertClickNoSignatureError(self, cmd_args):
+        with self.assertRaises(subprocess.CalledProcessError) as cm:
+            output = subprocess.check_output(
+                [self.click_binary] + cmd_args,
+                stderr=subprocess.STDOUT, universal_newlines=True)
+        output = cm.exception.output
+        expected_error_message = ("debsig: Origin Signature check failed. "
+                                  "This deb might not be signed.")
+        self.assertIn(expected_error_message, output)
+
+    def assertClickInvalidSignatureError(self, cmd_args):
+        with self.assertRaises(subprocess.CalledProcessError) as cm:
+            output = subprocess.check_output(
+                [self.click_binary] + cmd_args,
+                stderr=subprocess.STDOUT, universal_newlines=True)
+            print(output)
+
+        output = cm.exception.output
+        expected_error_message = "Signature verification error: "
+        self.assertIn(expected_error_message, output)
+
+
[e-mail](not is_root(), "This tests needs to run as root")
+class TestSignatureVerificationNoSignature(ClickSignaturesTestCase):
+    def test_debsig_verify_no_sig(self):
+        name = "org.example.debsig-no-sig"
+        path_to_click = self._make_click(name, framework="")
+        self.assertClickNoSignatureError(["verify", path_to_click])
+
+    def test_debsig_install_no_sig(self):
+        name = "org.example.debsig-no-sig"
+        path_to_click = self._make_click(name, framework="")
+        self.assertClickNoSignatureError(["install", path_to_click])
+
+    def test_debsig_install_can_install_with_sig_override(self):
+        name = "org.example.debsig-no-sig"
+        path_to_click = self._make_click(name, framework="")
+        user = os.environ.get("USER", "root")
+        subprocess.check_call(
+            [self.click_binary, "install",
+             "--allow-unauthenticated", "--user=%s" % user,
+             path_to_click])
+        self.addCleanup(
+            subprocess.call, [self.click_binary, "unregister",
+                              "--user=%s" % user, name])
+
+
[e-mail](not is_root(), "This tests needs to run as root")
+class TestSignatureVerification(ClickSignaturesTestCase):
+    def setUp(self):
+        super(TestSignatureVerification, self).setUp()
+        self.user = os.environ.get("USER", "root")
+        # the valid origin keyring
+        self.datadir = os.path.join(os.path.dirname(__file__), "data")
+        origin_keyring_dir = os.path.abspath(
+            os.path.join(self.datadir, "origin-keyring"))
+        keyid = get_keyid_from_gpghome(origin_keyring_dir)
+        self.debsigs = Debsigs(origin_keyring_dir, keyid)
+        self.debsigs.install_signature_policy()
+
+    def tearDown(self):
+        self.debsigs.uninstall_signature_policy()
+
+    def test_debsig_install_valid_signature(self):
+        name = "org.example.debsig-valid-sig"
+        path_to_click = self._make_click(name, framework="")
+        self.debsigs.sign(path_to_click)
+        subprocess.check_call(
+            [self.click_binary, "install",
+             "--user=%s" % self.user,
+             path_to_click])
+        self.addCleanup(
+            subprocess.call, [self.click_binary, "unregister",
+                              "--user=%s" % self.user, name])
+        output = subprocess.check_output(
+            [self.click_binary, "list", "--user=%s" % self.user],
+            universal_newlines=True)
+        self.assertIn(name, output)
+        
+    def test_debsig_install_signature_not_in_keyring(self):
+        name = "org.example.debsig-no-keyring-sig"
+        path_to_click = self._make_click(name, framework="")
+        evil_keyring_dir = os.path.join(self.datadir, "evil-keyring")
+        keyid = get_keyid_from_gpghome(evil_keyring_dir)
+        debsig_bad = Debsigs(evil_keyring_dir, keyid)
+        debsig_bad.sign(path_to_click)
+        # and ensure its really not there
+        self.assertClickInvalidSignatureError(["install", path_to_click])
+        output = subprocess.check_output(
+            [self.click_binary, "list", "--user=%s" % self.user],
+            universal_newlines=True)
+        self.assertNotIn(name, output)
+
+    def test_debsig_install_not_a_signature(self):
+        name = "org.example.debsig-invalid-sig"
+        path_to_click = self._make_click(name, framework="")
+        invalid_sig = os.path.join(self.temp_dir, "_gpgorigin")
+        with open(invalid_sig, "w") as f:
+            f.write("no-valid-signature")
+        # add a invalid sig
+        subprocess.check_call(["ar", "-r", path_to_click, invalid_sig])
+        self.assertClickInvalidSignatureError(["install", path_to_click])
+        output = subprocess.check_output(
+            [self.click_binary, "list", "--user=%s" % self.user],
+            universal_newlines=True)
+        self.assertNotIn(name, output)
+
+    def test_debsig_install_signature_altered_click(self):
+        def modify_ar_member(member):
+            subprocess.check_call(
+                ["ar", "-x", path_to_click, "control.tar.gz"],
+                cwd=self.temp_dir)
+            altered_member = os.path.join(self.temp_dir, member)
+            with open(altered_member, "ba") as f:
+                f.write(b"\0")
+            subprocess.check_call(["ar", "-r", path_to_click, altered_member])
+
+        # ensure that all members we care about are checked by debsig-verify
+        for member in ["control.tar.gz", "data.tar.gz", "debian-binary"]:
+            name = "org.example.debsig-altered-click"
+            path_to_click = self._make_click(name, framework="")
+            self.debsigs.sign(path_to_click)
+            modify_ar_member(member)
+            self.assertClickInvalidSignatureError(["install", path_to_click])
+            output = subprocess.check_output(
+                [self.click_binary, "list", "--user=%s" % self.user],
+                universal_newlines=True)
+            self.assertNotIn(name, output)
+
+    def make_nasty_data_tar(self, compression):
+        new_data_tar = os.path.join(self.temp_dir, "data.tar." + compression)
+        evilfile = os.path.join(self.temp_dir, "README.evil")
+        with open(evilfile, "w") as f:
+            f.write("I am a nasty README")
+        with tarfile.open(new_data_tar, "w:"+compression) as tar:
+            tar.add(evilfile)
+        return new_data_tar
+
+    def test_debsig_install_signature_injected_data_tar(self):
+        name = "org.example.debsig-injected-data-click"
+        path_to_click = self._make_click(name, framework="")
+        self.debsigs.sign(path_to_click)
+        new_data = self.make_nasty_data_tar("bz2")
+        # insert before the real data.tar.gz and ensure this is caught
+        # NOTE: that right now this will not be caught by debsig-verify
+        #        but later in audit() by debian.debfile.DebFile()
+        subprocess.check_call(["ar",
+                               "-r", 
+                               "-b", "data.tar.gz",
+                               path_to_click,
+                               new_data])
+        output = subprocess.check_output(
+            ["ar", "-t", path_to_click], universal_newlines=True)
+        self.assertEqual(output.splitlines(),
+                         ["debian-binary",
+                          "_click-binary",
+                          "control.tar.gz",
+                          "data.tar.bz2",
+                          "data.tar.gz",
+                          "_gpgorigin"])
+        with self.assertRaises(subprocess.CalledProcessError):
+            output = subprocess.check_output(
+                [self.click_binary, "install", path_to_click],
+                stderr=subprocess.STDOUT, universal_newlines=True)
+        output = subprocess.check_output(
+            [self.click_binary, "list", "--user=%s" % self.user],
+            universal_newlines=True)
+        self.assertNotIn(name, output)
+
+    def test_debsig_install_signature_replaced_data_tar(self):
+        name = "org.example.debsig-replaced-data-click"
+        path_to_click = self._make_click(name, framework="")
+        self.debsigs.sign(path_to_click)
+        new_data = self.make_nasty_data_tar("bz2")
+        # replace data.tar.gz with data.tar.bz2 and ensure this is caught
+        subprocess.check_call(["ar",
+                               "-d", 
+                               path_to_click,
+                               "data.tar.gz",
+                               ])
+        subprocess.check_call(["ar",
+                               "-r", 
+                               path_to_click,
+                               new_data])
+        output = subprocess.check_output(
+            ["ar", "-t", path_to_click], universal_newlines=True)
+        self.assertEqual(output.splitlines(),
+                         ["debian-binary",
+                          "_click-binary",
+                          "control.tar.gz",
+                          "_gpgorigin",
+                          "data.tar.bz2",
+                         ])
+        with self.assertRaises(subprocess.CalledProcessError) as cm:
+            output = subprocess.check_output(
+                [self.click_binary, "install", path_to_click],
+                stderr=subprocess.STDOUT, universal_newlines=True)
+        self.assertIn("Signature verification error", cm.exception.output)
+        output = subprocess.check_output(
+            [self.click_binary, "list", "--user=%s" % self.user],
+            universal_newlines=True)
+        self.assertNotIn(name, output)
+
+    def test_debsig_install_signature_prepend_sig(self):
+        # this test is probably not really needed, it tries to trick
+        # the system by prepending a valid signature that is not
+        # in the keyring. But given that debsig-verify only reads
+        # the first packet of any given _gpg$foo signature its 
+        # equivalent to test_debsig_install_signature_not_in_keyring test
+        name = "org.example.debsig-replaced-data-prepend-sig-click"
+        path_to_click = self._make_click(name, framework="")
+        self.debsigs.sign(path_to_click)
+        new_data = self.make_nasty_data_tar("gz")
+        # replace data.tar.gz
+        subprocess.check_call(["ar",
+                               "-r", 
+                               path_to_click,
+                               new_data,
+                               ])
+        # get previous good _gpgorigin for the old data
+        subprocess.check_call(
+            ["ar", "-x", path_to_click, "_gpgorigin"], cwd=self.temp_dir)
+        with open(os.path.join(self.temp_dir, "_gpgorigin"), "br") as f:
+            good_gpg_origin = f.read()
+        # and append a valid signature from a non-keyring key
+        evil_keyring_dir = os.path.join(self.datadir, "evil-keyring")
+        debsig_bad = Debsigs(evil_keyring_dir, "18B38B9AC1B67A0D")
+        debsig_bad.sign(path_to_click)
+        subprocess.check_call(
+            ["ar", "-x", path_to_click, "_gpgorigin"], cwd=self.temp_dir)
+        with open(os.path.join(self.temp_dir, "_gpgorigin"), "br") as f:
+            evil_gpg_origin = f.read()
+        with open(os.path.join(self.temp_dir, "_gpgorigin"), "wb") as f:
+            f.write(evil_gpg_origin)
+            f.write(good_gpg_origin)
+        subprocess.check_call(
+            ["ar", "-r", path_to_click, "_gpgorigin"], cwd=self.temp_dir)
+        # now ensure that the verification fails as well
+        with self.assertRaises(subprocess.CalledProcessError) as cm:
+            output = subprocess.check_output(
+                [self.click_binary, "install", path_to_click],
+                stderr=subprocess.STDOUT, universal_newlines=True)
+        self.assertIn("Signature verification error", cm.exception.output)
+        output = subprocess.check_output(
+            [self.click_binary, "list", "--user=%s" % self.user],
+            universal_newlines=True)
+        self.assertNotIn(name, output)
+        

=== modified file 'tests/integration/test_verify.py'
--- tests/integration/test_verify.py	2014-06-26 12:00:09 +0000
+++ tests/integration/test_verify.py	2014-08-22 17:12:39 +0000
@@ -22,9 +22,11 @@
 
 class TestVerify(ClickTestCase):
     def test_verify_ok(self):
-        name = "com.ubuntu.verify-ok"
+        name = "com.example.verify-ok"
         path_to_click = self._make_click(name)
         output = subprocess.check_output([
-            self.click_binary, "verify", "--force-missing-framework",
+            self.click_binary, "verify",
+            "--force-missing-framework",
+            "--allow-unauthenticated",
             path_to_click], universal_newlines=True)
         self.assertEqual(output, "")