Merge lp:~xnox/software-properties/gnupg-fix-all-the-things into lp:software-properties

[Dimitri John Ledkov]

   * ppa.py:
    - rework key retrieval, instead of using hkp & gnupg/dirmngr, use https
      & python's built in urllib.
    - thus, add-apt-key for PPAs observes https_proxy for key retrieval
    - simplify gnupg operations, depend on gpg package only, and use
      import/public key operations only.
    - fix unicode process output bugs, when operating in a non-UTF-8
      locale, thus enabling to import keys for my ppas in C locale.
    - avoid creating trustdb, or requiring any gpg-agent systemd socket to
      be activated
    - update tests to execute key addition fully with less things stubbed
      out with mock
    - stop using apt-key for installing keys
    - deprecate --keyserver option, making HTTPS access to
      keyserver.ubuntu.com required

   * ppa.py:
    - rework key retrieval, instead of using hkp & gnupg/dirmngr, use https
      & python's built in urllib.
    - thus, add-apt-key for PPAs observes https_proxy for key retrieval
    - simplify gnupg operations, depend on gpg package only, and use
      import/public key operations only.
    - fix unicode process output bugs, when operating in a non-UTF-8
      locale, thus enabling to import keys for my ppas in C locale.
    - avoid creating trustdb, or requiring any gpg-agent systemd socket to
      be activated
    - update tests to execute key addition fully with less things stubbed
      out with mock
    - stop using apt-key for installing keys
    - deprecate --keyserver option, making HTTPS access to
      keyserver.ubuntu.com required

Autopkgtests pass, results e.g.:
https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_39a8dbb93caf4ec889f8a1b7f69885db/bileto-3222-excuses/2018-04-02_11:20:01/3222_bionic_excuses.html

[lp:~xnox/software-properties/gnupg-fix-all-the-things]

1019. By Dimitri John Ledkov on 2018-04-03

 - dirmngr is a heavy dependency and not used, and it is hard to pass
   proxy information to it when invoking gpg from a non-standard homedir
 - LP: #1755192, LP: #1713962, LP: #1699086, LP: #1510220, LP: #1433761,
   LP: #1395321, LP: #1312267

=== modified file 'add-apt-repository'
--- add-apt-repository	2018-02-08 15:06:39 +0000
+++ add-apt-repository	2018-04-03 08:42:06 +0000
@@ -10,7 +10,6 @@
 
 from softwareproperties.SoftwareProperties import SoftwareProperties, shortcut_handler
 from softwareproperties.shortcuts import ShortcutException
-from softwareproperties.ppa import DEFAULT_KEYSERVER
 import aptsources
 from aptsources.sourceslist import SourceEntry
 from optparse import OptionParser
@@ -60,9 +59,6 @@
     parser.add_option("-r", "--remove", action="store_true",
         dest="remove", default=False,
         help=_("remove repository from sources.list.d directory"))
-    parser.add_option("-k", "--keyserver",
-        dest="keyserver", default=DEFAULT_KEYSERVER,
-        help=_("URL of keyserver. Default: %default"))
     parser.add_option("-s", "--enable-source", action="store_true",
         dest="enable_source", default=False,
         help=_("Allow downloading of the source packages from the repository"))
@@ -75,6 +71,10 @@
     parser.add_option("-u", "--update", action="store_true",
         dest="update", default=True,
         help=_("Update package cache after adding (legacy option)"))
+    parser.add_option("-k", "--keyserver",
+        dest="keyserver", default="",
+        help=_("Legacy option, unused."))
+    
     (options, args) = parser.parse_args()
     
     # We prefer to run apt-get update here. The built-in update support

=== modified file 'debian/changelog'
--- debian/changelog	2018-03-21 16:43:05 +0000
+++ debian/changelog	2018-04-03 08:42:06 +0000
@@ -1,3 +1,27 @@
+software-properties (0.96.24.25) bionic; urgency=medium
+
+  * ppa.py:
+   - rework key retrieval, instead of using hkp & gnupg/dirmngr, use https
+     & python's built in urllib.
+   - thus, add-apt-key for PPAs observes https_proxy for key retrieval
+   - simplify gnupg operations, depend on gpg package only, and use
+     import/public key operations only.
+   - fix unicode process output bugs, when operating in a non-UTF-8
+     locale, thus enabling to import keys for my ppas in C locale.
+   - avoid creating trustdb, or requiring any gpg-agent systemd socket to
+     be activated
+   - update tests to execute key addition fully with less things stubbed
+     out with mock
+   - stop using apt-key for installing keys
+   - dirmngr is a heavy dependency and not used, and it is hard to pass
+     proxy information to it when invoking gpg from a non-standard homedir
+   - deprecate --keyserver option, making HTTPS access to
+     keyserver.ubuntu.com required
+   - LP: #1755192, LP: #1713962, LP: #1699086, LP: #1510220, LP: #1433761,
+     LP: #1395321, LP: #1312267
+
+ -- Dimitri John Ledkov <[e-mail]>  Mon, 02 Apr 2018 10:19:34 +0100
+
 software-properties (0.96.24.24) bionic; urgency=medium
 
   * DialogAuth.py: Implement a dialog to choose between an ubuntu sso account or

=== modified file 'debian/control'
--- debian/control	2018-03-21 15:00:01 +0000
+++ debian/control	2018-04-03 08:42:06 +0000
@@ -20,7 +20,7 @@
 Section: python
 Architecture: all
 Depends: ${python:Depends}, ${misc:Depends}, python, python-apt (>=
- 0.6.20ubuntu16), python-pycurl, lsb-release, iso-codes, gnupg, dirmngr
+ 0.6.20ubuntu16), python-pycurl, lsb-release, iso-codes, gpg
 Recommends: unattended-upgrades
 Description: manage the repositories that you install software from
  This software provides an abstraction of the used apt repositories.
@@ -31,7 +31,7 @@
 Section: python
 Architecture: all
 Depends: ${python3:Depends}, ${misc:Depends}, python3, python3-apt (>=
- 0.6.20ubuntu16), lsb-release, iso-codes, gnupg, dirmngr
+ 0.6.20ubuntu16), lsb-release, iso-codes, gpg
 Recommends: unattended-upgrades
 Description: manage the repositories that you install software from
  This software provides an abstraction of the used apt repositories.

=== modified file 'debian/tests/add-apt-repository'
--- debian/tests/add-apt-repository	2016-09-01 10:23:19 +0000
+++ debian/tests/add-apt-repository	2018-04-03 08:42:06 +0000
@@ -1,10 +1,14 @@
 #!/bin/sh
 set -e
 
-rm -f /etc/apt/sources.list.d/xnox-ubuntu-nonvirt-*.list
-rm -f /etc/apt/trusted.gpg.d/xnox_ubuntu_nonvirt.gpg
-
-add-apt-repository ppa:xnox/nonvirt --yes
-
-[ -s /etc/apt/sources.list.d/xnox-ubuntu-nonvirt-*.list ]
-[ -s /etc/apt/trusted.gpg.d/xnox_ubuntu_nonvirt.gpg ]
+for locale in C.UTF-8 C
+do
+    export LC_ALL=$locale
+    echo LC_ALL=$locale test...
+    rm -f /etc/apt/sources.list.d/xnox-ubuntu-nonvirt-*.list
+    rm -f /etc/apt/trusted.gpg.d/xnox_ubuntu_nonvirt.gpg
+    add-apt-repository ppa:xnox/nonvirt --yes --no-update
+    [ -s /etc/apt/sources.list.d/xnox-ubuntu-nonvirt-*.list ]
+    [ -s /etc/apt/trusted.gpg.d/xnox_ubuntu_nonvirt.gpg ]
+    gpg -q --homedir $(mktemp -d)  --no-default-keyring --keyring /etc/apt/trusted.gpg.d/xnox_ubuntu_nonvirt.gpg --fingerprint
+done

=== modified file 'debian/tests/control'
--- debian/tests/control	2017-04-10 21:30:25 +0000
+++ debian/tests/control	2018-04-03 08:42:06 +0000
@@ -1,6 +1,6 @@
 Tests: run-tests
-Depends: @, xvfb, dbus-x11, python-dbus, python-pycurl, python3-pycurl, python-mock, python3-mock, python-distutils-extra, python-setuptools, python3-distutils-extra, python3-setuptools, python-gi, python3-gi, pyflakes, pyflakes3, gnupg
+Depends: @, xvfb, dbus-x11, python-dbus, python-pycurl, python3-pycurl, python-mock, python3-mock, python-distutils-extra, python-setuptools, python3-distutils-extra, python3-setuptools, python-gi, python3-gi, pyflakes, pyflakes3, gpg
 
 Tests: add-apt-repository
-Depends: software-properties-common, gnupg
-Restrictions: needs-root, breaks-testbed, allow-stderr
+Depends: software-properties-common, gpg
+Restrictions: needs-root, breaks-testbed

=== modified file 'debian/tests/run-tests'
--- debian/tests/run-tests	2017-04-10 21:30:25 +0000
+++ debian/tests/run-tests	2018-04-03 08:42:06 +0000
@@ -13,15 +13,6 @@
 # the test work in other locales too.
 export LC_ALL=C.UTF-8
 
-# dirmngr and/or gpg-agent fail without ~/.gnupg present maybe some
-# places should be properly declaring homedir, instead of just keyrings
-if ! out=$(gpg --list-keys 2>&1); then
-    ret=$?
-    echo "Failed [$ret] to initialize ~/.gnupg with: gpg --list-keys" 1>&2
-    echo "$out" 1>&2;
-    exit $ret
-fi
-
 code=0
 if [ "$TMPDIR" ]; then
 	env -u TMPDIR xvfb-run -e "$tmpdir/xvfb.log" sh -ec "TMPDIR=\"$TMPDIR\" python setup.py test && python3 setup.py test" || code="$?"

=== modified file 'software-properties-gtk'
--- software-properties-gtk	2013-06-19 07:30:35 +0000
+++ software-properties-gtk	2018-04-03 08:42:06 +0000
@@ -35,7 +35,6 @@
 #sys.path.append("@prefix@/share/update-manager/python")
 
 from softwareproperties.gtk.SoftwarePropertiesGtk import SoftwarePropertiesGtk
-from softwareproperties.ppa import DEFAULT_KEYSERVER
 
 if __name__ == "__main__":
   _ = gettext.gettext
@@ -68,8 +67,8 @@
                     action="store", type="string", default=None,
                     help="Enable PPA with the given name")
   parser.add_option("-k", "--keyserver",
-                    dest="keyserver", default=DEFAULT_KEYSERVER,
-                    help="URL of keyserver. Default: %default")
+                    dest="keyserver", default="",
+                    help="Legacy option, unused")
   parser.add_option("--data-dir", "",
                     action="store", type="string", default="/usr/share/software-properties/",
                     help="Use data files (UI) from the given directory")

=== modified file 'software-properties-kde'
--- software-properties-kde	2014-12-01 07:04:29 +0000
+++ software-properties-kde	2018-04-03 08:42:06 +0000
@@ -36,7 +36,6 @@
 #sys.path.append("@prefix@/share/update-manager/python")
 
 from softwareproperties.kde.SoftwarePropertiesKDE import SoftwarePropertiesKDE
-from softwareproperties.ppa import DEFAULT_KEYSERVER
 
 import sip
 
@@ -45,7 +44,6 @@
     massive_debug = False
     no_update = False
     enable_component = ""
-    keyserver = DEFAULT_KEYSERVER
 
 #--------------- main ------------------
 if __name__ == '__main__':
@@ -89,7 +87,7 @@
                                    "name");
     parser.addOption(ppaOption);
     keyServerOption = QCommandLineOption("keyserver",
-                                         _("URL of keyserver"),
+                                         _("Legacy option, unused"),
                                          "url");
     parser.addOption(keyServerOption);
     winidOption = QCommandLineOption("attach", _("Win ID to act as a dialogue for"),
@@ -126,8 +124,6 @@
     attachWinID = None
     if parser.isSet(winidOption):
         attachWinID = parser.value(winidOption)
-    if parser.isSet(keyServerOption):
-        options.keyserver = parser.value(keyServerOption)
     # datadir has a default value, so always read it
     data_dir = parser.value(dataDirOption)
 

=== modified file 'softwareproperties/ppa.py'
--- softwareproperties/ppa.py	2016-09-21 20:01:50 +0000
+++ softwareproperties/ppa.py	2018-04-03 08:42:06 +0000
@@ -46,7 +46,7 @@
     HTTPError = pycurl.error
 
 
-DEFAULT_KEYSERVER = "hkp://keyserver.ubuntu.com:80/"
+SKS_KEYSERVER = 'https://keyserver.ubuntu.com/pks/lookup?op=get&options=mr&exact=on&search=0x%s'
 # maintained until 2015
 LAUNCHPAD_PPA_API = 'https://launchpad.net/api/1.0/%s/+archive/%s'
 LAUNCHPAD_USER_API = 'https://launchpad.net/api/1.0/%s'
@@ -79,13 +79,20 @@
 def encode(s):
     return re.sub("[^a-zA-Z0-9_-]", "_", s)
 
-def get_info_from_lp(lp_url):
+def get_info_from_https(url, accept_json):
     if NEED_PYCURL:
         # python2 has no cert verification so we need pycurl
-        return _get_https_content_pycurl(lp_url)
+        data = _get_https_content_pycurl(url, accept_json)
     else:
         # python3 has cert verification so we can use the buildin urllib
-        return _get_https_content_py3(lp_url)
+        data = _get_https_content_py3(url, accept_json)
+    if accept_json:
+        return json.loads(data)
+    else:
+        return data
+
+def get_info_from_lp(lp_url):
+    return get_info_from_https(lp_url, True)
 
 def get_ppa_info_from_lp(owner_name, ppa):
     if owner_name[0] != '~':
@@ -106,19 +113,20 @@
     return os.path.basename(get_info_from_lp(lp_url)["current_series_link"])
 
 
-def _get_https_content_py3(lp_url):
+def _get_https_content_py3(lp_url, accept_json):
     try:
-        request = urllib.request.Request(str(lp_url), headers={"Accept":" application/json"})
+        headers = {"Accept":" application/json"} if accept_json else {}
+        request = urllib.request.Request(str(lp_url), headers=headers)
         lp_page = urllib.request.urlopen(request, cafile=LAUNCHPAD_PPA_CERT)
-        json_data = lp_page.read().decode("utf-8", "strict")
+        data = lp_page.read().decode("utf-8", "strict")
     except (URLError, HTTPException) as e:
         # HTTPException doesn't have a reason but might have a string
         # representation
         reason = hasattr(e, "reason") and e.reason or e
         raise PPAException("Error reading %s: %s" % (lp_url, reason), e)
-    return json.loads(json_data)
+    return data
 
-def _get_https_content_pycurl(lp_url):
+def _get_https_content_pycurl(lp_url, accept_json):
     # this is the fallback code for python2
     try:
         callback = CurlCallback()
@@ -129,16 +137,17 @@
         if LAUNCHPAD_PPA_CERT:
             curl.setopt(pycurl.CAINFO, LAUNCHPAD_PPA_CERT)
         curl.setopt(pycurl.URL, str(lp_url))
-        curl.setopt(pycurl.HTTPHEADER, ["Accept: application/json"])
+        if accept_json:
+            curl.setopt(pycurl.HTTPHEADER, ["Accept: application/json"])
         curl.perform()
         response = curl.getinfo(curl.RESPONSE_CODE)
         curl.close()
-        json_data = callback.contents
+        data = callback.contents
     except pycurl.error as e:
         raise PPAException("Error reading %s: %s" % (lp_url, e), e)
     if response != 200:
         raise PPAException("Error reading %s: response code %i" % (lp_url, response))
-    return json.loads(json_data)
+    return data
 
 
 def mangle_ppa_shortcut(shortcut):
@@ -168,14 +177,18 @@
 class AddPPASigningKey(object):
     " thread class for adding the signing key in the background "
 
-    GPG_DEFAULT_OPTIONS = ["gpg", "--no-default-keyring", "--no-options"]
-
     def __init__(self, ppa_path, keyserver=None):
         self.ppa_path = ppa_path
-        self.keyserver = (keyserver if keyserver is not None
-                          else DEFAULT_KEYSERVER)
-
-    def _recv_key(self, keyring, secret_keyring, signing_key_fingerprint, keyring_dir):
+        self._homedir = tempfile.mkdtemp()
+
+    def __del__(self):
+        shutil.rmtree(self._homedir)
+
+    def gpg_cmd(self, args):
+        cmd = "gpg -q --homedir %s --no-default-keyring --no-options --import --import-options %s" % (self._homedir, args)
+        return subprocess.Popen(cmd.split(), stdin=subprocess.PIPE, stdout=subprocess.PIPE)
+        
+    def _recv_key(self, signing_key_fingerprint):
         try:
             # double check that the signing key is a v4 fingerprint (160bit)
             if not verify_keyid_is_v4(signing_key_fingerprint):
@@ -185,57 +198,30 @@
         except TypeError:
             print("Error: signing key fingerprint does not exist")
             return False
-        # then get it
-        res = subprocess.call(self.GPG_DEFAULT_OPTIONS + [
-            "--homedir", keyring_dir,
-            "--secret-keyring", secret_keyring,
-            "--keyring", keyring,
-            "--keyserver", self.keyserver,
-            "--recv", signing_key_fingerprint,
-            ])
-        return (res == 0)
-
-    def _export_key(self, keyring, export_keyring, signing_key_fingerprint, keyring_dir):
-        res = subprocess.call(self.GPG_DEFAULT_OPTIONS + [
-          "--homedir", keyring_dir,
-          "--keyring", keyring,
-          "--output", export_keyring,
-          "--export", signing_key_fingerprint,
-          ])
-        if res != 0:
-            return False
-        return True
-
-    def _export_armor_key(self, keyring, export_keyring, signing_key_fingerprint, keyring_dir):
-        res = subprocess.call(self.GPG_DEFAULT_OPTIONS + [
-          "--homedir", keyring_dir,
-          "--keyring", keyring,
-          "--output", export_keyring,
-          "--armor",
-          "--export", signing_key_fingerprint,
-          ])
-        if res != 0:
-            return False
-        return True
-
-    def _get_fingerprints(self, keyring, keyring_dir):
-        cmd = self.GPG_DEFAULT_OPTIONS + [
-          "--homedir", keyring_dir,
-          "--keyring", keyring,
-          "--fingerprint",
-          "--batch",
-          "--with-colons",
-          ]
-        output = subprocess.check_output(cmd, universal_newlines=True)
+
+        return get_info_from_https(SKS_KEYSERVER % signing_key_fingerprint, accept_json=False)
+
+    def _minimize_key(self, key):
+        p = self.gpg_cmd("import-minimal,import-export")
+        (minimal_key, _) = p.communicate(key.encode())
+        
+        if p.returncode != 0:
+            return False
+        return minimal_key
+
+    def _get_fingerprints(self, key):
         fingerprints = []
-        for line in output.splitlines():
-            if line.startswith("fpr:"):
-                fingerprints.append(line.split(":")[9])
+        p = self.gpg_cmd("show-only --fingerprint --batch --with-colons")
+        (output, _) = p.communicate(key)
+        if p.returncode == 0:
+            for line in output.decode('utf-8').splitlines():
+                if line.startswith("fpr:"):
+                    fingerprints.append(line.split(":")[9])
         return fingerprints
 
-    def _verify_fingerprint(self, keyring, expected_fingerprint, keyring_dir):
-        got_fingerprints = self._get_fingerprints(keyring, keyring_dir)
-        if len(got_fingerprints) > 1:
+    def _verify_fingerprint(self, key, expected_fingerprint):
+        got_fingerprints = self._get_fingerprints(key)
+        if len(got_fingerprints) != 1:
             print("Got '%s' fingerprints, expected only one" %
                   len(got_fingerprints))
             return False
@@ -255,9 +241,6 @@
         if ppa_path is None:
             ppa_path = self.ppa_path
 
-        def cleanup(tmpdir):
-            shutil.rmtree(tmp_keyring_dir)
-
         try:
             ppa_info = get_ppa_info(ppa_path)
         except PPAException as e:
@@ -268,41 +251,26 @@
         except IndexError as e:
             print("Error: can't find signing_key_fingerprint at %s" % ppa_path)
             return False
-        # create temp keyrings
-        tmp_keyring_dir = tempfile.mkdtemp()
-        tmp_secret_keyring = os.path.join(tmp_keyring_dir, "secring.gpg")
-        tmp_keyring = os.path.join(tmp_keyring_dir, "pubring.gpg")
-        #  download the key into a temp keyring first
-        if not self._recv_key(
-            tmp_keyring, tmp_secret_keyring, signing_key_fingerprint, tmp_keyring_dir):
-            cleanup(tmp_keyring_dir)
-            return False
-        # now export the key into a temp keyring using the long key id
-        tmp_export_keyring = os.path.join(tmp_keyring_dir, "export-keyring.gpg")
-        if not self._export_key(
-            tmp_keyring, tmp_export_keyring, signing_key_fingerprint, tmp_keyring_dir):
-            cleanup(tmp_keyring_dir)
-            return False
-        # now verify the fingerprint
-        if not self._verify_fingerprint(
-            tmp_export_keyring, signing_key_fingerprint, tmp_keyring_dir):
-            cleanup(tmp_keyring_dir)
-            return False
-        # now export armor key, because apt-key cannot import keybox
-        tmp_export_armor_keyring = os.path.join(tmp_keyring_dir, "export-armor-keyring.gpg")
-        if not self._export_armor_key(
-            tmp_keyring, tmp_export_armor_keyring, signing_key_fingerprint, tmp_keyring_dir):
-            cleanup(tmp_keyring_dir)
-            return False
-        # and add it
+        
+        #  download the armored_key
+        armored_key = self._recv_key(signing_key_fingerprint)
+        if not armored_key:
+            return False
+
         trustedgpgd = apt_pkg.config.find_dir("Dir::Etc::trustedparts")
-        apt_keyring = os.path.join(trustedgpgd, "%s.gpg" % (
-            encode(ppa_info["reference"][1:])))
-        res = subprocess.call(["apt-key", "--keyring", apt_keyring, "add",
-            tmp_export_armor_keyring])
-        # cleanup
-        cleanup(tmp_keyring_dir)
-        return (res == 0)
+        apt_keyring = os.path.join(trustedgpgd, encode(ppa_info["reference"][1:]))
+
+        minimal_key = self._minimize_key(armored_key)
+        if not minimal_key:
+            return False
+        
+        if not self._verify_fingerprint(minimal_key, signing_key_fingerprint):
+            return False
+
+        with open('%s.gpg' % apt_keyring, 'wb') as f:
+            f.write(minimal_key)
+
+        return True
 
 
 class AddPPASigningKeyThread(Thread, AddPPASigningKey):

=== modified file 'tests/test_lp.py'
--- tests/test_lp.py	2017-12-20 20:55:27 +0000
+++ tests/test_lp.py	2018-04-03 08:42:06 +0000
@@ -27,6 +27,37 @@
     'reference': '~mvo/ubuntu/ppa',
     }
 
+MOCK_KEY="""
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: SKS 1.1.6
+Comment: Hostname: keyserver.ubuntu.com
+
+mI0ESXP67wEEAN2m3xWkAP0p1erHbJx1wYBCL6tLqWXESx1BmF0htLzdD9lfsUYiNs+Zgg3w
+uU0PrQIcqZtyTESh514tw3KQ+OAK2I0a2XJR99lXPksiKoxaOOsr0pTVWDYuIlfV3yfmXvnK
+FZSmaMjjKuqQbCwZe8Ev7yry9Gh9pM5Y87MbNT05ABEBAAG0HkxhdW5jaHBhZCBQUEEgZm9y
+IE1pY2hhZWwgVm9ndIi2BBMBAgAgBQJJc/rvAhsDBgsJCAcDAgQVAggDBBYCAwECHgECF4AA
+CgkQEpGWRw6xLwVofAP/YyU3YykXbr8p7wRp1EpFlDmtbPlFXp00gt4Cqlu2AWVOkwkVoMRQ
+Ncb7wog2Z6u7KyUhD8pgC2FEL0+FQjyNemv7D0OYBG+6DLdjtRsv0CumLdWFmviU96j3OcwT
+G2GkIC/eB2maTrV/vj7vlZ0Qe/T1NL6XLpr0A6Rg6JAtkFM=
+=SMbJ
+-----END PGP PUBLIC KEY BLOCK-----
+"""
+
+MOCK_SECOND_KEY="""
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: SKS 1.1.6
+Comment: Hostname: keyserver.ubuntu.com
+
+mI0ESX34EgEEAOTzplZO3TXmb9dRLu7kOuIEia21e4gwQ/RQe+LD7HdhikcETjf2Ruu0mn6S
+sgPLL+duhKxmv6ZciLUgkk0qEDCZuR6BPxdgAIwqmQmFipcv6UTMQitRPUa9WlPU37Qg+joL
+cTBUdamnVq+yJhLmnuO44UWAty85nNJzDd29gxqXABEBAAG0LUxhdW5jaHBhZCBQUEEgZm9y
+INCU0LzQuNGC0YDQuNC5INCb0LXQtNC60L7Qsoi2BBMBAgAgBQJJffgSAhsDBgsJCAcDAgQV
+AggDBBYCAwECHgECF4AACgkQFXlR/kAx0oeuSwQAuhhgWgeeG3F9XMYDqgJShzMSeQOLMKBq
+6mNFEL1sDhRdbinf7rwuQFXDSSNCj8/PLa3DF/u09tAm6CTi10iwxxbXf16pTq21gxCA3/xS
+fszv352yZpcN85MD5aozqv7qUCGOQ9Gey7JzgD7L4wMEjyRScVjx1chfLgyapdj822E=
+=pdql
+-----END PGP PUBLIC KEY BLOCK-----
+"""
 
 class LaunchpadPPATestCase(unittest.TestCase):
 	
@@ -34,7 +65,7 @@
     def setUpClass(cls):
         for k in apt_pkg.config.keys():
             apt_pkg.config.clear(k)
-        apt_pkg.init()
+        apt_pkg.init()        
 
     @unittest.skipUnless(
         "TEST_ONLINE" in os.environ,
@@ -73,7 +104,13 @@
         for k in apt_pkg.config.keys():
             apt_pkg.config.clear(k)
         apt_pkg.init()
-		
+        cls.trustedgpg = os.path.join(
+            os.path.dirname(__file__), "aptroot", "etc", "apt", "trusted.gpg.d")
+        try:
+            os.makedirs(cls.trustedgpg)
+        except:
+            pass
+
     def setUp(self):
         self.t = AddPPASigningKeyThread("~mvo/ubuntu/ppa")
 
@@ -91,38 +128,30 @@
         self.assertFalse(mock_subprocess.call.called)
 
     @patch("softwareproperties.ppa.get_ppa_info_from_lp")
-    @patch("softwareproperties.ppa.subprocess")
-    def test_add_ppa_signing_key_wrong_fingerprint(self, mock_subprocess, mock_get_ppa_info):
-        mock_get_ppa_info.return_value = MOCK_PPA_INFO
-        mock_subprocess.call.return_value = 0
-        with patch.object(self.t, "_get_fingerprints") as mock:
-            # setup wrong fingerprint
-            mock.return_value = ["48B913EC7093C0C675DADCC04BEF262422DF4087"]
-            res = self.t.add_ppa_signing_key("~mvo/ubuntu/ppa")
-            self.assertFalse(res)
-
-    @patch("softwareproperties.ppa.get_ppa_info_from_lp")
-    @patch("softwareproperties.ppa.subprocess")
-    def test_add_ppa_signing_key_multiple_fingerprints(self, mock_subprocess, mock_get_ppa_info):
-        mock_get_ppa_info.return_value = MOCK_PPA_INFO
-        mock_subprocess.call.return_value = 0
-        with patch.object(self.t, "_get_fingerprints") as mock:
-            # setup multiple fingerprints
-            mock.return_value = ["019A25FED88F961763935D7F129196470EB12F05",
-                                 "48B913EC7093C0C675DADCC04BEF262422DF4087"]
-            res = self.t.add_ppa_signing_key("~mvo/ubuntu/ppa")
-            self.assertFalse(res)
-
-    @patch("softwareproperties.ppa.get_ppa_info_from_lp")
-    @patch("softwareproperties.ppa.subprocess")
-    def test_add_ppa_signing_key_ok(self, mock_subprocess, mock_get_ppa_info):
-        mock_get_ppa_info.return_value = MOCK_PPA_INFO
-        mock_subprocess.call.return_value = 0
-        # setup correct signing key
-        with patch.object(self.t, "_get_fingerprints") as mock:
-            mock.return_value = ["019A25FED88F961763935D7F129196470EB12F05"]
-            res = self.t.add_ppa_signing_key("~mvo/ubuntu/ppa")
-            self.assertTrue(res)
+    @patch("softwareproperties.ppa.get_info_from_https")
+    def test_add_ppa_signing_key_wrong_fingerprint(self, mock_https, mock_get_ppa_info):
+        mock_get_ppa_info.return_value = MOCK_PPA_INFO
+        mock_https.return_value = MOCK_SECOND_KEY
+        res = self.t.add_ppa_signing_key("~mvo/ubuntu/ppa")
+        self.assertFalse(res)
+
+    @patch("softwareproperties.ppa.get_ppa_info_from_lp")
+    @patch("softwareproperties.ppa.get_info_from_https")
+    def test_add_ppa_signing_key_multiple_fingerprints(self, mock_https, mock_get_ppa_info):
+        mock_get_ppa_info.return_value = MOCK_PPA_INFO
+        mock_https.return_value = '\n'.join([MOCK_KEY, MOCK_SECOND_KEY])
+        res = self.t.add_ppa_signing_key("~mvo/ubuntu/ppa")
+        self.assertFalse(res)
+
+    @patch("softwareproperties.ppa.get_ppa_info_from_lp")
+    @patch("softwareproperties.ppa.get_info_from_https")
+    @patch("apt_pkg.config")
+    def test_add_ppa_signing_key_ok(self, mock_config, mock_https, mock_get_ppa_info):
+        mock_get_ppa_info.return_value = MOCK_PPA_INFO
+        mock_https.return_value = MOCK_KEY
+        mock_config.find_dir.return_value = self.trustedgpg
+        res = self.t.add_ppa_signing_key("~mvo/ubuntu/ppa")
+        self.assertTrue(res)
     
     def test_verify_keyid_is_v4(self):
         keyid = "0EB12F05"