fix(i/apt): prevent false positives in deb inspection
Metadata
Current evaluation
Merged in canonical/fetch-service#422 (0a4cc2a), making deb inspection the final approval and enforcing Packages/Release verification dependencies to prevent false positives.
Resolution: closed resolved
Reason: PR canonical/fetch-service#422 was merged as commit 0a4cc2a. It requires successful transactional inspection, gives final approval only to the deb inspector, and checks that Packages is listed in Release.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Deb artifacts are inspected by both the deb inspector (for the content)
and Packages inspector (to verify if the digest is listed in the
Packages file). Only the deb inspector should give the final approval,
with transactional inspectors rejecting if their verification fail.
This avoids the situation where the Packages inspector approves and
the main inspector ignores the artifact, causing an non-inspected
artifact to be approved and reach the original client. Also the deb
inspector requires the artifact to be previously inspected by the
Packages inspector.
The same happens between the Release inspector and artifacts listed
in the InRelease file (Packages, Commands, and Translation files).
Additionally, check if the Packages file is listed in the Release file
when verifying the deb file digest. This avoids the situation where a
deb file is correctly listed in an invalid Packages file.
- [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-----
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/fetch-service#422 (0a4cc2a), making deb inspection the final approval and enforcing Packages/Release verification dependencies to prevent false positives. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged canonical/fetch-service#422 as commit 0a4cc2a, preventing false approvals by reserving final approval for the deb inspector and requiring successful transactional checks. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged a fix preventing false positives in deb inspection. It ensures only the deb inspector grants final approval, validates Packages listings in Release files, and enforces transactional rejection. Approved by two reviewers and merged. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #12 metadata: better apt release file detection | fetch-service | merged | Merged in canonical/fetch-service#12 via commit 21b2d02, tightening APT release-file detection to prevent false positives for legacy Release files. | |
| #71 fix: enable and update the apt release test | fetch-service | merged | Merged in canonical/fetch-service#71; follow-up PR #75 (commit b9d7ce0) added missing APT release package-verification coverage after lint skipped the test run. |