inspectors: add apt and deb file inspectors
Metadata
Current evaluation
Merged. Added apt and deb file inspectors to validate .deb packages against Packages.xz and verify Packages.xz signatures against InRelease files. The stateful implementation includes caching and received approval from two reviewers.
Suggested action: —
No scores available.
Issue body
Apt and deb file inspectors work together to validate debs against
Packages.xz files and Packages.xz files against a signed InRelease
file. The apt inspectors are stateful and keep a cache of the
essential data from the files they inspect.
Example of an opinion from the apt release file inspector:
```
"apt.release": {
"opinion": "Approved",
"reason": "release file parsed and signature validated",
"annotations": {
"Architectures": "amd64 arm64 armhf i386 ppc64el riscv64 s390x",
"Codename": "jammy",
"Components": "main restricted universe multiverse",
"Date": "Wed, 06 Mar 2024 20:12:39 UTC",
"Description": "Ubuntu Jammy Security",
"Label": "Ubuntu",
"Origin": "Ubuntu",
"Suite": "jammy-security",
"Version": "22.04",
"public-keys": [
"871920D1991BC93C"
]
}
}
```
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-----
CRAFT-2256
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged. Added apt and deb file inspectors to validate .deb packages against Packages.xz and verify Packages.xz signatures against InRelease files. The stateful implementation includes caching and received approval from two reviewers. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #422 fix(i/apt): prevent false positives in deb inspection | fetch-service | merged | Merged a fix preventing false positives in deb inspection. It ensures only the deb inspector grants final approval, validates Packages listings in Release files, and enforces transactional rejection. Approved by two reviewers and merged. | |
| #75 inspectors/apt: add test for packages verification in release | fetch-service | merged | Merged after approval by two reviewers. The update adds a test for packages verification in the release process under inspectors/apt. Despite a zero-line diff, the change was successfully integrated. | |
| #339 fix(inspectors/deb): handle more compression methods | fetch-service | merged | Merged. The DEB inspector now handles xz-compressed control files and gzip-compressed data files, failing if artifact name or version extraction fails. Resolves #337. Approved by two reviewers and passed CI checks. | |
| #338 feat(inspectors/apt): allow packages file download by name | fetch-service | merged | Merged. Updates the apt inspector to download the Packages file by name in gzip format, supporting both gzip and native xz variants. Approved by three reviewers, resolves #332, and changes six files (+177/-98). |