inspectors: add apt and deb file inspectors
Metadata
Current evaluation
Merged PR #61 in commit 566f57c, adding stateful APT and DEB inspectors to validate signed InRelease files, Packages.xz indexes, and .deb packages.
Resolution: closed resolved
Reason: The PR was approved by two reviewers and merged as commit 566f57c, implementing the requested APT and DEB file inspectors.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Apt and deb file inspectors work together to validate debs against
Packages.xz files and Packages.xz files against a signed InRelease
file. The apt inspectors are stateful and keep a cache of the
essential data from the files they inspect.
Example of an opinion from the apt release file inspector:
```
"apt.release": {
"opinion": "Approved",
"reason": "release file parsed and signature validated",
"annotations": {
"Architectures": "amd64 arm64 armhf i386 ppc64el riscv64 s390x",
"Codename": "jammy",
"Components": "main restricted universe multiverse",
"Date": "Wed, 06 Mar 2024 20:12:39 UTC",
"Description": "Ubuntu Jammy Security",
"Label": "Ubuntu",
"Origin": "Ubuntu",
"Suite": "jammy-security",
"Version": "22.04",
"public-keys": [
"871920D1991BC93C"
]
}
}
```
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-----
CRAFT-2256
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #61 in commit 566f57c, adding stateful APT and DEB inspectors to validate signed InRelease files, Packages.xz indexes, and .deb packages. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/fetch-service#61 (commit 566f57c), adding stateful apt and deb inspectors to validate .deb packages against Packages.xz and release metadata. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged. Added apt and deb file inspectors to validate .deb packages against Packages.xz and verify Packages.xz signatures against InRelease files. The stateful implementation includes caching and received approval from two reviewers. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #127 inspectors/apt: extend configuration to apt inspectors | fetch-service | merged | Merged PR #127 as commit 26c596c, unifying APT configuration for allowed repositories, distributions, and components across metadata files and .deb packages (CRAFT-3027). | |
| #83 docs: add apt inspectors reference | fetch-service | merged | Merged PR #83 as commit 27edc4d, adding reference documentation for APT release, package, and translation inspectors. | |
| #65 inspectors: add quick check for clearsigned file | fetch-service | merged | Merged as commit 06bff29, adding a quick clearsigned-file check to the APT release inspector. | |
| #75 inspectors/apt: add test for packages verification in release | fetch-service | merged | Merged PR #75 added APT release package-verification test coverage, landing as commit b9d7ce0. | |
| #339 fix(inspectors/deb): handle more compression methods | fetch-service | merged | Merged PR #339 as 8ea9e8e: DEB inspection now supports xz control files and gzip data files, and rejects packages missing parsed name/version; fixes #337. | |
| #101 inspectors/apt: fix release and package state when rejected | fetch-service | closed | APT inspection now records state only for approved packages and releases; the rejection fix was cherry-picked into the feature branch in commit e19a80c. | |
| #120 config: initial apt release inspector configuration | fetch-service | merged | Merged as commit 50107e7, adding configurable apt release-inspector URLs, distributions, components, architectures, and signing keys. | |
| #100 inspectors/apt: fix release signature validation | fetch-service | merged | Merged PR #100 via commit 2d202b5, fixing APT InRelease signature validation to verify the release against the archive's public keys. | |
| #10 metadata: add debian package inspector | fetch-service | merged | Merged PR #10 added a basic metadata inspector for Debian packages, extracting details including name, version, vendor, author, and integrity hashes. | |
| #308 fix(inspectors/apt): rejection fix and additional tests | fetch-service | merged | Merged in #308 via commit ecf2e07: APT translation-file uncompression failures now reject the artifact instead of erroring, with additional inspector tests. |