Bug#578540: Acknowledgement (APT::Authentication::TrustCDROM "false"; is not working)

["Andreas.Miller" <Andreas.Miller@sec-xtreme.com>]

Hello,

Situation:

Unsigned CD-ROM

When an unsigned CD-ROM is added with the command "apt-cdrom add" no
copy of the Release-File will be done to /var/lib/apt/lists.

Signed CD-ROM

If the CD-ROM is signed and verified against /etc/apt/trusted.gpg the
Release- and the Release.gpg will be copied to /var/lib/apt/lists.

Bugfix:
With the patch in debmetaindex.cc an unsigned CD-ROM will only be used
for the installation when APT::Authentication::TrustCDROM "true".

Attached is a small patch to fix the logic.

Best Regards
Andreas

*** apt-pkg/deb/debmetaindex.cc	2009-02-07 16:09:35.000000000 +0100
--- apt-pkg/deb/debmetaindex.cc	2010-05-07 06:13:17.000000000 +0200
***************
*** 180,186 ****
     string VerifiedSigFile = _config->FindDir("Dir::State::lists") +
        URItoFileName(MetaIndexURI("Release")) + ".gpg";
     
!    if(_config->FindB("APT::Authentication::TrustCDROM", false))
        if(URI.substr(0,strlen("cdrom:")) == "cdrom:")
  	 return true;
     
--- 180,186 ----
     string VerifiedSigFile = _config->FindDir("Dir::State::lists") +
        URItoFileName(MetaIndexURI("Release")) + ".gpg";
     
!    if(_config->FindB("APT::Authentication::TrustCDROM", true))
        if(URI.substr(0,strlen("cdrom:")) == "cdrom:")
  	 return true;