Bug#921685: 1.8.0~rc2 breaks using Release.gpg instead of InRelease

[Anthony DeRobertis <anthony@derobert.net>]

Package: libapt-pkg5.0
Version: 1.8.0~rc2
Severity: important

We have a local repository here which is generated with an (ancient!)
version of mini-dinstall. This worked fine until rc2. The problem
appears to be that it uses Release and Release.gpg instead of InRelease.

    root@648fb8052f3f:/# apt-get update
    Ign:1 http://haruhi.metrics.net/deb buster/ InRelease
    Get:2 http://haruhi.metrics.net/deb buster/ Release [1521 B]
    Get:3 http://haruhi.metrics.net/deb buster/ Release.gpg [88 B]                         
    Get:5 http://haruhi.metrics.net/deb buster/ Packages [3626 B]                          
    Get:4 http://security-cdn.debian.org/debian-security buster/updates InRelease [38.3 kB]
    Get:6 http://cdn-fastly.deb.debian.org/debian buster InRelease [159 kB]          
    Get:7 http://cdn-fastly.deb.debian.org/debian buster-updates InRelease [47.6 kB]
    Get:8 http://cdn-fastly.deb.debian.org/debian buster/main amd64 Packages [7958 kB]
    Fetched 8208 kB in 3s (2477 kB/s)   
    Reading package lists... Done
    root@648fb8052f3f:/# apt-get install libapt-pkg5.0=1.8.0~rc2
    Reading package lists... Done
    Building dependency tree       
    Reading state information... Done
    The following additional packages will be installed:
      apt
    Suggested packages:
      apt-doc aptitude | synaptic | wajig dpkg-dev gnupg | gnupg2 | gnupg1 powermgmt-base
    Recommended packages:
      ca-certificates
    The following packages will be upgraded:
      apt libapt-pkg5.0
    2 upgraded, 0 newly installed, 0 to remove and 11 not upgraded.
    Need to get 2280 kB of archives.
    After this operation, 14.3 kB of additional disk space will be used.
    Do you want to continue? [Y/n] 
    Get:1 http://cdn-fastly.deb.debian.org/debian buster/main amd64 libapt-pkg5.0 amd64 1.8.0~rc2 [965 kB]
    Get:2 http://cdn-fastly.deb.debian.org/debian buster/main amd64 apt amd64 1.8.0~rc2 [1315 kB]
    Fetched 2280 kB in 1s (3919 kB/s)
    debconf: delaying package configuration, since apt-utils is not installed
    (Reading database ... 6577 files and directories currently installed.)
    Preparing to unpack .../libapt-pkg5.0_1.8.0~rc2_amd64.deb ...
    Unpacking libapt-pkg5.0:amd64 (1.8.0~rc2) over (1.8.0~beta1) ...
    Setting up libapt-pkg5.0:amd64 (1.8.0~rc2) ...
    (Reading database ... 6577 files and directories currently installed.)
    Preparing to unpack .../apt_1.8.0~rc2_amd64.deb ...
    Unpacking apt (1.8.0~rc2) over (1.8.0~beta1) ...
    Setting up apt (1.8.0~rc2) ...
    Processing triggers for libc-bin (2.28-5) ...
    root@648fb8052f3f:/# apt-get update
    Ign:1 http://haruhi.metrics.net/deb buster/ InRelease
    Hit:2 http://haruhi.metrics.net/deb buster/ Release                                
    Err:3 http://haruhi.metrics.net/deb buster/ Release.gpg                            
      Signed file isn't valid, got 'NODATA' (does the network require authentication?)
    Hit:5 http://cdn-fastly.deb.debian.org/debian buster InRelease                                   
    Hit:4 http://security-cdn.debian.org/debian-security buster/updates InRelease
    Hit:6 http://cdn-fastly.deb.debian.org/debian buster-updates InRelease
    Reading package lists... Done
    W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://haruhi.metrics.net/deb buster/ Release: Signed file isn't valid, got 'NODATA' (does the network require authentication?)
    W: Failed to fetch http://haruhi.metrics.net/deb/buster/Release.gpg  Signed file isn't valid, got 'NODATA' (does the network require authentication?)
    W: Some index files failed to download. They have been ignored, or old ones used instead.

I think it's the lack of an InRelease file because when I ran this (in
the repository):

    $ gpg --clearsign < Release > InRelease

... then "apt-get update" is happy again.

-- System Information:
Debian Release: buster/sid
  APT prefers testing-debug
  APT policy: (500, 'testing-debug'), (500, 'testing'), (200, 'unstable-debug'), (200, 'unstable'), (150, 'stable'), (100, 'experimental-debug'), (100, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.19.0-1-amd64 (SMP w/8 CPU cores)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_FIRMWARE_WORKAROUND, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en_GB (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)