From 3bcbd1557b4ee0c964cc2dbbc936af00b0ea1316 Mon Sep 17 00:00:00 2001
From: Hugh Esco <hesco@campaignfoundations.com>
Date: Wed, 9 Feb 2022 06:57:55 -0500
Subject: [PATCH] enable allow-insecure for apt::source defined types, includes
 new tests, documentation (#1014)

Co-authored-by: Lukas Audzevicius <97180854+LukasAud@users.noreply.github.com>
---
 REFERENCE.md                       | 11 +++++++++++
 manifests/source.pp                |  8 +++++---
 spec/defines/source_compat_spec.rb | 12 ++++++++++++
 spec/defines/source_spec.rb        | 13 +++++++++++++
 4 files changed, 41 insertions(+), 3 deletions(-)

diff --git a/REFERENCE.md b/REFERENCE.md
index 674ec22..0293856 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -935,6 +935,7 @@ The following parameters are available in the `apt::source` defined type:
 * [`pin`](#pin)
 * [`architecture`](#architecture)
 * [`allow_unsigned`](#allow_unsigned)
+* [`allow_insecure`](#allow_insecure)
 * [`notify_update`](#notify_update)
 
 ##### <a name="location"></a>`location`
@@ -1036,6 +1037,16 @@ Specifies whether to authenticate packages from this release, even if the Releas
 
 Default value: ``false``
 
+##### <a name="allow_insecure"></a>`allow_insecure`
+
+Data type: `Boolean`
+
+Specifies whether to authenticate packages from this release, even if the Release file is not signed or the signature can't be checked.
+Unlike the `allow_unsigned` (trusted=yes) option, this should throw a warning that the interaction is insecure.  
+See [this comment](https://unix.stackexchange.com/a/480550) for a brief discussion of the difference and why this option might be preferable to `allow_unsigned`.
+
+Default value: ``false``
+
 ##### <a name="notify_update"></a>`notify_update`
 
 Data type: `Boolean`
diff --git a/manifests/source.pp b/manifests/source.pp
index be5b1c4..54cfadf 100644
--- a/manifests/source.pp
+++ b/manifests/source.pp
@@ -70,6 +70,7 @@ define apt::source(
   Optional[Variant[Hash, Numeric, String]] $pin = undef,
   Optional[String] $architecture                = undef,
   Boolean $allow_unsigned                       = false,
+  Boolean $allow_insecure                       = false,
   Boolean $notify_update                        = true,
 ) {
 
@@ -135,9 +136,10 @@ define apt::source(
     'comment'          => $comment,
     'includes'         => $includes,
     'options'          => delete_undef_values({
-      'arch'      => $_architecture,
-      'trusted'   => $allow_unsigned ? {true => "yes", false => undef},
-      'signed-by' => $keyring,
+      'arch'           => $architecture,
+      'trusted'        => $allow_unsigned ? {true => "yes", false => undef},
+      'allow-insecure' => $allow_insecure ? {true => "yes", false => undef},
+      'signed-by'      => $keyring,
     }),
     'location'         => $_location,
     'release'          => $_release,
diff --git a/spec/defines/source_compat_spec.rb b/spec/defines/source_compat_spec.rb
index c35b630..bd54fcf 100644
--- a/spec/defines/source_compat_spec.rb
+++ b/spec/defines/source_compat_spec.rb
@@ -71,6 +71,18 @@ describe 'apt::source', type: :define do
     }
   end
 
+  context 'when allow_insecure true' do
+    let :params do
+      {
+        'include'        => { 'src' => false },
+        'location'       => 'http://debian.mirror.iweb.ca/debian/',
+        'allow_insecure' => true,
+      }
+    end
+
+    it { is_expected.to contain_apt__setting('list-my_source').with_content(%r{# my_source\ndeb \[allow-insecure=yes\] http://debian.mirror.iweb.ca/debian/ jessie main\n}) }
+  end
+
   context 'when allow_unsigned true' do
     let :params do
       {
diff --git a/spec/defines/source_spec.rb b/spec/defines/source_spec.rb
index f6c2e23..9a8d4a7 100644
--- a/spec/defines/source_spec.rb
+++ b/spec/defines/source_spec.rb
@@ -145,6 +145,19 @@ describe 'apt::source' do
     end
   end
 
+  context 'with allow_insecure true' do
+    let :params do
+      {
+        location: 'hello.there',
+        allow_insecure: true,
+      }
+    end
+
+    it {
+      is_expected.to contain_apt__setting('list-my_source').with(ensure: 'present').with_content(%r{# my_source\ndeb \[allow-insecure=yes\] hello.there jessie main\n})
+    }
+  end
+
   context 'with allow_unsigned true' do
     let :params do
       {
-- 
2.32.3