update test/integration/test-releasefile-verification

apt-pkg/acquire-item.cc

@@ -1623,7 +1623,15 @@ void pkgAcqMetaSig::Done(string Message,unsigned long long Size, HashStringList
 void pkgAcqMetaSig::Failed(string Message,pkgAcquire::MethodConfig *Cnf)/*{{{*/
 {
    string Final = _config->FindDir("Dir::State::lists") + URItoFileName(RealURI);
-   
+
+   // FIXME: duplicated code from pkgAcqMetaIndex
+   if (AuthPass == true)
+   {
+      bool Stop = GenerateAuthWarning(RealURI, Message);
+      if(Stop)
+         return;
+   }
+
    // FIXME: meh, this is not really elegant
    string InReleaseURI = RealURI.replace(RealURI.rfind("Release.gpg"), 12,
                                          "InRelease");
@@ -1658,14 +1666,6 @@ void pkgAcqMetaSig::Failed(string Message,pkgAcquire::MethodConfig *Cnf)/*{{{*/
    DestFile += URItoFileName(RealURI);
    TransactionManager->TransactionStageRemoval(this, DestFile);
 
-   // FIXME: duplicated code from pkgAcqMetaIndex
-   if (AuthPass == true)
-   {
-      bool Stop = GenerateAuthWarning(RealURI, Message);
-      if(Stop)
-         return;
-   }
-
    // only allow going further if the users explicitely wants it
    if(_config->FindB("Acquire::AllowInsecureRepositories") == true)
    {

test/integration/test-releasefile-verification

@@ -235,10 +235,21 @@ runtest2() {
 " aptcache show apt
 	failaptnew
 }
-runtest2
 
+# diable some protection by default and ensure we still do the verification
+# correctly
+cat > rootdir/etc/apt/apt.conf.d/weaken-security <<EOF
+Acquire::AllowInsecureRepositories "1";
+Acquire::AllowDowngradeToInsecureRepositories "1";
+EOF
+
+msgmsg "Runing base test"
+runtest2
 
 DELETEFILE="InRelease"
+msgmsg "Running test with deletion of $DELETEFILE"
 runtest
+
 DELETEFILE="Release.gpg"
+msgmsg "Running test with deletion of $DELETEFILE"
 runtest