Merge branch 'debian_inrelease2' into 'master'

Return signature in InRelease and Release.gpg endpoints

See merge request gitlab-org/gitlab!67061

lib/api/concerns/packages/debian_package_endpoints.rb

@@ -71,7 +71,7 @@ module API
 
             route_setting :authentication, authenticate_non_public: true
             get 'Release.gpg' do
-              not_found!
+              distribution_from!(project_or_group).file_signature
             end
 
             # GET {projects|groups}/:id/packages/debian/dists/*distribution/Release
@@ -91,8 +91,7 @@ module API
 
             route_setting :authentication, authenticate_non_public: true
             get 'InRelease' do
-              # Signature to be added in 7.3 of https://gitlab.com/groups/gitlab-org/-/epics/6057#note_582697034
-              present_carrierwave_file!(distribution_from!(project_or_group).file)
+              present_carrierwave_file!(distribution_from!(project_or_group).signed_file)
             end
 
             params do

spec/factories/packages/debian/distribution.rb

@@ -13,8 +13,18 @@ FactoryBot.define do
     end
 
     trait(:with_file) do
+      file_signature do
+        <<~EOF
+        -----BEGIN PGP SIGNATURE-----
+
+        ABC
+        -----BEGIN PGP SIGNATURE-----
+        EOF
+      end
+
       after(:build) do |distribution, evaluator|
         distribution.file = fixture_file_upload('spec/fixtures/packages/debian/distribution/Release')
+        distribution.signed_file = fixture_file_upload('spec/fixtures/packages/debian/distribution/InRelease')
       end
     end
 

spec/fixtures/packages/debian/distribution/InRelease

+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA256
+
+Codename: fixture-distribution
+-----BEGIN PGP SIGNATURE-----
+
+ABC
+-----BEGIN PGP SIGNATURE-----

spec/requests/api/debian_group_packages_spec.rb

@@ -15,7 +15,7 @@ RSpec.describe API::DebianGroupPackages do
     describe 'GET groups/:id/-/packages/debian/dists/*distribution/Release.gpg' do
       let(:url) { "/groups/#{container.id}/-/packages/debian/dists/#{distribution.codename}/Release.gpg" }
 
-      it_behaves_like 'Debian repository read endpoint', 'GET request', :not_found
+      it_behaves_like 'Debian repository read endpoint', 'GET request', :success, /^-----BEGIN PGP SIGNATURE-----/
     end
 
     describe 'GET groups/:id/-/packages/debian/dists/*distribution/Release' do
@@ -27,7 +27,7 @@ RSpec.describe API::DebianGroupPackages do
     describe 'GET groups/:id/-/packages/debian/dists/*distribution/InRelease' do
       let(:url) { "/groups/#{container.id}/-/packages/debian/dists/#{distribution.codename}/InRelease" }
 
-      it_behaves_like 'Debian repository read endpoint', 'GET request', :success, /^Codename: fixture-distribution\n$/
+      it_behaves_like 'Debian repository read endpoint', 'GET request', :success, /^-----BEGIN PGP SIGNED MESSAGE-----/
     end
 
     describe 'GET groups/:id/-/packages/debian/dists/*distribution/:component/binary-:architecture/Packages' do

spec/requests/api/debian_project_packages_spec.rb

@@ -15,7 +15,7 @@ RSpec.describe API::DebianProjectPackages do
     describe 'GET projects/:id/packages/debian/dists/*distribution/Release.gpg' do
       let(:url) { "/projects/#{container.id}/packages/debian/dists/#{distribution.codename}/Release.gpg" }
 
-      it_behaves_like 'Debian repository read endpoint', 'GET request', :not_found
+      it_behaves_like 'Debian repository read endpoint', 'GET request', :success, /^-----BEGIN PGP SIGNATURE-----/
     end
 
     describe 'GET projects/:id/packages/debian/dists/*distribution/Release' do
@@ -27,7 +27,7 @@ RSpec.describe API::DebianProjectPackages do
     describe 'GET projects/:id/packages/debian/dists/*distribution/InRelease' do
       let(:url) { "/projects/#{container.id}/packages/debian/dists/#{distribution.codename}/InRelease" }
 
-      it_behaves_like 'Debian repository read endpoint', 'GET request', :success, /^Codename: fixture-distribution\n$/
+      it_behaves_like 'Debian repository read endpoint', 'GET request', :success, /^-----BEGIN PGP SIGNED MESSAGE-----/
     end
 
     describe 'GET projects/:id/packages/debian/dists/*distribution/:component/binary-:architecture/Packages' do