apt repo: allow insecure repos

In Xenial this was the default behavior, which explains why Snapcraft
works. However, in Zesty this behavior changed, causing breakage when
using external repositories (e.g. ROS). Instead of relying on defaults,
ensure the behavior is consistent across releases.

This is not a long-term fix. We should add a way to ack repository keys.

Signed-off-by: Kyle Fazzari <kyrofa@ubuntu.com>

snapcraft/internal/repo/_deb.py

@@ -66,6 +66,13 @@ def _setup_apt(self, cache_dir):
         # Do not install recommends
         apt.apt_pkg.config.set('Apt::Install-Recommends', 'False')
 
+        # Don't verify repository keys. FIXME: We should have a way to simply
+        # ack keys for extra repositories. We're only setting this here because
+        # in Xenial it defaulted to True, but in Zesty that has changed to
+        # False, and we want consistent behavior. This is, however, not a
+        # long-term solution.
+        apt.apt_pkg.config.set('Acquire::AllowInsecureRepositories', 'True')
+
         # Methods and solvers dir for when in the SNAP
         if common.is_snap():
             snap_dir = os.getenv('SNAP')

snapcraft/tests/repo/test_deb.py

@@ -76,6 +76,7 @@ def test_get_package(self, mock_apt_pkg):
 
         mock_apt_pkg.assert_has_calls([
             call.config.set('Apt::Install-Recommends', 'False'),
+            call.config.set('Acquire::AllowInsecureRepositories', 'True'),
             call.config.find_file('Dir::Etc::Trusted'),
             call.config.set('Dir::Etc::Trusted', ANY),
             call.config.find_file('Dir::Etc::TrustedParts'),
@@ -115,6 +116,7 @@ def test_get_multiarch_package(self, mock_apt_pkg):
 
         mock_apt_pkg.assert_has_calls([
             call.config.set('Apt::Install-Recommends', 'False'),
+            call.config.set('Acquire::AllowInsecureRepositories', 'True'),
             call.config.find_file('Dir::Etc::Trusted'),
             call.config.set('Dir::Etc::Trusted', ANY),
             call.config.find_file('Dir::Etc::TrustedParts'),