From ffa86a76866321216634f72f129fd1b774a22488 Mon Sep 17 00:00:00 2001
From: rrskris <rrskris@gmail.com>
Date: Mon, 6 Jul 2026 22:57:08 +0530
Subject: [PATCH 1/2] Support DEB822 apt source format in
 apt_sources_list_official

The OVAL check for apt_sources_list_official only matched the legacy
one-line sources.list syntax, so a system using the DEB822 format
(the default since apt 2.x, e.g. /etc/apt/sources.list.d/*.sources)
was reported as not using official repositories even when it was.

Also fix the filepath regex: it was written to match
/etc/apt/sources.d/*.list, which is not a real Debian path, instead
of the intended /etc/apt/sources.list.d/*.list, so repos split into
sources.list.d were never detected by the legacy check either.

Add DEB822-aware checks alongside the existing legacy ones (combined
with OR) for debian11, debian12, and the generic shared fallback, and
add test scenarios covering the legacy format, DEB822 with base and
security combined in one file (the originally reported case), DEB822
split across files, and DEB822 with only a third-party repo.

Fixes #12509
---
 .../oval/debian11.xml                         | 36 ++++++++++++++++--
 .../oval/debian12.xml                         | 36 ++++++++++++++++--
 .../apt_sources_list_official/oval/shared.xml | 38 ++++++++++++++++---
 .../tests/correct_deb822_combined.pass.sh     | 19 ++++++++++
 .../correct_deb822_separate_files.pass.sh     | 21 ++++++++++
 .../correct_legacy_sources_list_d.pass.sh     | 10 +++++
 .../wrong_deb822_thirdparty_only.fail.sh      | 13 +++++++
 .../tests/wrong_missing.fail.sh               |  6 +++
 8 files changed, 166 insertions(+), 13 deletions(-)
 create mode 100644 linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_combined.pass.sh
 create mode 100644 linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_separate_files.pass.sh
 create mode 100644 linux_os/guide/services/apt/apt_sources_list_official/tests/correct_legacy_sources_list_d.pass.sh
 create mode 100644 linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_deb822_thirdparty_only.fail.sh
 create mode 100644 linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_missing.fail.sh

diff --git a/linux_os/guide/services/apt/apt_sources_list_official/oval/debian11.xml b/linux_os/guide/services/apt/apt_sources_list_official/oval/debian11.xml
index 20efae3dcb42..6ba32d4a56a5 100644
--- a/linux_os/guide/services/apt/apt_sources_list_official/oval/debian11.xml
+++ b/linux_os/guide/services/apt/apt_sources_list_official/oval/debian11.xml
@@ -2,8 +2,14 @@
   <definition class="compliance" id="apt_sources_list_official" version="1">
     {{{ oval_metadata("Official distribution repositories contain up-to-date distribution security and functional patches.", rule_title=rule_title) }}}
     <criteria comment="Match sources.list distribution repositories usage" operator="AND">
-      <criterion comment="Check /etc/apt/sources(.d/.+).list file for base" test_ref="test_apt_sources_list_base_official" />
-      <criterion comment="Check /etc/apt/sources(.d/.+).list file for security" test_ref="test_apt_sources_list_security_official" />
+      <criteria comment="Check base repository, one-line or DEB822 format" operator="OR">
+        <criterion comment="Check /etc/apt/sources(.list.d/.+).list file for base, one-line format" test_ref="test_apt_sources_list_base_official" />
+        <criterion comment="Check /etc/apt/sources(.list.d/.+).sources file for base, DEB822 format" test_ref="test_apt_sources_list_base_official_deb822" />
+      </criteria>
+      <criteria comment="Check security repository, one-line or DEB822 format" operator="OR">
+        <criterion comment="Check /etc/apt/sources(.list.d/.+).list file for security, one-line format" test_ref="test_apt_sources_list_security_official" />
+        <criterion comment="Check /etc/apt/sources(.list.d/.+).sources file for security, DEB822 format" test_ref="test_apt_sources_list_security_official_deb822" />
+      </criteria>
     </criteria>
   </definition>
   <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Checks usage of official distribution base repositories"
@@ -11,7 +17,7 @@
     <ind:object object_ref="obj_apt_sources_list_base_official" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_apt_sources_list_base_official" version="1">
-    <ind:filepath operation="pattern match">^/etc/apt/sources(.d\/[a-zA-Z0-9]+){0,1}.list$</ind:filepath>
+    <ind:filepath operation="pattern match">^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$</ind:filepath>
     <ind:pattern operation="pattern match">^deb[\s]+http://[a-z\.]+\.debian\.org/debian[/]?[\s]+bullseye[\s]+main</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
@@ -20,8 +26,30 @@
     <ind:object object_ref="obj_apt_sources_list_security_official" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_apt_sources_list_security_official" version="1">
-    <ind:filepath operation="pattern match">^/etc/apt/sources(.d\/[a-zA-Z0-9]+){0,1}.list$</ind:filepath>
+    <ind:filepath operation="pattern match">^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$</ind:filepath>
     <ind:pattern operation="pattern match">^deb[\s]+http://security\.debian\.org/debian-security[/]?[\s]+bullseye-security[\s]+main</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="at least one" check_existence="at_least_one_exists" comment="Checks usage of official distribution base repositories, DEB822 format"
+  id="test_apt_sources_list_base_official_deb822" version="1">
+    <ind:object object_ref="obj_apt_sources_deb822_official" />
+    <ind:state state_ref="state_apt_sources_deb822_base" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_test check="at least one" check_existence="at_least_one_exists" comment="Checks usage of official distribution security repositories, DEB822 format"
+  id="test_apt_sources_list_security_official_deb822" version="1">
+    <ind:object object_ref="obj_apt_sources_deb822_official" />
+    <ind:state state_ref="state_apt_sources_deb822_security" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_apt_sources_deb822_official" version="1">
+    <ind:filepath operation="pattern match">^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.sources$</ind:filepath>
+    <ind:pattern operation="pattern match">Types:[^\n]*\n(?:(?!Types:)[^\n]*\n?)*</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_state id="state_apt_sources_deb822_base" version="1">
+    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*http://[a-z.]*\.debian\.org/debian/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\bbullseye(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
+  </ind:textfilecontent54_state>
+  <ind:textfilecontent54_state id="state_apt_sources_deb822_security" version="1">
+    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*http://[a-z.]*\.debian\.org/debian-security/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\bbullseye-security(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
+  </ind:textfilecontent54_state>
 </def-group>
diff --git a/linux_os/guide/services/apt/apt_sources_list_official/oval/debian12.xml b/linux_os/guide/services/apt/apt_sources_list_official/oval/debian12.xml
index 8390203d356c..4aa23164c63b 100644
--- a/linux_os/guide/services/apt/apt_sources_list_official/oval/debian12.xml
+++ b/linux_os/guide/services/apt/apt_sources_list_official/oval/debian12.xml
@@ -2,8 +2,14 @@
   <definition class="compliance" id="apt_sources_list_official" version="1">
     {{{ oval_metadata("Official distribution repositories contain up-to-date distribution security and functional patches.", rule_title=rule_title) }}}
     <criteria comment="Match sources.list distribution repositories usage" operator="AND">
-      <criterion comment="Check /etc/apt/sources(.d/.+).list file for base" test_ref="test_apt_sources_list_base_official" />
-      <criterion comment="Check /etc/apt/sources(.d/.+).list file for security" test_ref="test_apt_sources_list_security_official" />
+      <criteria comment="Check base repository, one-line or DEB822 format" operator="OR">
+        <criterion comment="Check /etc/apt/sources(.list.d/.+).list file for base, one-line format" test_ref="test_apt_sources_list_base_official" />
+        <criterion comment="Check /etc/apt/sources(.list.d/.+).sources file for base, DEB822 format" test_ref="test_apt_sources_list_base_official_deb822" />
+      </criteria>
+      <criteria comment="Check security repository, one-line or DEB822 format" operator="OR">
+        <criterion comment="Check /etc/apt/sources(.list.d/.+).list file for security, one-line format" test_ref="test_apt_sources_list_security_official" />
+        <criterion comment="Check /etc/apt/sources(.list.d/.+).sources file for security, DEB822 format" test_ref="test_apt_sources_list_security_official_deb822" />
+      </criteria>
     </criteria>
   </definition>
   <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Checks usage of official distribution base repositories"
@@ -11,7 +17,7 @@
     <ind:object object_ref="obj_apt_sources_list_base_official" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_apt_sources_list_base_official" version="1">
-    <ind:filepath operation="pattern match">^/etc/apt/sources(.d\/[a-zA-Z0-9]+){0,1}.list$</ind:filepath>
+    <ind:filepath operation="pattern match">^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$</ind:filepath>
     <ind:pattern operation="pattern match">^deb[\s]+http://[a-z\.]+\.debian\.org/debian[/]?[\s]+bookworm[\s]+main</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
@@ -20,8 +26,30 @@
     <ind:object object_ref="obj_apt_sources_list_security_official" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_apt_sources_list_security_official" version="1">
-    <ind:filepath operation="pattern match">^/etc/apt/sources(.d\/[a-zA-Z0-9]+){0,1}.list$</ind:filepath>
+    <ind:filepath operation="pattern match">^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$</ind:filepath>
     <ind:pattern operation="pattern match">^deb[\s]+http://security\.debian\.org/debian-security[/]?[\s]+bookworm-security[\s]+main</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="at least one" check_existence="at_least_one_exists" comment="Checks usage of official distribution base repositories, DEB822 format"
+  id="test_apt_sources_list_base_official_deb822" version="1">
+    <ind:object object_ref="obj_apt_sources_deb822_official" />
+    <ind:state state_ref="state_apt_sources_deb822_base" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_test check="at least one" check_existence="at_least_one_exists" comment="Checks usage of official distribution security repositories, DEB822 format"
+  id="test_apt_sources_list_security_official_deb822" version="1">
+    <ind:object object_ref="obj_apt_sources_deb822_official" />
+    <ind:state state_ref="state_apt_sources_deb822_security" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_apt_sources_deb822_official" version="1">
+    <ind:filepath operation="pattern match">^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.sources$</ind:filepath>
+    <ind:pattern operation="pattern match">Types:[^\n]*\n(?:(?!Types:)[^\n]*\n?)*</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_state id="state_apt_sources_deb822_base" version="1">
+    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*http://[a-z.]*\.debian\.org/debian/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\bbookworm(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
+  </ind:textfilecontent54_state>
+  <ind:textfilecontent54_state id="state_apt_sources_deb822_security" version="1">
+    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*http://[a-z.]*\.debian\.org/debian-security/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\bbookworm-security(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
+  </ind:textfilecontent54_state>
 </def-group>
diff --git a/linux_os/guide/services/apt/apt_sources_list_official/oval/shared.xml b/linux_os/guide/services/apt/apt_sources_list_official/oval/shared.xml
index 35a236f537c0..566911c48c07 100644
--- a/linux_os/guide/services/apt/apt_sources_list_official/oval/shared.xml
+++ b/linux_os/guide/services/apt/apt_sources_list_official/oval/shared.xml
@@ -1,9 +1,15 @@
 <def-group>
   <definition class="compliance" id="apt_sources_list_official" version="1">
     {{{ oval_metadata("Official distribution repositories contain up-to-date distribution security and functional patches.", rule_title=rule_title) }}}
-    <criteria comment="Match sources.list distribution repositories usage" operator="AND">      
-      <criterion comment="Check /etc/apt/sources(.d/.+).list file for base" test_ref="test_apt_sources_list_base_official" />
-      <criterion comment="Check /etc/apt/sources(.d/.+).list file for security" test_ref="test_apt_sources_list_security_official" />
+    <criteria comment="Match sources.list distribution repositories usage" operator="AND">
+      <criteria comment="Check base repository, one-line or DEB822 format" operator="OR">
+        <criterion comment="Check /etc/apt/sources(.list.d/.+).list file for base, one-line format" test_ref="test_apt_sources_list_base_official" />
+        <criterion comment="Check /etc/apt/sources(.list.d/.+).sources file for base, DEB822 format" test_ref="test_apt_sources_list_base_official_deb822" />
+      </criteria>
+      <criteria comment="Check security repository, one-line or DEB822 format" operator="OR">
+        <criterion comment="Check /etc/apt/sources(.list.d/.+).list file for security, one-line format" test_ref="test_apt_sources_list_security_official" />
+        <criterion comment="Check /etc/apt/sources(.list.d/.+).sources file for security, DEB822 format" test_ref="test_apt_sources_list_security_official_deb822" />
+      </criteria>
     </criteria>
   </definition>
   <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Checks usage of official distribution base repositories"
@@ -11,7 +17,7 @@
     <ind:object object_ref="obj_apt_sources_list_base_official" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_apt_sources_list_base_official" version="1">
-    <ind:filepath operation="pattern match">^/etc/apt/sources(.d\/[a-zA-Z0-9]+){0,1}.list$</ind:filepath>
+    <ind:filepath operation="pattern match">^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$</ind:filepath>
     <ind:pattern operation="pattern match">^deb[\s]+http://[a-z\.]+\.debian\.org/debian[\s]+[a-z]+[\s]+main</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
@@ -20,8 +26,30 @@
     <ind:object object_ref="obj_apt_sources_list_security_official" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_apt_sources_list_security_official" version="1">
-    <ind:filepath operation="pattern match">^/etc/apt/sources(.d\/[a-zA-Z0-9]+){0,1}.list$</ind:filepath>
+    <ind:filepath operation="pattern match">^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$</ind:filepath>
     <ind:pattern operation="pattern match">^deb[\s]+http://security\.debian\.org/debian-security[\s]+[a-z]+/updates[\s]+main</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="at least one" check_existence="at_least_one_exists" comment="Checks usage of official distribution base repositories, DEB822 format"
+  id="test_apt_sources_list_base_official_deb822" version="1">
+    <ind:object object_ref="obj_apt_sources_deb822_official" />
+    <ind:state state_ref="state_apt_sources_deb822_base" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_test check="at least one" check_existence="at_least_one_exists" comment="Checks usage of official distribution security repositories, DEB822 format"
+  id="test_apt_sources_list_security_official_deb822" version="1">
+    <ind:object object_ref="obj_apt_sources_deb822_official" />
+    <ind:state state_ref="state_apt_sources_deb822_security" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="obj_apt_sources_deb822_official" version="1">
+    <ind:filepath operation="pattern match">^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.sources$</ind:filepath>
+    <ind:pattern operation="pattern match">Types:[^\n]*\n(?:(?!Types:)[^\n]*\n?)*</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+  </ind:textfilecontent54_object>
+  <ind:textfilecontent54_state id="state_apt_sources_deb822_base" version="1">
+    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*http://[a-z.]*\.debian\.org/debian/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\b[a-z]+(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
+  </ind:textfilecontent54_state>
+  <ind:textfilecontent54_state id="state_apt_sources_deb822_security" version="1">
+    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*http://[a-z.]*\.debian\.org/debian-security/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\b[a-z]+-security(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
+  </ind:textfilecontent54_state>
 </def-group>
diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_combined.pass.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_combined.pass.sh
new file mode 100644
index 000000000000..85cd190875ed
--- /dev/null
+++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_combined.pass.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+# platform = multi_platform_debian
+# remediation = none
+
+rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*
+
+cat > /etc/apt/sources.list.d/debian.sources << 'EOF'
+Types: deb
+URIs: http://deb.debian.org/debian
+Suites: bookworm bookworm-updates
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb
+URIs: http://deb.debian.org/debian-security
+Suites: bookworm-security
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+EOF
diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_separate_files.pass.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_separate_files.pass.sh
new file mode 100644
index 000000000000..0d612cb51b2a
--- /dev/null
+++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_separate_files.pass.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+# platform = multi_platform_debian
+# remediation = none
+
+rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*
+
+cat > /etc/apt/sources.list.d/debian.sources << 'EOF'
+Types: deb
+URIs: http://deb.debian.org/debian
+Suites: bookworm
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+EOF
+
+cat > /etc/apt/sources.list.d/debian-security.sources << 'EOF'
+Types: deb
+URIs: http://deb.debian.org/debian-security
+Suites: bookworm-security
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+EOF
diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_legacy_sources_list_d.pass.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_legacy_sources_list_d.pass.sh
new file mode 100644
index 000000000000..0a49c019c6e6
--- /dev/null
+++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_legacy_sources_list_d.pass.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+# platform = multi_platform_debian
+# remediation = none
+
+rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*
+
+cat > /etc/apt/sources.list.d/debian.list << 'EOF'
+deb http://deb.debian.org/debian bookworm main
+deb http://security.debian.org/debian-security bookworm-security main
+EOF
diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_deb822_thirdparty_only.fail.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_deb822_thirdparty_only.fail.sh
new file mode 100644
index 000000000000..9912546cb219
--- /dev/null
+++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_deb822_thirdparty_only.fail.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+# platform = multi_platform_debian
+# remediation = none
+
+rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*
+
+cat > /etc/apt/sources.list.d/example.sources << 'EOF'
+Types: deb
+URIs: https://packages.example.com/debian
+Suites: stable
+Components: main
+Signed-By: /usr/share/keyrings/example.gpg
+EOF
diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_missing.fail.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_missing.fail.sh
new file mode 100644
index 000000000000..0e39ce01748f
--- /dev/null
+++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_missing.fail.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# platform = multi_platform_debian
+# remediation = none
+
+rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*
+touch /etc/apt/sources.list

From 75a86954e77bcc882e24e1ba8cd7830612b68ea9 Mon Sep 17 00:00:00 2001
From: rrskris <rrskris@gmail.com>
Date: Tue, 7 Jul 2026 13:38:36 +0530
Subject: [PATCH 2/2] Accept HTTPS mirrors and pin bookworm test scenarios to
 Debian 12

Address review comments on the DEB822 support PR:

- Accept https:// in addition to http:// for official repository URIs,
  in both the pre-existing one-line patterns and the new DEB822 states
  (debian11, debian12, shared), and add an https DEB822 test scenario.
- Mark the three bookworm-dependent test scenarios as Debian 12 only.
- Create /etc/apt/sources.list.d in test setup so the remaining
  multi_platform_debian scenarios evaluate as notapplicable instead of
  erroring when the test backend is not an apt-based container
  (Automatus Fedora runs the debian11 product in a Fedora container).
---
 .../oval/debian11.xml                         |  8 ++++----
 .../oval/debian12.xml                         |  8 ++++----
 .../apt_sources_list_official/oval/shared.xml |  8 ++++----
 .../tests/correct_deb822_combined.pass.sh     |  3 ++-
 .../tests/correct_deb822_https.pass.sh        | 20 +++++++++++++++++++
 .../correct_deb822_separate_files.pass.sh     |  3 ++-
 .../correct_legacy_sources_list_d.pass.sh     |  3 ++-
 .../wrong_deb822_thirdparty_only.fail.sh      |  1 +
 .../tests/wrong_missing.fail.sh               |  1 +
 9 files changed, 40 insertions(+), 15 deletions(-)
 create mode 100644 linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_https.pass.sh

diff --git a/linux_os/guide/services/apt/apt_sources_list_official/oval/debian11.xml b/linux_os/guide/services/apt/apt_sources_list_official/oval/debian11.xml
index 6ba32d4a56a5..a4c826eee4d4 100644
--- a/linux_os/guide/services/apt/apt_sources_list_official/oval/debian11.xml
+++ b/linux_os/guide/services/apt/apt_sources_list_official/oval/debian11.xml
@@ -18,7 +18,7 @@
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_apt_sources_list_base_official" version="1">
     <ind:filepath operation="pattern match">^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$</ind:filepath>
-    <ind:pattern operation="pattern match">^deb[\s]+http://[a-z\.]+\.debian\.org/debian[/]?[\s]+bullseye[\s]+main</ind:pattern>
+    <ind:pattern operation="pattern match">^deb[\s]+https?://[a-z\.]+\.debian\.org/debian[/]?[\s]+bullseye[\s]+main</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
   <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Checks usage of official distribution security repositories"
@@ -27,7 +27,7 @@
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_apt_sources_list_security_official" version="1">
     <ind:filepath operation="pattern match">^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$</ind:filepath>
-    <ind:pattern operation="pattern match">^deb[\s]+http://security\.debian\.org/debian-security[/]?[\s]+bullseye-security[\s]+main</ind:pattern>
+    <ind:pattern operation="pattern match">^deb[\s]+https?://security\.debian\.org/debian-security[/]?[\s]+bullseye-security[\s]+main</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -47,9 +47,9 @@
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
   </ind:textfilecontent54_object>
   <ind:textfilecontent54_state id="state_apt_sources_deb822_base" version="1">
-    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*http://[a-z.]*\.debian\.org/debian/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\bbullseye(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
+    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*https?://[a-z.]*\.debian\.org/debian/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\bbullseye(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
   </ind:textfilecontent54_state>
   <ind:textfilecontent54_state id="state_apt_sources_deb822_security" version="1">
-    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*http://[a-z.]*\.debian\.org/debian-security/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\bbullseye-security(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
+    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*https?://[a-z.]*\.debian\.org/debian-security/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\bbullseye-security(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
   </ind:textfilecontent54_state>
 </def-group>
diff --git a/linux_os/guide/services/apt/apt_sources_list_official/oval/debian12.xml b/linux_os/guide/services/apt/apt_sources_list_official/oval/debian12.xml
index 4aa23164c63b..9cdf67d43405 100644
--- a/linux_os/guide/services/apt/apt_sources_list_official/oval/debian12.xml
+++ b/linux_os/guide/services/apt/apt_sources_list_official/oval/debian12.xml
@@ -18,7 +18,7 @@
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_apt_sources_list_base_official" version="1">
     <ind:filepath operation="pattern match">^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$</ind:filepath>
-    <ind:pattern operation="pattern match">^deb[\s]+http://[a-z\.]+\.debian\.org/debian[/]?[\s]+bookworm[\s]+main</ind:pattern>
+    <ind:pattern operation="pattern match">^deb[\s]+https?://[a-z\.]+\.debian\.org/debian[/]?[\s]+bookworm[\s]+main</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
   <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Checks usage of official distribution security repositories"
@@ -27,7 +27,7 @@
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_apt_sources_list_security_official" version="1">
     <ind:filepath operation="pattern match">^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$</ind:filepath>
-    <ind:pattern operation="pattern match">^deb[\s]+http://security\.debian\.org/debian-security[/]?[\s]+bookworm-security[\s]+main</ind:pattern>
+    <ind:pattern operation="pattern match">^deb[\s]+https?://security\.debian\.org/debian-security[/]?[\s]+bookworm-security[\s]+main</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -47,9 +47,9 @@
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
   </ind:textfilecontent54_object>
   <ind:textfilecontent54_state id="state_apt_sources_deb822_base" version="1">
-    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*http://[a-z.]*\.debian\.org/debian/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\bbookworm(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
+    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*https?://[a-z.]*\.debian\.org/debian/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\bbookworm(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
   </ind:textfilecontent54_state>
   <ind:textfilecontent54_state id="state_apt_sources_deb822_security" version="1">
-    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*http://[a-z.]*\.debian\.org/debian-security/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\bbookworm-security(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
+    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*https?://[a-z.]*\.debian\.org/debian-security/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\bbookworm-security(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
   </ind:textfilecontent54_state>
 </def-group>
diff --git a/linux_os/guide/services/apt/apt_sources_list_official/oval/shared.xml b/linux_os/guide/services/apt/apt_sources_list_official/oval/shared.xml
index 566911c48c07..619fb82e2a8b 100644
--- a/linux_os/guide/services/apt/apt_sources_list_official/oval/shared.xml
+++ b/linux_os/guide/services/apt/apt_sources_list_official/oval/shared.xml
@@ -18,7 +18,7 @@
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_apt_sources_list_base_official" version="1">
     <ind:filepath operation="pattern match">^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$</ind:filepath>
-    <ind:pattern operation="pattern match">^deb[\s]+http://[a-z\.]+\.debian\.org/debian[\s]+[a-z]+[\s]+main</ind:pattern>
+    <ind:pattern operation="pattern match">^deb[\s]+https?://[a-z\.]+\.debian\.org/debian[\s]+[a-z]+[\s]+main</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
   <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Checks usage of official distribution security repositories"
@@ -27,7 +27,7 @@
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="obj_apt_sources_list_security_official" version="1">
     <ind:filepath operation="pattern match">^/etc/apt/sources(\.list\.d/[a-zA-Z0-9._-]+)?\.list$</ind:filepath>
-    <ind:pattern operation="pattern match">^deb[\s]+http://security\.debian\.org/debian-security[\s]+[a-z]+/updates[\s]+main</ind:pattern>
+    <ind:pattern operation="pattern match">^deb[\s]+https?://security\.debian\.org/debian-security[\s]+[a-z]+/updates[\s]+main</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
@@ -47,9 +47,9 @@
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
   </ind:textfilecontent54_object>
   <ind:textfilecontent54_state id="state_apt_sources_deb822_base" version="1">
-    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*http://[a-z.]*\.debian\.org/debian/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\b[a-z]+(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
+    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*https?://[a-z.]*\.debian\.org/debian/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\b[a-z]+(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
   </ind:textfilecontent54_state>
   <ind:textfilecontent54_state id="state_apt_sources_deb822_security" version="1">
-    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*http://[a-z.]*\.debian\.org/debian-security/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\b[a-z]+-security(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
+    <ind:text operation="pattern match">^(?=[\s\S]*\nURIs:\s*https?://[a-z.]*\.debian\.org/debian-security/?(?=\s|$))(?=[\s\S]*\nSuites:[^\n]*\b[a-z]+-security(?=\s|$))(?=[\s\S]*\nComponents:[^\n]*\bmain(?=\s|$))Types:\s*deb(?=\s|$)</ind:text>
   </ind:textfilecontent54_state>
 </def-group>
diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_combined.pass.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_combined.pass.sh
index 85cd190875ed..0cb8b2446c53 100644
--- a/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_combined.pass.sh
+++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_combined.pass.sh
@@ -1,7 +1,8 @@
 #!/bin/bash
-# platform = multi_platform_debian
+# platform = Debian 12
 # remediation = none
 
+mkdir -p /etc/apt/sources.list.d
 rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*
 
 cat > /etc/apt/sources.list.d/debian.sources << 'EOF'
diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_https.pass.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_https.pass.sh
new file mode 100644
index 000000000000..8b5e6bec5f75
--- /dev/null
+++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_https.pass.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+# platform = Debian 12
+# remediation = none
+
+mkdir -p /etc/apt/sources.list.d
+rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*
+
+cat > /etc/apt/sources.list.d/debian.sources << 'EOF'
+Types: deb
+URIs: https://deb.debian.org/debian
+Suites: bookworm bookworm-updates
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb
+URIs: https://deb.debian.org/debian-security
+Suites: bookworm-security
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+EOF
diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_separate_files.pass.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_separate_files.pass.sh
index 0d612cb51b2a..10930deb51ca 100644
--- a/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_separate_files.pass.sh
+++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_deb822_separate_files.pass.sh
@@ -1,7 +1,8 @@
 #!/bin/bash
-# platform = multi_platform_debian
+# platform = Debian 12
 # remediation = none
 
+mkdir -p /etc/apt/sources.list.d
 rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*
 
 cat > /etc/apt/sources.list.d/debian.sources << 'EOF'
diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_legacy_sources_list_d.pass.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_legacy_sources_list_d.pass.sh
index 0a49c019c6e6..b66b8a3b7fa2 100644
--- a/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_legacy_sources_list_d.pass.sh
+++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/correct_legacy_sources_list_d.pass.sh
@@ -1,7 +1,8 @@
 #!/bin/bash
-# platform = multi_platform_debian
+# platform = Debian 12
 # remediation = none
 
+mkdir -p /etc/apt/sources.list.d
 rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*
 
 cat > /etc/apt/sources.list.d/debian.list << 'EOF'
diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_deb822_thirdparty_only.fail.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_deb822_thirdparty_only.fail.sh
index 9912546cb219..cbf1c28a28db 100644
--- a/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_deb822_thirdparty_only.fail.sh
+++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_deb822_thirdparty_only.fail.sh
@@ -2,6 +2,7 @@
 # platform = multi_platform_debian
 # remediation = none
 
+mkdir -p /etc/apt/sources.list.d
 rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*
 
 cat > /etc/apt/sources.list.d/example.sources << 'EOF'
diff --git a/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_missing.fail.sh b/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_missing.fail.sh
index 0e39ce01748f..a882dd4a2db2 100644
--- a/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_missing.fail.sh
+++ b/linux_os/guide/services/apt/apt_sources_list_official/tests/wrong_missing.fail.sh
@@ -2,5 +2,6 @@
 # platform = multi_platform_debian
 # remediation = none
 
+mkdir -p /etc/apt/sources.list.d
 rm -f /etc/apt/sources.list /etc/apt/sources.list.d/*
 touch /etc/apt/sources.list