Add test scenarios for the Ubuntu 26.04 CIS rules

47 scenarios covering the 13 new rules. The APT scenarios exercise quoted
and unquoted values, case variants, commented settings, deb-src entries, options
blocks such as [signed-by=...], and deb822 URIs lines carrying more than one URI.

service_update-notifier-motd_disabled ships only a pass scenario. The unit is a
static oneshot, so it is never enabled and never lingers active, and the check
reports the same result whether or not it has been masked. Recorded in the rule's
warnings block.

Author: realstuffie

linux_os/guide/services/apt/apt_configure_allow_downgrade_to_insecure_repositories/tests/commented.pass.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowDowngradeToInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+echo '# Acquire::AllowDowngradeToInsecureRepositories "1";' >> /etc/apt/apt.conf

linux_os/guide/services/apt/apt_configure_allow_downgrade_to_insecure_repositories/tests/correct_value.pass.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowDowngradeToInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+echo 'Acquire::AllowDowngradeToInsecureRepositories "0";' >> /etc/apt/apt.conf.d/99-cis-repository-security

linux_os/guide/services/apt/apt_configure_allow_downgrade_to_insecure_repositories/tests/missing.pass.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowDowngradeToInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+# The APT default is compliant, so no setting at all must pass.
+exit 0

linux_os/guide/services/apt/apt_configure_allow_downgrade_to_insecure_repositories/tests/wrong_value.fail.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowDowngradeToInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+echo 'Acquire::AllowDowngradeToInsecureRepositories "1";' >> /etc/apt/apt.conf

linux_os/guide/services/apt/apt_configure_allow_downgrade_to_insecure_repositories/tests/wrong_value_unquoted_dir.fail.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowDowngradeToInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+# APT option names are case insensitive and values may be unquoted.
+echo 'acquire::allowdowngradetoinsecurerepositories 1;' >> /etc/apt/apt.conf.d/70-cac-test

linux_os/guide/services/apt/apt_configure_allow_insecure_repositories/tests/commented.pass.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+echo '# Acquire::AllowInsecureRepositories "1";' >> /etc/apt/apt.conf

linux_os/guide/services/apt/apt_configure_allow_insecure_repositories/tests/correct_value.pass.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+echo 'Acquire::AllowInsecureRepositories "0";' >> /etc/apt/apt.conf.d/99-cis-repository-security

linux_os/guide/services/apt/apt_configure_allow_insecure_repositories/tests/missing.pass.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+# The APT default is compliant, so no setting at all must pass.
+exit 0

linux_os/guide/services/apt/apt_configure_allow_insecure_repositories/tests/wrong_value.fail.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+echo 'Acquire::AllowInsecureRepositories "1";' >> /etc/apt/apt.conf

linux_os/guide/services/apt/apt_configure_allow_insecure_repositories/tests/wrong_value_unquoted_dir.fail.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /etc/apt/apt.conf.d
+touch /etc/apt/apt.conf
+find /etc/apt/apt.conf /etc/apt/apt.conf.d -maxdepth 1 -type f -exec sed -ri '/^[[:space:]]*Acquire::AllowInsecureRepositories[[:space:]]+/Id' {} + 2>/dev/null || true
+
+# APT option names are case insensitive and values may be unquoted.
+echo 'acquire::allowinsecurerepositories 1;' >> /etc/apt/apt.conf.d/70-cac-test