apt, branch 1.3_exp3Debians commandline package managerhttps://git.kalnischkies.de/apt/atom?h=1.3_exp32016-06-22T12:51:31ZRelease 1.3~exp32016-06-22T12:51:31ZJulian Andres Klodejak@debian.org2016-06-22T12:51:31Zurn:sha1:14e325c7e4b33e8fc6d33b99d1ffd3b934d26ed0
Quite a huge churn of new strings.
add insecure (and weak) allow-options for sources.list2016-06-22T12:05:01ZDavid Kalnischkiesdavid@kalnischkies.de2016-06-20T18:50:43Zurn:sha1:d03b947b0ce4f87d7d5cc48d4d274ab3bd0b289a
Weak had no dedicated option before and Insecure and Downgrade were both
global options, which given the effect they all have on security is
rather bad. Setting them for individual repositories only isn't great
but at least slightly better and also more consistent with other
settings for repositories.
ensure filesize of deb is included in the hashes list2016-06-22T12:05:01ZDavid Kalnischkiesdavid@kalnischkies.de2016-06-18T14:27:04Zurn:sha1:5da51e0e2da3f055306562d38103b06a23d81719
Filesize is a silly hash all by itself, but in combination with others
it can be a strong opponent, so ensuring that it is in the list of
hashes and hence checked by the normal course of action the acquire
process takes is a good thing.
add [weak] tag to hash errors to indicate insufficiency2016-06-22T12:05:01ZDavid Kalnischkiesdavid@kalnischkies.de2016-06-18T13:15:27Zurn:sha1:d30036922c6963846db4ab633b13fb87c1b5b462
For "Hash Sum mismatch" that info doesn't make a whole lot of
difference, but for the new insufficient info message an indicator that
while this hashes are there and even match, they aren't enough from a
security standpoint.
better error message for insufficient hashsums2016-06-22T12:05:01ZDavid Kalnischkiesdavid@kalnischkies.de2016-06-18T11:55:39Zurn:sha1:562f0774f8f04d978c7cea69a29c131a0e0ec75f
Downloading and saying "Hash Sum mismatch" isn't very friendly from a
user POV, so with this change we try to detect such cases early on and
report it, preferably before download even started.
Closes: 827758
source: if download is skipped, don't try to unpack2016-06-22T12:05:01ZDavid Kalnischkiesdavid@kalnischkies.de2016-06-18T07:59:08Zurn:sha1:60a0cb424e91acebc2bba0f9add220b474e432e6
If apt decides it can't download a file it is relatively pointless to
try to tell dpkg-source to unpack it.
forbid insecure repositories by default expect in apt-get2016-06-22T12:05:01ZDavid Kalnischkiesdavid@kalnischkies.de2016-03-18T13:46:24Zurn:sha1:952ee63b0af14a534c0aca00c11d1a99be6b22b2
With this commit all APT-based clients default to refusing to work with
unsigned or otherwise insufficently secured repositories. In terms of
apt and apt-get this changes nothing, but it effects all tools using
libapt like aptitude, synaptic or packagekit.
The exception remains apt-get for stretch for now as this might break
too many scripts/usecases too quickly.
The documentation is updated and extended to reflect how to opt out or
in on this behaviour change.
Closes: 808367
generalize secure->insecure downgrade protection2016-06-22T12:05:01ZDavid Kalnischkiesdavid@kalnischkies.de2016-03-18T11:50:02Zurn:sha1:b1bdfe682054ea6fc202416968c5342d59b403b1
Handling the extra check (and force requirement) for downgrades in
security in our AllowInsecureRepositories checker helps in having this
check everywhere instead of just in the most common place and requiring
a little extra force in such cases is always good.
handle weak-security repositories as unauthenticated2016-06-22T12:05:01ZDavid Kalnischkiesdavid@kalnischkies.de2016-03-17T15:36:14Zurn:sha1:ab94dcece2465f824bea80fc9158bf9a028b2e87
APT can be forced to deal with repositories which have no security
features whatsoever, so just giving up on repositories which "just" fail
our current criteria of good security features is the wrong incentive.
Of course, repositories are better of fixing their setup to provide the
minimum of security features, but sometimes this isn't possible:
Historic repositories for example which do not change (anymore).
That also fixes problem with repositories which are marked as trusted,
but are providing only weak security features which would fail the
parsing of the Release file.
Closes: 827364
run update post-invokes even on (partial) failures2016-06-22T12:05:01ZDavid Kalnischkiesdavid@kalnischkies.de2016-06-16T21:13:26Zurn:sha1:57f7fb6511fcc7c55ee7a88475d15385093c048e
Unsecure repositories result in error messages by default which causes
the acquire run to fail hard, but non-failing repositories are still
updated just like in the slightly less hard-failures which got this
behaviour in 35664152e47a1d4d712fd52e0f0a2dc8ed359d32.