Debians commandline package manager https://git.kalnischkies.de/apt/atom?h=1.6_alpha6 2018-01-03T22:35:18Z 2018-01-03T22:35:18Z Julian Andres Klode jak@debian.org 2018-01-03T22:35:18Z urn:sha1:a283107760379b869b9b730e03b9d2d4aac4e736 2018-01-03T21:05:16Z Julian Klode jak@debian.org 2018-01-03T21:05:16Z urn:sha1:6ee1b762322e725d50ea53e2cf16f8450e23c578 reimplement mirror method See merge request apt-team/apt!1 2018-01-03T18:42:45Z David Kalnischkies david@kalnischkies.de 2017-12-09T11:32:32Z urn:sha1:e4ed47f10844cf7ad933f7a9b64583869592f139 The mirror method is undocumented since 0.7.24, now with the reimplementation it is high time to get something written about it. 2018-01-03T18:42:45Z David Kalnischkies david@kalnischkies.de 2017-11-18T13:21:14Z urn:sha1:8aadb98849ba2555f4596042c888da451d965dfd Gbp-Dch: Ignore 2018-01-03T18:42:45Z David Kalnischkies david@kalnischkies.de 2017-11-18T11:38:21Z urn:sha1:4df5483994d510290677abab5720445f71babe65 A mirror list we get from an non-local source like http shouldn't be able to include e.g. file sources and even with other online sources we need to be careful: They also shouldn't include prefixed methods like 'tor+http'. So apply magic based on how the method is called: mirror+file will be allowed to redirect to any source while tor+mirror+file allows all, but sends them to their tor+ variant. 2018-01-03T18:42:45Z David Kalnischkies david@kalnischkies.de 2017-10-27T16:27:54Z urn:sha1:a839efb126af066dc2e58400fb5e25911cb2a9f1 The old implementation used to construct a query string including the release(s) the mirrorlist should be for, but that is hard to deal with as this rules out that partial mirrors are included in the list and it turns out that nobody ended up implementing it on the server side. Controlling this on the client side allows partial mirrors to be included and as a bonus prevents that we tell the mirrorlist server (this rather generic) user information. 2018-01-03T18:42:45Z David Kalnischkies david@kalnischkies.de 2017-10-27T22:01:27Z urn:sha1:04ab37fecaf286f724bef2e0969d2b67ab5ac1b1 Allowing a method to request work from other methods is a powerful capability which could be misused or exploited, so to slightly limited the surface let method opt-in into this capability on startup. 2018-01-03T17:55:41Z David Kalnischkies david@kalnischkies.de 2017-10-27T16:39:36Z urn:sha1:57fa854e4cdb060e87ca265abd5a83364f9fa681 Embedding an entire acquire stack and HTTP logic in the mirror method made it rather heavy weight and fragile. This reimplement goes the other way by doing only the bare minimum in the method itself and instead redirect the actual download of files to their proper methods. The reimplementation drops the (in the real world) unused query-string feature as it isn't really implementable in the new architecture. 2018-01-03T17:55:41Z David Kalnischkies david@kalnischkies.de 2017-08-12T14:21:13Z urn:sha1:ef9677831f62a1554a888ebc7b162517d7881116 If a method needs a file to operate like e.g. mirror needs to get a list of mirrors before it can redirect the the actual requests to them. That could easily be solved by moving the logic into libapt directly, but by allowing a method to request other methods to do something we can keep this logic contained in the method and allow e.g. also methods which perform binary patching or similar things. Previously they would need to implement their own acquire system inside the existing one which in all likelyhood will not support the same features and methods nor operate with similar security compared to what we have already running 'above' the requesting method. That said, to avoid methods producing conflicts with "proper" files we are downloading a new directory is introduced to keep the auxiliary files in. [The message magic number 351 is a tribute to the german Grundgesetz article 35 paragraph 1 which defines that all authorities of the state(s) help each other on request.] 2018-01-03T17:55:41Z David Kalnischkies david@kalnischkies.de 2017-08-09T21:26:19Z urn:sha1:02567e3084d2faec92e8bf248e89fda6452e634b The format isn't too hard to get right, but it gets funny with multiline fields (which we don't really have yet) and its just easier to deal with it once and for all which can be reused for more messages later.