apt, branch 1.8.0_beta1

Release 1.8.0~beta1

2019-01-23T15:50:11Z

Merge tag '1.8.0_alpha3.1'

2019-01-22T18:54:55Z

apt Debian release 1.8.0~alpha3.1

Release 1.8.0~alpha3.1

2019-01-22T18:52:42Z

SECURITY UPDATE: content injection in http method (CVE-2019-3462)

2019-01-22T18:50:36Z

This fixes a security issue that can be exploited to inject arbritrary debs or other files into a signed repository as followed: (1) Server sends a redirect to somewhere%0a (where %0a is \n encoded) (2) apt method decodes the redirect (because the method encodes the URLs before sending them out), writting something like somewhere\n into its output (3) apt then uses the headers injected for validation purposes. Regression-Of: c34ea12ad509cb34c954ed574a301c3cbede55ec LP: #1812353 (cherry picked from commit 5eb01ec13f3ede4bae5e60eb16bd8cffb7c03e1b)

Merge branch 'pu/release-preparations'

2019-01-22T17:39:56Z

debian/control: Drop libcurl4-gnutls-dev build dependency

2019-01-22T17:37:49Z

Not needed since quite some time.

Merge branch 'pu/gpgvsignedby' into 'master'

2019-01-22T15:02:36Z

Report keys used to sign file from gpgv method to acquire system See merge request apt-team/apt!44

SECURITY UPDATE: content injection in http method (CVE-2019-3462)

2019-01-22T11:50:59Z

doc/apt-verbatim.ent: Debian buster is stable

2019-01-22T11:43:15Z

Move everything up one "old", and change testing to be bullseye.

CI: Use debian:buster as test base image

2019-01-22T11:43:15Z

This prepares us for the upcoming buster release, as buster is the main release series for this series (the other being Ubuntu disco).