apt, branch 2.1.2

Release 2.1.2, take 2

2020-05-13T20:05:05Z

Fix location of testdeb in added regression tests

2020-05-13T20:04:13Z

Release 2.1.2

2020-05-12T20:50:39Z

SECURITY UPDATE: Fix out of bounds read in .ar and .tar implementation (CVE-2020-3810)

2020-05-12T16:55:55Z

When normalizing ar member names by removing trailing whitespace and slashes, an out-out-bound read can be caused if the ar member name consists only of such characters, because the code did not stop at 0, but would wrap around and continue reading from the stack, without any limit. Add a check to abort if we reached the first character in the name, effectively rejecting the use of names consisting just of slashes and spaces. Furthermore, certain error cases in arfile.cc and extracttar.cc have included member names in the output that were not checked at all and might hence not be nul terminated, leading to further out of bound reads. Fixes Debian/apt#111 LP: #1878177

Dutch program translation update

2020-05-10T16:37:35Z

Closes: #960186

Release 2.1.1

2020-05-08T16:03:47Z

Use "po4a --porefs file" instead of undocumented compat noline

2020-05-08T14:38:20Z

References: https://github.com/mquinson/po4a/commit/329f472a378d42c7a33e8110e5091be61480a0fc

Drop nowrap from po4a --porefs as it is no longer supported

2020-05-08T14:34:36Z

Upstream says it had no effect before, so it seems safe to adapt. References: https://github.com/mquinson/po4a/commit/ac1e97305b6073ed87fa8cf0a2e32f9b1255d0f1

Fix typo in Polish translation of --help messages

2020-05-08T14:19:55Z

Also translating two related strings along the way. References: https://github.com/Debian/apt/pull/107

Allow aptitude to MarkInstall broken packages via FromUser

2020-05-08T13:52:14Z

apt marks packages coming from the commandline among others as protected to ensure the various resolver parts do not fiddle with the state of these packages. aptitude (and potentially others) do not so the state is modified (to a Keep which for uninstalled means it is not going to be installed) due to being uninstallable before the call fails – basically reverting at least some state changes the call made before it realized it has to fail, which is usually a good idea, except if users expect you to not do it. They do set the FromUser option though which has beside controlling autobit also gained the notion of "the user is always right" over time and can be used for this one here as well preventing the state revert. References: 0de399391372450d0162b5a09bfca554b2d27c3d Reported-By: Jessica Clarke on IRC