Debians commandline package manager https://git.kalnischkies.de/apt/atom?h=2.3.6 2021-06-09T11:42:02Z 2021-06-09T11:42:02Z Julian Andres Klode julian.klode@canonical.com 2021-06-09T11:42:02Z urn:sha1:06da685fc1abe073c379a34151500fc4d2d853fa 2021-06-09T09:35:44Z Julian Andres Klode jak@debian.org 2021-06-09T09:35:44Z urn:sha1:416d468b84eb432ef1cbe7d3e80955bbdef035c7 URI encode filename fields (again) See merge request apt-team/apt!175 2021-06-04T14:45:06Z David Kalnischkies david@kalnischkies.de 2021-06-04T14:15:45Z urn:sha1:a2406cda4dd0aca523183ed6a8b651f06e0e63f9 The code exists since ever, but no other client supports this and the specification like debian-policy isn't asking for this either. What it does do is breaking than all others continue working through: If the filename includes in fact URI encoded bits (hopefully no quotes) which is rather unlikely, but none the less possible. 2021-06-04T14:45:02Z David Kalnischkies david@kalnischkies.de 2021-06-04T12:15:46Z urn:sha1:ba18c4323ecbc66e6a1e3fedae60721f9c5701b1 If a source is not copying files to the destination the download code forces the copy – which in practice are local repositories accessed via file:/ – but in that process takes the filename the local repo used rather than the filename it e.g. advertised via --print-uris. A local repository could hence override a file in the current directory if you use 'apt download', which is a rather weak ability, but still. 2021-06-04T14:43:41Z David Kalnischkies david@kalnischkies.de 2021-06-04T11:06:34Z urn:sha1:149b23c2b9697bc262c0af1934c7a3f6114d903f Keeping URIs encoded in the acquire system depends on having them encoded in the first place. While many other places got the encoding 2 out of 3 ArchiveURI implementations were missed which are in practice responsible for nearly all of the URI building, just that index filename do not contain characters to escape and the Filename fields in Packages files usually aren't. Usually. Except if you happen to have e.g. an epoch featuring package with the colon encoded in the filename. On the upside, in most repositories the epoch isn't part of the filename. Reported-By: Johannes 'josch' Schauer on IRC References: e6c55283d235aa9404395d30f2db891f36995c49 2021-05-17T09:43:54Z Julian Andres Klode julian.klode@canonical.com 2021-05-17T09:43:54Z urn:sha1:aeae140b11220c8ca3692ef690bc51578f197992 2021-05-17T08:25:28Z Julian Andres Klode julian.klode@canonical.com 2021-05-17T08:25:28Z urn:sha1:81eb944c76d99f34b57d7c3efd283c3ffb6e4c1f If a package is not installed yet, we do need to apply phasing as we otherwise get into weird situations when installing packages: In the launchpad bug below, ubuntu-release-upgrader-core was installed, and hence the phasing for the upgrade to it was applied. However, ubuntu-release-upgrader-gtk was about to be installed - and hence the phasing did not apply, causing a version mismatch, because ubuntu-release-upgrader-gtk from -updates was used, but -core from release pocket. Sigh. An alternative approach to dealing with this issue could be to apply phasing to all packages within the same source package, which would work in most cases. However, there might be unforeseen side effects and it is of course possible to have = depends between source packages, such as -signed packages on the unsigned ones for bootloaders. This problem does not occur in the update-manager implementation of phased updates as update-manager only deals with upgrading packages, but does not install new packages and thus does not see that issue. APT however, has to apply phasing more broadly, as you can and often do install additional packages during upgrade, or upgrade packages during install commands, as both accept package list arguments and have the same code in the backend. LP: #1925745 2021-05-12T16:06:32Z Julian Andres Klode julian.klode@canonical.com 2021-05-12T16:06:32Z urn:sha1:1be9dc63719f3a73df5ee7dea3119fab13a55239 2021-05-12T11:06:11Z Julian Andres Klode julian.klode@canonical.com 2021-05-11T14:04:10Z urn:sha1:2129ffecc084ca772af75418225c5551631e6278 This makes them retriable, and brings them more into line with TCP, where handshake is also a transient error. LP: #1928100 2021-05-05T10:14:11Z Julian Andres Klode julian.klode@canonical.com 2021-05-05T10:14:11Z urn:sha1:6fe716703b2dd5c47cb6684e0b83fd1c52516d41 See https://github.com/Debian/apt/pull/129