apt, branch 2.9.19

Release 2.9.19

2024-12-23T11:23:44Z

Merge branch 'symbols'

2024-12-23T11:14:49Z

Symbols: Merge stable, noble, testing, unstable

2024-12-23T11:13:26Z

Hand edit 2.7.14build2 to 2.7.14 The funny 999:0misbuilt version number gets auto-reduced to the current version when building which is sad, but it works.

Merge branch 'sqv' into 'main'

2024-12-23T11:13:08Z

methods: Add new sqv method See merge request apt-team/apt!409

abicheck: Add symbol-merge.py helper

2024-12-23T10:56:33Z

This allows merging symbol diffs from the various build logs

debian: Plug sqv into the package build

2024-12-22T22:52:05Z

Our goal is for each platform to have one blessed OpenPGP verification system: Platforms that support sqv get sqv, platforms that don't get gpgv. To do so we hardcode the architecture list at build time. At build time we check if /usr/bin/sqv exists, which is the condition that apt uses to see if it should build with sqv support. We use a slight hack here to build with sqv on the official Debian buildds but use gpgv on Ubuntu by abusing the fact that Ubuntu resolves alternative build dependencies, and gpgv is installed in the buildd image.

debian: Add default policy to allow SHA-1 self-signatures until 2026

2024-12-22T22:52:05Z

Many repositories still have SHA-1 self-signatures, and they are not security relevant for APT repositories in the first place since we do not use a web of trust model, but rather a set of trusted keyrings, and the subkey can essentially be always considered trusted even if it cannot be verified.

methods: Add new sqv method

2024-12-22T22:51:22Z

The new sqv method uses sequoia's sqv tool to verify files. The tool's interface is quite simple: It returns 0 on success, and prints one line per good signer with the fingerprint. sqv has a configurable crypto policy. We have defined apt-specific override mechanisms for sequoia's standard policy, allowing both users, distributions, and apt package to provide overrides for Sequoia's default policy in meaningful ways. The sqv method will be built and be the standard method for verifying OpenPGP signatures provided that `sqv` is in the PATH during building. It is not built if there was no sqv at build time, so you need a rebuild to enable sqv later on. On the flip side, the gpgv method is always built, but it does need to be always built: If APT::Key::GPGVCommand is set, we need to fallback to it - this is important to support existing users of that interface such as mmdebstrap. Also we want to fall back to it when /usr/bin/sqv disappears - for example in our CI :D A couple of concessions have been made for test suite purposes: - Failure to split a clearsigned file only shows the summary, as the gpgv method also only showed it, and no details why it failed. - We write "Got GOODSIG " in debug mode to mimic the gpgv code to keep the test suite happy. - In various places in the test suite we assert minimal output from sqv, but sqv's human output is not intended to be stable. This will incur additional work when it breaks. However we do not _parse_ the output, so actual operation of apt is unaffected. A couple of things are suboptimal here: - We are still doing clearsigned splitting ourselves. sqv only has support for detached signatures right now, whereas sqopv has support for clearsigned files as well (but sqopv does not provide any reasons for why signature verification fails or means to set a policy). - Deprecation of algorithms happens on a timebomb basis in sequoia. We have no means to give users warnings ahead of time if their configuration is outdated. We have implemented various bits that probably should be going away: - Fallback to trusted.gpg This is just annoying... - Support for fingerprints in Signed-By (no subkey matching though) The extra work here is arguably less compared to gpgv. - Check the keyring for correctness. With Signed-By everywhere, we should just error out rather than skip broken keyrings. Moo

Merge branch 'refactor-hashes' into 'main'

2024-12-22T22:47:05Z

Switch to OpenSSL in a convoluted path of commits See merge request apt-team/apt!412

Remove GnuTLS and gcrypt support

2024-12-22T22:45:15Z

OpenSSL is mandatory now, it is no longer possible to build without https support either.