apt/apt-pkg/acquire-item.cc, branch 1.0.9.4Debians commandline package managerhttps://git.kalnischkies.de/apt/atom?h=1.0.9.42014-10-15T13:56:53Zdon't cleanup cdrom files in apt-get update2014-10-15T13:56:53ZDavid Kalnischkiesdavid@kalnischkies.de2014-10-15T13:56:53Zurn:sha1:5afcfe2a51a9e47e95023b99bcab065d1975e950
Regression from merging 801745284905e7962aa77a9f37a6b4e7fcdc19d0 and
b0f4b486e6850c5f98520ccf19da71d0ed748ae4. While fine by itself, merged
the part fixing the filename is skipped if a cdrom source is
encountered, so that our list-cleanup removes what seems to be orphaned
files.
Closes: 765458
Merge remote-tracking branch 'donkult/feature/generalize-gzipindex' into debian/sid2014-09-26T16:09:32ZMichael Vogtmvo@ubuntu.com2014-09-26T16:09:32Zurn:sha1:48fd4181ad0261d5f3e8894dcbfccfaea1530645Fix regression for cdrom: sources from latest security update2014-09-21T19:23:04ZMichael Vogtmvo@ubuntu.com2014-09-21T19:23:04Zurn:sha1:801745284905e7962aa77a9f37a6b4e7fcdc19d0
Skip a reverify for cdrom: sources. The reverify step is actually
harmful here because the apt-cdrom add code uses the indexcopy.cc
which will "normalize" the Packages file from the cdrom when it
writes it to the local disk. This leads to changing the "MD5sum"
field (notice the lower case "s") on the cdrom Packages file to
a "MD5Sum" field on the local file in /var/lib/apt/lists. Which
of course alters the hash and makes apt fail to reverify the file.
generalize Acquire::GzipIndex2014-09-21T08:18:03ZMichael Vogtmvo@debian.org2014-09-21T08:18:03Zurn:sha1:b0f4b486e6850c5f98520ccf19da71d0ed748ae4improve test for commit daff4a2014-09-17T15:48:27ZMichael Vogtmvo@ubuntu.com2014-09-17T15:48:27Zurn:sha1:23d0a6fbee9e8880107481502e14411961c44a7bFix regression for file:/// uris from CVE-2014-04872014-09-17T12:57:05ZMichael Vogtmvo@ubuntu.com2014-09-17T12:57:05Zurn:sha1:daff4aa356128310f022370f7825bdc369c66ba8
Do not run ReverifyAfterIMS() for local file URIs as this will
causes apt to mess around in the file:/// uri space. This is
wrong in itself, but it will also cause a incorrect verification
failure when the archive and the lists directory are on different
partitions as rename().
SECURITY UPDATE for CVE-2014-{0488,0487,0489}2014-09-16T18:39:13ZMichael Vogtmvo@ubuntu.com2014-09-16T18:23:43Zurn:sha1:ca7fd76c2f30c100dcf1c12e717ce397cccd690b
incorrect invalidating of unauthenticated data (CVE-2014-0488)
incorect verification of 304 reply (CVE-2014-0487)
incorrect verification of Acquire::Gzip indexes (CVE-2014-0489)
apt-pkg/acquire-item.cc: make pkgAcqDiffIndex more uniform2014-07-17T07:59:55ZMichael Vogtmvo@debian.org2014-07-17T07:59:55Zurn:sha1:31b9d84143f7330f4ad60eaa2c8877d28e00cffaTry not to parse invalid translation files (LP: #756317)2014-07-03T16:20:44ZMichael Vogtmvo@ubuntu.com2014-07-03T16:20:44Zurn:sha1:19818b65467e954a55e2af56111233ce305d5508initialize Verify in second pkgAcqIndex constructor2014-04-28T16:19:41ZDavid Kalnischkiesdavid@kalnischkies.de2014-04-28T15:36:54Zurn:sha1:949d2e98a0fc00afc6e9cf78a724d0d578a3ca2a
gcc reports in testcase ./test-bug-596498-trusted-unsigned-repo:
apt-pkg/acquire-item.cc:1059:7: runtime error: load of value 234, which
is not a valid value for type 'bool'
This happens as the bool Verify is initialized only in one of the two
constructors of the pkgAcqIndex class. It isn't a problem through as the
verification controlled by this flag is optional and used to fail early
on garbage files (like network portal pages) instead of later on in the
hashsum verification or while parsing (the then untrusted) file.
Reported-By: gcc-4.9 -fsanitize=undefined