apt/apt-pkg/acquire-item.cc, branch 3.1.2

Replace "GPG error" with "OpenPGP signature verification failed"

2025-03-04T10:07:51Z

Reported-by: cacin on irc

string{=> _view} flNotDir(string{=> _view}). Configuration::{Cnd,}Set(Value: string{=> _view})

2025-02-14T18:45:12Z

string{=> _view} flExtension(string{=> _view})

2025-02-14T18:45:12Z

Drop usage of macro APT_OVERRIDE for simple override

2025-01-05T22:16:08Z

We were rather inconsistent in using it and as our public headers contain deduction guides (a c++17 feature) it seems silly to try to hide a c++11 feature in a macro, so lets stop this charade and drop the macro and while we are changing all these lines lets apply [[nodiscard]] (another c++17 feature) and other suggestions from clang-tidy and formatting for a little more consistency.

methods: Add new sqv method

2024-12-22T22:51:22Z

The new sqv method uses sequoia's sqv tool to verify files. The tool's interface is quite simple: It returns 0 on success, and prints one line per good signer with the fingerprint. sqv has a configurable crypto policy. We have defined apt-specific override mechanisms for sequoia's standard policy, allowing both users, distributions, and apt package to provide overrides for Sequoia's default policy in meaningful ways. The sqv method will be built and be the standard method for verifying OpenPGP signatures provided that `sqv` is in the PATH during building. It is not built if there was no sqv at build time, so you need a rebuild to enable sqv later on. On the flip side, the gpgv method is always built, but it does need to be always built: If APT::Key::GPGVCommand is set, we need to fallback to it - this is important to support existing users of that interface such as mmdebstrap. Also we want to fall back to it when /usr/bin/sqv disappears - for example in our CI :D A couple of concessions have been made for test suite purposes: - Failure to split a clearsigned file only shows the summary, as the gpgv method also only showed it, and no details why it failed. - We write "Got GOODSIG " in debug mode to mimic the gpgv code to keep the test suite happy. - In various places in the test suite we assert minimal output from sqv, but sqv's human output is not intended to be stable. This will incur additional work when it breaks. However we do not _parse_ the output, so actual operation of apt is unaffected. A couple of things are suboptimal here: - We are still doing clearsigned splitting ourselves. sqv only has support for detached signatures right now, whereas sqopv has support for clearsigned files as well (but sqopv does not provide any reasons for why signature verification fails or means to set a policy). - Deprecation of algorithms happens on a timebomb basis in sequoia. We have no means to give users warnings ahead of time if their configuration is outdated. We have implemented various bits that probably should be going away: - Fallback to trusted.gpg This is just annoying... - Support for fingerprints in Signed-By (no subkey matching though) The extra work here is arguably less compared to gpgv. - Check the keyring for correctness. With Signed-By everywhere, we should just error out rather than skip broken keyrings. Moo

Merge branch 'fix/partialfilemirror' into 'main'

2024-11-22T16:12:34Z

Support uncompressed indexes from partial file:/ mirrors See merge request apt-team/apt!235

Look at non by-hash paths in copy and file methods

2024-11-22T12:40:10Z

Ideally copy and file mirrors would support by-hash as well, but its harder to setup and maintain especially if you want to cache an online mirror who has by-hash enabled. We can avoid unneeded roundtrips (in the best case) and entire cache misses (in the usual worst case) by "just" telling methods that the URI we passed it has the requested file perhaps also in other paths. This is done in pseudo-relative paths as we would otherwise need to teach redirection code to rewrite those URIs as well. A method like http can easily ignore this value and await explicit instructions to look at that file, but inspecting the path in local sources via file or copy is (comparatively) free, so we just do it immediately. If that ends up being the wrong version of the file as by-hash would have protected us from we are in this feature branch now falling back to other mirrors which are like the ones online and in support of by-hash.

Allow HashSum mismatches to fallback to other mirrors

2024-11-22T12:40:10Z

Perhaps a common error in the past nowadays thanks to by-hash we rarely get mismatches due to our calling behaviour and more because the mirror is genuinely bad especially if this mirror didn't work with by-hash. Using our "normal" error handling allows falling back to other mirrors which hopefully do support by-hash and/or are not broken on a filesystem level making us more resistent to the occasional bad apple in a wild mirror forest.

Never consider file/copy/cdrom sources bad sites due to errors

2024-11-22T12:40:10Z

As the hostname for them is likely empty (for absolute or . or .. for relative paths) considering one a bad site causes all of the sites from this scheme to be considered bad. In a perfect world, we would figure out a good site-path to use for these sources, but as they are local sources which means we don't have to perform costly requests to the internet we just let them happen instead for now.

Do not change UsedMirror on local copy of InRelease

2024-11-22T12:40:10Z

While we pick most files from the file:/ mirror directly, we explicitly bring in the InRelease file with a copy one if-clause later, which causes this code to be run again and ends up considering the copy:/ the mirror the file was picked up from, which works, but isn't what we had signed up for.