apt/apt-pkg/acquire.cc, branch 1.1_exp16Debians commandline package managerhttps://git.kalnischkies.de/apt/atom?h=1.1_exp162015-11-19T16:56:07Zignore lost+found in private directory cleanup2015-11-19T16:56:07ZDavid Kalnischkiesdavid@kalnischkies.de2015-11-19T15:19:15Zurn:sha1:6aef1942f441e6e667982b92802907026d8cc7c6
In ce1f3a2c we started warning about failing unlinking, which we
consistently do for directories. That isn't a problem as directories
usually aren't in the places we do want to clean up – with the potential
exeception of "lost+found", so lets ignore it like we ignore our own
partial/ subdirectory.
Closes: 805424
do not use _apt for file/copy sources if it isn't world-accessible2015-11-19T15:46:29ZDavid Kalnischkiesdavid@kalnischkies.de2015-11-18T18:31:40Zurn:sha1:514a25cbcd2babb2a9c4485fc7b9a4256b7f6ff3
In 0940230d we started dropping privileges for file (and a bit later for
copy, too) with the intend of uniforming this for all methods. The
commit message says that the source will likely fail based on the
compressors already – and there isn't much secret in the repository
content. After all, after apt has run the update everyone can access the
content via apt anyway…
There are sources through which worked before which are mostly
single-deb (and those with the uncompressed files available).
The first one being especially surprising for users maybe, so instead of
failing, we make it so that apt detects that it can't access a source as
_apt and if so doesn't drop (for all sources!) privileges – but we limit
this to file/copy, so the uncompress which might be needed will still
fail – but that failed before this regression.
We display a notice about this, mostly so that if it still fails (e.g.
compressed) the user has some idea what is wrong.
Closes: 805069
wrap every unlink call to check for != /dev/null2015-11-04T17:42:28ZDavid Kalnischkiesdavid@kalnischkies.de2015-11-02T17:49:52Zurn:sha1:ce1f3a2c616b86da657c1c796efa5f4d18c30c39
Unlinking /dev/null is bad, we shouldn't do that. Also, we should print
at least a warning if we tried to unlink a file but didn't manage to
pull it of (ignoring the case were the file is /dev/null or doesn't
exist in the first place).
This got triggered by a relatively unlikely to cause problem in
pkgAcquire::Worker::PrepareFiles which would while temporary
uncompressed files (which are set to keep compressed) figure out that to
files are the same and prepare for sharing by deleting them. Bad move.
That also shows why not printing a warning is a bad idea as this hide
the error for in non-root test runs.
Git-Dch: Ignore
use std-algorithms instead of manual loops to avoid overflow warning2015-09-14T13:22:18ZDavid Kalnischkiesdavid@kalnischkies.de2015-09-11T18:53:07Zurn:sha1:ae732225ec2fa0d7434c9f40a92ced8683752211
Reported-By: gcc
Understandable: no
Git-Dch: Ignore
fix 'Dead assignment' by dropping unneeded boolean2015-09-14T13:22:18ZDavid Kalnischkiesdavid@kalnischkies.de2015-09-10T20:44:01Zurn:sha1:69b7654484c3f16d61f315275abb15cc062d190e
Reported-By: scan-build
Git-Dch: Ignore
avoid using global PendingError to avoid failing too often too soon2015-09-14T13:22:18ZDavid Kalnischkiesdavid@kalnischkies.de2015-09-10T17:00:51Zurn:sha1:95278287f4e1eeaf5d96749d6fc9bfc53fb400d0
Our error reporting is historically grown into some kind of mess.
A while ago I implemented stacking for the global error which is used in
this commit now to wrap calls to functions which do not report (all)
errors via return, so that only failures in those calls cause a failure
to propergate down the chain rather than failing if anything
(potentially totally unrelated) has failed at some point in the past.
This way we can avoid stopping the entire acquire process just because a
single source produced an error for example. It also means that after
the acquire process the cache is generated – even if the acquire
process had failures – as we still have the old good data around we can and
should generate a cache for (again).
There are probably more instances of this hiding, but all these looked
like the easiest to work with and fix with reasonable (aka net-positive)
effects.
improve CheckDropPrivsMustBeDisabled further2015-09-01T00:49:53ZDavid Kalnischkiesdavid@kalnischkies.de2015-09-01T00:29:27Zurn:sha1:226c0f64d46019d675840b16bd44ff985b45ad0f
Various smaller improvements so that the check deals better with already
downloaded files, relative paths and other things.
Git-Dch: Ignore
if file is inaccessible for _apt, disable privilege drop in acquire2015-08-31T09:00:12ZDavid Kalnischkiesdavid@kalnischkies.de2015-08-31T09:00:12Zurn:sha1:7c8206bf26b8ef6020b543bbc027305dee8f2308
We had a very similar method previously for our own private usage, but
with some generalisation we can move this check into the acquire system
proper so that all frontends profit from this compatibility change.
As we are disabling a security feature here a warning is issued and
frontends are advised to consider reworking their download logic if
possible.
Note that this is implemented as an all or nothing situation: We can't
just (not) drop privileges for a subset of the files in a fetcher, so in
case you have to download some files with and some without you need to
use two fetchers.
Fix all the wrong removals of includes that iwyu got wrong2015-08-17T12:29:02ZMichael Vogtmvo@debian.org2015-08-17T12:29:02Zurn:sha1:ac7f8f7916f16905d8eeb0133bc650d89726d0f4
Git-Dch: ignore
Cleanup includes after running iwyu2015-08-17T10:01:45ZMichael Vogtmvo@debian.org2015-08-17T10:01:45Zurn:sha1:88a8975f156e452d9f3ebe76822b236e8962ebba