apt/apt-pkg/contrib/hashes.cc, branch 3.1.7Debians commandline package managerhttps://git.kalnischkies.de/apt/atom?h=3.1.72025-02-15T08:40:15ZRun unifdef -DAPT_PKG_ABI=700 again2025-02-15T08:40:15ZJulian Andres Klodejulian.klode@canonical.com2025-02-15T08:40:15Zurn:sha1:6e877571bc2dd50e38f2f35675c401d74dbe233d
main picked up a couple new ifdefs since the branch started; so
clean them up again.
Remove GnuTLS and gcrypt support2024-12-22T22:45:15ZJulian Andres Klodejulian.klode@canonical.com2024-12-21T14:26:34Zurn:sha1:7b1fb90b93ced7c0772d726e512da01fad456852
OpenSSL is mandatory now, it is no longer possible to build
without https support either.
hashes, methods: Add OpenSSL backends2024-12-22T21:55:39ZJulian Andres Klodejulian.klode@canonical.com2024-12-18T18:37:40Zurn:sha1:90270f0959d490d56db891809d83c91b3d4b9bf0
Introduce an OpenSSL::Crypto backend for the hashes library
and an OpenSSL::SSL backend for the TLS support in our https
method.
Many thanks to curl for showing the way with how to handle
a CRL file. There are some memory leaks here with the
TlsFd itself as well as the proxy support; and we should
reorganize the code to generate the ssl object as late
as possible.
A peculiar aspect of OpenSSL is that SSL_has_pending() returns
1 even if SSL_read() will fail to read anything and return the
equivalent of EAGAIN. We work around this here by also peeking
ahead 1 byte. I was running a very high RTT connection from
Germany to Australia for testing, and with the peeking it's
using negligible amounts of CPU; before that, it was busy
looping at 100%. Bad OpenSSL!
hashes: Add GnuTLS backend, make it default2024-12-21T12:31:06ZJulian Andres Klodejulian.klode@canonical.com2024-12-18T18:11:26Zurn:sha1:470f5cf449ac20c7d7bf50ad805c72a5f52d256f
The GnuTLS backend avoids the need to link in libgcrypt, and
gets us another certified library people will be happy with.
This should be an intermediate step on the road to OpenSSL.
hashes: Refactor backend into PrivateHashes2024-12-21T12:31:06ZJulian Andres Klodejulian.klode@canonical.com2024-12-18T17:44:05Zurn:sha1:ef435a3ed9c3e835c799df651f160b658eeee56a
Everything is abstracted away now.
apt-pkg/contrib/hashes.cc, apt-pkg/contrib/hashes.h: APT::StringView -> std::string_view in private interface. Take std::string_view instead of std::string const& for HashString::HashString (not reused) [#if APT_PKG_ABI > 600]2024-11-14T17:23:34Zнабnabijaczleweli@nabijaczleweli.xyz2024-11-12T16:59:17Zurn:sha1:de6ec4aca77d0a56e30d08dbc12661bdda0c6e69Turn char[APT_BUFFER_SIZE] buffers into std::array<char, APT_BUFFER_SIZE>2024-11-11T14:52:43Zнабnabijaczleweli@nabijaczleweli.xyz2024-11-11T14:23:46Zurn:sha1:e59793e29ecb47c63b72de4f9d1e6d044a0ff6f2Modernize standard library includes2024-02-20T12:49:04ZJulian Andres Klodejulian.klode@canonical.com2024-02-20T12:43:08Zurn:sha1:40a75722c43ae24cb9a99d6730a3b25b65819c49
This was automated with sed and git-clang-format, and then I had to
fix up the top of policy.cc by hand as git-clang-format accidentally
indented it by two spaces.
Revert "Do not fail on systems running in FIPSmode."2023-10-04T12:52:29ZJulian Andres Klodejulian.klode@canonical.com2023-10-04T12:52:29Zurn:sha1:b92934a1904cd6dd1dfdab283d27cd34ca2dbe44
This reverts commit 668451def296afeb0c358a7d80ff39dc546defab.
Do not fail on systems running in FIPSmode.2023-05-29T12:28:20ZA. Maitland Bottomsbottoms@debian.org2023-05-29T12:28:20Zurn:sha1:668451def296afeb0c358a7d80ff39dc546defab
Initialize using gcrypt's GCRYCTL_NO_FIPS_MODE, available since
gcrypt version 1.10.0, otherwise apt aborts on FIPS enabled systems.