apt/apt-pkg/deb/debmetaindex.cc, branch 2.7.2 Debians commandline package manager https://git.kalnischkies.de/apt/atom?h=2.7.2 2023-07-12T14:49:19Z Fix snapshot crashes 2023-07-12T14:49:19Z Julian Andres Klode julian.klode@canonical.com 2023-06-27T15:11:06Z urn:sha1:5dcb36e7af4bd65211ac4937e5e7feac8c85683c We did not handle multiple components properly, add a contrib component to the test case. update: Add notice about missing Signed-By in deb822 sources 2023-06-27T17:21:47Z Julian Andres Klode julian.klode@canonical.com 2023-06-27T17:14:43Z urn:sha1:aba813975abb880f8b27d659147f7760c02f99e7 We want to gently steer users towards having Signed-By for each source such that we can retire a shared keyring across sources which improves resilience against configuration issues and incompetent malicious actors. Rework the domain iteration in the host fallback 2023-05-24T09:25:33Z Julian Andres Klode julian.klode@canonical.com 2023-05-24T09:22:34Z urn:sha1:4000ee2f9064623e096d975489aec35c99982437 Separate the determination of the next level domain into its own function and split out the "we found a result" into its own break for improved readability. Ensure that Snapshots: no doesn't get overriden by host-name config 2023-05-24T09:22:44Z Julian Andres Klode julian.klode@canonical.com 2023-05-24T09:07:26Z urn:sha1:4e35e5079f589700b4b5f1fc00787144bc1c58bf Seed snapshot servers for well-known hosts 2023-05-24T09:22:44Z Julian Andres Klode julian.klode@canonical.com 2023-05-17T15:18:33Z urn:sha1:48cbc5413fb2a0e490c2282b9df65da96ad7a9f2 This will attempt to fallback to a per-server setting if we could not determine a value from the release file. Initial support for snapshot servers, apt --snapshot option 2023-05-02T13:23:14Z Julian Andres Klode julian.klode@canonical.com 2023-02-22T13:14:52Z urn:sha1:a19f606aad717fe5c9c69237c3af53feb547115e Provide snapshot support for offical Debian and Ubuntu archives. There are two ways to enable snapshots for sources: 1. Add Snapshot: yes to your sources file ([snapshot=yes]). This will allow you to specify a snapshot to use when updating or installing using the --snapshot,-S option. 2. Add Snapshot: ID to your sources files to request a specific snapshot for this source. Snapshots are discovered using Label and Origin fields in the Release file of the main source, hence you need to have updated the source at least once before you can use snapshots. The Release file may also declare a snapshots server to use, similar to Changelogs, it can contain a Snapshots field with the values: 1. `Snapshots: https://example.com/@SNAPSHOTID@` where `@SNAPSHOTID@` is a placeholder that is replaced with the requested snapshot id 2. `Snapshots: no` to disable snapshot support for this source. Requesting snapshots for this source will result in a failure to load the source. The implementation adds a SHADOWED option to deb source entries, and marks the main entry as SHADOWED when a snapshot has been requested, which will cause it to be updated, but not included in the generated cache. The concern here was that we need to keep generating the shadowed entries because the cleanup in `apt update` deletes any files not queued for download, so we gotta keep downloading the main source. This design is not entirely optimal, but avoids the pitfalls of having to reimplement list cleanup. Gaps: - Ubuntu Pro repositories and PPAs are not yet supported. Parse Checksum fields via pkgTagSection::Key, too 2022-04-01T12:16:19Z David Kalnischkies david@kalnischkies.de 2022-04-01T09:37:26Z urn:sha1:05fae6fae95d8ef6690f3d56863e3bb6a44d424c We abstract hashes a fair bit to be able to add new ones eventually, which lead us to building the field names on the fly. We can do better through by keeping a central place for these names, too, which even helps in reducing code as we don't need the MD5 → Files dance anymore. Don't print every inline PGP key in Signed-By 2021-11-05T14:36:08Z Victor Westerhuis victor@westerhu.is 2021-11-05T14:36:08Z urn:sha1:8b15e3b90aa3686cecfece1361f8c7857b128e13 It looks like a debug line was left in accidentally. Only allow full Signed-By keys where filenames are allowed 2021-10-18T14:12:54Z Julian Andres Klode julian.klode@canonical.com 2021-10-18T13:48:05Z urn:sha1:dcbae505308758df2870c0424e3f5a1dfebcb5ec Rename the argument to Introducer and generalize it to anything that introduces new keys into the trusted vector, like file names and full keys. Add support for embedding PGP keys into Signed-By in deb822 sources 2021-10-18T14:12:54Z Julian Andres Klode julian.klode@canonical.com 2021-06-09T11:22:38Z urn:sha1:3f07f5345ec79702c3c769047452041b2c12953f Extend the Signed-By field to handle embedded public key blocks, this allows shipping self-contained .sources files, making it substantially easier to provide third party repositories.