apt/apt-pkg, branch 1.8.0_alpha3.1

SECURITY UPDATE: content injection in http method (CVE-2019-3462)

2019-01-22T18:50:36Z

This fixes a security issue that can be exploited to inject arbritrary debs or other files into a signed repository as followed: (1) Server sends a redirect to somewhere%0a (where %0a is \n encoded) (2) apt method decodes the redirect (because the method encodes the URLs before sending them out), writting something like somewhere\n into its output (3) apt then uses the headers injected for validation purposes. Regression-Of: c34ea12ad509cb34c954ed574a301c3cbede55ec LP: #1812353 (cherry picked from commit 5eb01ec13f3ede4bae5e60eb16bd8cffb7c03e1b)

Merge branch 'pu/dpkg-path' into 'master'

2018-12-10T17:35:33Z

Set PATH=/usr/sbin:/usr/bin:/sbin:/bin when running dpkg See merge request apt-team/apt!38

Set PATH=/usr/sbin:/usr/bin:/sbin:/bin when running dpkg

2018-12-10T16:31:24Z

This avoids a lot of problems from local installations of scripting languages and other stuff in /usr/local for which maintainer scripts are not prepared. [v3: Inherit PATH during tests, check overrides work] [v2: Add testing]

Add support for /etc/apt/auth.conf.d/*.conf (netrcparts)

2018-12-04T16:48:41Z

This allows us to install matching auth files for sources.list.d files, for example; very useful. This converts aptmethod's authfd from one FileFd to a vector of pointers to FileFd, as FileFd cannot be copied, and move operators are hard.

Override FileFd copy constructor to prevent copying

2018-12-04T15:34:26Z

FileFd could be copied using the default copy constructor, which does not work, and then causes code to crash.

Merge branch 'bugfix/spaceinconfig' into 'master'

2018-12-04T11:53:05Z

Use quoted tagnames in config dumps See merge request apt-team/apt!32

Merge branch 'remove_old_derivatives' into 'master'

2018-12-04T11:52:28Z

Remove old derivatives See merge request apt-team/apt!31

Use quoted tagnames in config dumps

2018-11-29T21:15:28Z

Tagnames in configuration can include spaces (and other nasties) e.g. in repository-specific configuration options due to Origin/Label potentially containing a space. The configuration file format supports parsing quoted as well as encoded spaces, but the output generated by apt-config and other places which might be feedback into apt via parsing (e.g. before calling apt-key in our gpgv method) do not quote and hence produce invalid configuration files. Changing the default to be an encoded tagname ensures that the output of dump can be used as a config file, but other users might not expect this so that is technically a backward-breaking change.

Fix typo reported by codespell in code comments

2018-11-25T16:38:31Z

No user visible change expect for some years old changelog entries, so we don't really need to add a new one for this… Reported-By: codespell Gbp-Dch: Ignore

Fix typos encountered while updating de translation

2018-10-30T21:43:35Z