apt/apt-pkg, branch 1.8.0_beta1

Merge branch 'pu/gpgvsignedby' into 'master'

2019-01-22T15:02:36Z

Report keys used to sign file from gpgv method to acquire system See merge request apt-team/apt!44

SECURITY UPDATE: content injection in http method (CVE-2019-3462)

2019-01-22T11:50:59Z

This fixes a security issue that can be exploited to inject arbritrary debs or other files into a signed repository as followed: (1) Server sends a redirect to somewhere%0a (where %0a is \n encoded) (2) apt method decodes the redirect (because the method encodes the URLs before sending them out), writting something like somewhere\n into its output (3) apt then uses the headers injected for validation purposes. Regression-Of: c34ea12ad509cb34c954ed574a301c3cbede55ec LP: #1812353

Communicate back which key(s) were used for signing

2019-01-22T11:24:22Z

Telling the acquire system which keys caused the gpgv method to succeed allows us for now just a casual check if the gpgv method really executed catching bugs like CVE-2018-0501, but we will make use of the information for better features in the following commits.

Remove `register` keyword

2019-01-22T11:08:14Z

In C++17 `register` keyword was removed. Current gcc 8.1.0 produces following warning if `-std=c++17` flag is used: warning: ISO C++17 does not allow 'register' storage class specifier [-Wregister] GCC almost completely ignores `register` keyword, with rare exception of `-O0` when additional copy from/to stack may be generated. For simplicity of the codebase it is better to just remove this problematic keyword where it is not strictly required. See: http://en.cppreference.com/w/cpp/language/storage_duration Signed-off-by: Khem Raj

hash32: Tighten to multiversion to x86-64 ELF and use uint32_t

2019-01-05T17:40:18Z

debListParser: Avoid native arch lookup in ParseDepends

2018-12-26T20:24:20Z

We called low-level ParseDepends without an architecture each time, which means each call looked up the native architecture. Store the native architecture in the class and use that when calling low-level ParseDepends from the high-level ParseDepends(). This improves performance for a cache build from 2.7 to 2.5 seconds for me. Also avoid a call when stripping multiarch, as the native architecture is passed in.

configuration: Compare size first during lookup

2018-12-26T20:24:20Z

cache hash: Use sse4.2 CRC32c on x86-64 where available

2018-12-26T20:22:37Z

This is more than twice as fast as adler32, but could be made another 50% faster by calculating crcs for 8 byte blocks in "parallel" (without data dependency) and then combining them. But that's complicated code. Reference measurements for hashing the cache 100 times: adler32=2.46s xxhash64=0.64 xxhash32=1.12 crc32c(this)=1.10 crc32c(opt)=0.44s

Merge branch 'pu/dpkg-path' into 'master'

2018-12-10T17:35:33Z

Set PATH=/usr/sbin:/usr/bin:/sbin:/bin when running dpkg See merge request apt-team/apt!38

Set PATH=/usr/sbin:/usr/bin:/sbin:/bin when running dpkg

2018-12-10T16:31:24Z

This avoids a lot of problems from local installations of scripting languages and other stuff in /usr/local for which maintainer scripts are not prepared. [v3: Inherit PATH during tests, check overrides work] [v2: Add testing]