apt/apt-pkg, branch 2.9.26

apt: Introduce the modernize-sources command

2025-01-28T18:47:00Z

This handles rewriting .list entries to .sources ones; the only options handled are - signed-by => Signed-By - trusted => Trusted The options to specify architectures, check-valid-until, etc. are not supported as they are not exposed in the code. We probably should refactor the parser at some point so we can actually read the parsed entry rather than the abstract objects we create from it. This can be improved further: - Keyrings from /etc/apt/trusted.gpg.d should be moved to /etc/apt/keyrings. - automatic detection by trying to verify using each keyring in trusted.gpg.d until we find the right one and then using that for Signed-By rather than leave some sources empty.

metaindex: Support loading without filename

2025-01-28T18:47:00Z

sqv, gpgv: Do not fail if Dir::Etc::Trusted is set and trusted.gpg.d is missing

2025-01-22T08:55:11Z

This should remain a warning case for now. So push the errors to a stack and see if we can find any file. Explictly warn again if Dir::Etc::trusted is set, as it is like _super_ deprecated. Reported-By: Cyril Brulebois in Bug#1032131

Unset Dir::Etc::trusted

2025-01-21T11:16:34Z

The trusted.gpg file has been deprecated since February 2022 and can no longer be managed easily without apt-key, so we should not be falling back to it by default. We do not remove the actual code to fall back to it, such that code that passes Dir::Etc::trusted explicitly continues to work for the time being (with the warnings in update), as the overhead is now rather trivial.

Remove superseded warning about trusted.gpg fallback

2025-01-21T11:16:34Z

This warning has been superseded by the missing sources.list notice (which will also become a warning shortly) Adjust the sqv exit to avoid introducing a new spurious "No good signature" that we did not reach before. moo

Write Pre-Depends with a dash again in EDSP

2025-01-17T00:27:48Z

For some reason ~ that I don't know and can't come up with on the spot ~ we output the Pre-Depends field as PreDepends in the translated user-visible output and I accidentally copied that over to the untranslated variant that replaced the embedded copy (with a dash) in the EDSP generator. Code-copies and implementation details littered all over the place are apparently sometimes a good bug-free thing, too… Regression-of: 6828ae2c2f9268c8187f0fa91b3c464ed84a8476 Closes: #1093254

proxy: Avoids triggering bounds check in std::string_view

2025-01-14T10:24:19Z

Check for empty string_view instead of first byte being '\0'; this otherwise breaks when compiling with higher ABI version.

Merge branch 'check-missing-dpkg-bin' into 'main'

2025-01-14T08:30:48Z

apt-pkg/deb/debsystem.cc: Fall back to "dpkg" when Dir::Bin::dpkg is not found See merge request apt-team/apt!419

Remove leftovers from ftp and rsh/ssh methods removal

2025-01-05T22:16:09Z

References: fd3684cdbc165ceaa635ed19fcbd231f509b0179

Remove leftovers of the apt-key removal

2025-01-05T22:16:09Z

References: a00fbbdb28cc31e78882301c2efe7218583ab4cb