Debians commandline package manager https://git.kalnischkies.de/apt/atom?h=1.3_exp1 2016-05-01T15:17:18Z 2016-05-01T15:17:18Z Carsten Hey carsten@debian.org 2016-05-01T15:06:29Z urn:sha1:2e49f51915d07a6ad85c7ee4380a1e51afaa3a17 Guarding against 'broken' greps not dealing with non-text inputs "just in case" by making the input text with a proper newline. [commit message by David Kalnischkies] Reported-On: IRC Git-Dch: Ignore 2016-05-01T13:50:04Z David Kalnischkies david@kalnischkies.de 2016-05-01T12:43:23Z urn:sha1:5f17b19f8f99eb6f80a10846d5891f53c16178dc We want to stop hard-depending on gnupg and for this it is essential that apt-key isn't used in any critical execution path, which maintainerscript are. Especially as it is likely that these script call apt-key either only for (potentially now outdated cleanup) or still not use the much simpler trusted.gpg.d infrastructure. 2016-03-06T09:16:59Z David Kalnischkies david@kalnischkies.de 2016-03-06T09:16:59Z urn:sha1:031a3f254a2a73b2843ead28a2481b63ec1d7244 Fixed in f7bd44bae0d7cb7f9838490b5eece075da83899e already, but the commit misses the Closes tag and while we are at it we can add a simple regression test and micro-optimize it a bit. Thanks: James McCoy for the suggestion. Closes: 816691 2016-03-04T22:26:11Z Daniel Kahn Gillmor dkg@fifthhorseman.net 2016-03-04T09:23:24Z urn:sha1:f7bd44bae0d7cb7f9838490b5eece075da83899e 2015-12-19T22:04:34Z David Kalnischkies david@kalnischkies.de 2015-12-18T11:35:43Z urn:sha1:803491dc568d2994745c3c4359f68053f7261658 The presents (even of an empty) secring.gpg is indication enough for gpg2 to tigger the migration code which not only produces a bunch of output on each apt-key call, but also takes a while to complete as an agent needs to be started and all that. We workaround the first part by forcing the migration to happen always in a call we forced into silence, but that leaves us with an agent to start all the time – with a bit of reordering we can make it so that we do not explicitly create the secring, but let gpg create it if needed, which prevents the migration from being triggered and we have at least a bit less of a need for an agent. Changes - even to public only keyrings - still require one, but such actions are infrequent in comparison to verification calls, so that should be a net improvement. 2015-12-19T22:04:34Z David Kalnischkies david@kalnischkies.de 2015-12-17T16:41:11Z urn:sha1:bc8f83a5afd858206efe518c31bbb1ac948a39a3 apt-key creates internally a script (since ~1.1) which it will call to avoid dealing with an array of different options in the code itself, but while writing this script it wraps the values in "", which will cause the shell to evaluate its content upon execution. To make 'use' of this either set a absolute gpg command or TMPDIR to something as interesting as: "/tmp/This is fü\$\$ing cràzy, \$(man man | head -n1 | cut -d' ' -f1)\$!" If such paths can be encountered in reality is a different question… 2015-12-06T23:09:10Z David Kalnischkies david@kalnischkies.de 2015-12-06T23:09:10Z urn:sha1:e23ee4c21c6d8045ab020526aa864a48dc16ddd9 In e75e5879 'replace "which" with "command -v" for portability' I missed that command -v isn't actually required to be available in debian, so for the 5 files we are using it: Two (abicheck/run_abi_test & test/integration/framework) are called in environments were I believe sh is at least dash or 'better' as the first one is "interactive" for apt developers and the later is sourced by ~200 tests in the same directory run by hand and ci-services – for the later we have pulled some uglier hacks for worser things already, so if there should actually end up needing something more compatible we will notice eventually (and the later actually had a command -v call for some time already and nobody came running). debian/rules and debian/apt.cron.daily I switched back to which as that is more or less debian-specific or at least highly non-critical. That leaves cmdline/apt-key.in with a bunch of calls where I will implement that functionality in shell as this is relatively short-lived as it is used to detect wget (for net-update, which Michael wants to revive and in that process will properly use apt-helper instead of wget) and to detect gpg vs. gpg2 systems, where the earlier is supposed to go away in the longrun (or the later, but by replacing the earlier…). [and this gpg/gpg2 detection is new in sid, so I have some sympathy for that being a problem now.] Thanks: Jakub Wilk for pointing out #747320 2015-12-06T13:46:11Z David Kalnischkies david@kalnischkies.de 2015-12-06T13:46:11Z urn:sha1:804419029ab1b969c8d2dedb9b3443225058521f After e75e5879 the reason for an implicit dependency on debianutils (which is essential for debian, but likely not on other systems) was just two uses of run-parts, which can be replaced with the a lot more portable find-piped-into-sort duo. 2015-12-06T13:03:35Z David Kalnischkies david@kalnischkies.de 2015-12-06T13:03:35Z urn:sha1:e75e5879c0e8d232a2e8f045685beeb8c965aba4 which is a debian specific tool packaged in debianutils (essential) while command is a shell builtin defined by POSIX. Closes: 807144 Thanks: Mingye Wang for the suggestion. 2015-09-14T13:22:19Z David Kalnischkies david@kalnischkies.de 2015-09-13T20:16:32Z urn:sha1:fecfbf2e4cbb71d20364306baf6aa7886c5f3ecd Filenames we get could include spaces, but also the tmpdir we work in and the failures we print in return a very generic and unhelpful… Properly supporting spaces is a bit painful as we constructed gpg command before, which is now moved to (multilevel) calls to temporary scripts instead.