Debians commandline package manager https://git.kalnischkies.de/apt/atom?h=1.4_beta4 2015-08-20T12:54:03Z 2015-08-20T12:54:03Z Julian Andres Klode jak@debian.org 2015-08-20T12:47:32Z urn:sha1:269b7c0cd89e9508c0051d6ac2c3632540a31daa Thanks: Niels Thykier for reporting this on IRC 2014-10-21T15:19:45Z Michael Vogt mvo@debian.org 2014-10-21T15:19:45Z urn:sha1:1924b1e513b0619c177565d17475ea3747983f4f Ensure in SetupAPTPartialDirectory() that the /etc/apt/auth.conf file can be read by the priv sep apt methods. 2014-10-21T14:54:03Z Michael Vogt mvo@debian.org 2014-10-21T14:54:03Z urn:sha1:cbb1005a0a2e026e4a7361b0ff86888af192ee85 If the methods drop privileges we need to ensure that /etc/apt/apt.conf is still readable by the _apt user. 2014-10-07T14:38:03Z Michael Vogt mvo@ubuntu.com 2014-10-07T14:38:03Z urn:sha1:4d0818cc39f7c0d44ecdfcdf9701058f81caa492 Conflicts: apt-pkg/acquire-item.cc 2014-10-06T23:59:49Z David Kalnischkies david@kalnischkies.de 2014-10-06T12:29:53Z urn:sha1:5684f71fa0f6c1b765aa53e22ca3b024c578b9c9 Using a different user for calling methods is intended to protect us from methods running amok (via remotely exploited bugs) by limiting what can be done by them. By using root:root for the final directories and just have the files in partial writeable by the methods we enhance this in sofar as a method can't modify already verified data in its parent directory anymore. As a side effect, this also clears most of the problems you could have if the final directories are shared without user-sharing or if these directories disappear as they are now again root owned and only the partial directories contain _apt owned files (usually none if apt isn't running) and the directory itself is autocreated with the right permissions. 2014-10-01T23:00:12Z David Kalnischkies david@kalnischkies.de 2014-10-01T21:58:05Z urn:sha1:8b32e72c6f7143de4ec02f44e362b0df9e21e024 apt-key creates trusted.gpg if it needs it with 644 nowadays, but before it ensured this, it was gpg creating it, which gives it by default 600. Not a problem as long as our gpgv is run as root, but now that we drop privileges we have to ensure that we can also read trusted.gpg files created by earlier apt-key versions. Closes: 647001 2014-09-30T13:21:44Z Michael Vogt mvo@ubuntu.com 2014-09-30T13:21:44Z urn:sha1:dacb75c62564f436a5f56b0a04169dc71ec3a9cd 2014-09-26T22:12:14Z David Kalnischkies david@kalnischkies.de 2014-01-24T14:45:09Z urn:sha1:1d240b5a2dd5a82283f7d0b7fe05b6f90222957c Adding and deleting many repositories could cause (empty) keyring files to pill up in older apt-key versions, which in the end might cause gnupg to run into its internal limit of at most 40 keyrings 2014-09-26T22:12:13Z David Kalnischkies david@kalnischkies.de 2014-01-24T14:18:14Z urn:sha1:5b55915a9beca06c9993285aee9da9f4ac3bccc4 It helps in identifying its affiliation. Also removes the old postinst which was hidden by apt.postinst for a long time now and would just install a sources.list in edgecases which is probably not a good idea (e.g. on my system /etc/apt/sources.list does not exist). It is better done by the installer of the distro. Git-Dch: Ignore 2014-09-25T09:39:16Z Michael Vogt mvo@ubuntu.com 2014-09-25T09:39:16Z urn:sha1:b98232208f580e7b2677af87fb22d21f61a0509a Thanks to Axel Beckert