Debians commandline package manager https://git.kalnischkies.de/apt/atom?h=2.9.19 2024-12-23T11:23:44Z 2024-12-23T11:23:44Z Julian Andres Klode julian.klode@canonical.com 2024-12-23T11:23:44Z urn:sha1:e126f608c877b5febb1a43d01cb3c662c598e8f2 2024-12-23T11:14:49Z Julian Andres Klode julian.klode@canonical.com 2024-12-23T11:14:49Z urn:sha1:e938c60061daff799113c4dbf6a8a41454f71126 2024-12-23T11:13:26Z Julian Andres Klode julian.klode@canonical.com 2024-12-23T10:56:41Z urn:sha1:225776b787f8e75b235a1ae080aae53dcc9e177e Hand edit 2.7.14build2 to 2.7.14 The funny 999:0misbuilt version number gets auto-reduced to the current version when building which is sad, but it works. 2024-12-22T22:52:05Z Julian Andres Klode julian.klode@canonical.com 2024-12-20T11:03:26Z urn:sha1:f5a24acea31248f98db51d7a2fd1d7b2198bb177 Our goal is for each platform to have one blessed OpenPGP verification system: Platforms that support sqv get sqv, platforms that don't get gpgv. To do so we hardcode the architecture list at build time. At build time we check if /usr/bin/sqv exists, which is the condition that apt uses to see if it should build with sqv support. We use a slight hack here to build with sqv on the official Debian buildds but use gpgv on Ubuntu by abusing the fact that Ubuntu resolves alternative build dependencies, and gpgv is installed in the buildd image. 2024-12-22T22:52:05Z Julian Andres Klode julian.klode@canonical.com 2024-12-20T10:21:29Z urn:sha1:153653d449efe121487641303d43ac523b9b17fb Many repositories still have SHA-1 self-signatures, and they are not security relevant for APT repositories in the first place since we do not use a web of trust model, but rather a set of trusted keyrings, and the subkey can essentially be always considered trusted even if it cannot be verified. 2024-12-22T21:55:39Z Julian Andres Klode julian.klode@canonical.com 2024-12-18T18:37:40Z urn:sha1:90270f0959d490d56db891809d83c91b3d4b9bf0 Introduce an OpenSSL::Crypto backend for the hashes library and an OpenSSL::SSL backend for the TLS support in our https method. Many thanks to curl for showing the way with how to handle a CRL file. There are some memory leaks here with the TlsFd itself as well as the proxy support; and we should reorganize the code to generate the ssl object as late as possible. A peculiar aspect of OpenSSL is that SSL_has_pending() returns 1 even if SSL_read() will fail to read anything and return the equivalent of EAGAIN. We work around this here by also peeking ahead 1 byte. I was running a very high RTT connection from Germany to Australia for testing, and with the peeking it's using negligible amounts of CPU; before that, it was busy looping at 100%. Bad OpenSSL! 2024-12-20T07:59:48Z Julian Andres Klode julian.klode@canonical.com 2024-12-20T07:59:48Z urn:sha1:becf3fed0f5f3da225eb1df2cd306add1fdf5ab8 2024-12-19T22:41:01Z Julian Andres Klode julian.klode@canonical.com 2024-12-19T21:11:04Z urn:sha1:a00fbbdb28cc31e78882301c2efe7218583ab4cb Remove the test case for MD5 and expired signatures, as we can't create them (can't set signing digest, and can't set signature expiry). Tests for them have been added to test-method-gpgv instead. We override sq in a function with cert-store and key-store set to none. This supports both sq 0.40 and sq 1.0. 2024-12-19T17:48:03Z Julian Andres Klode julian.klode@canonical.com 2024-12-19T17:39:01Z urn:sha1:63b9f4cd5307a1c22dd0001a1f7251ab2950f33e 2024-12-18T09:25:24Z Julian Andres Klode jak@debian.org 2024-12-16T16:05:40Z urn:sha1:6e260e26e4cd671f781151e24d89a17b29a55530 Automatically show the output of `show`, `policy`, `list`, `search`, `showsrc` in a pager. The pager setup is inspired by git's pager setup. Notably, the pager is found using APT_PAGER and PAGER variables. We wait for the pager to be setup somewhat correctly by using a notify pipe to figure out whether execvp() was succesful - then the pipe will read EOF as the other end got closed by CLOEXEC during exec - or not, then the pipe will contain an errno. We set up the correct handlers for signals and exit to close the fds and wait for the pager. Notably inside the signal handler we cannot flush our streams, only close them, so there is some duplication. We call the InitOutputPager() function from inside the various Do...() functions rather than setting it up generally in InitOutput(). Doing so allows us to first render the progress without a pager, and then setup the pager for the content only which improves user experience. When we setup a pager we also take care to disable standard input, as we should not be prompting users while a pager is running (the pager will be reading from the tty directly). We do this by dup2-ing() a /dev/null over it; if we just close()d the fd, another open() might reuse the fd number and problems could occur.