Debians commandline package manager https://git.kalnischkies.de/apt/atom?h=2.9.19 2024-12-22T22:45:15Z 2024-12-22T22:45:15Z Julian Andres Klode julian.klode@canonical.com 2024-12-21T14:26:34Z urn:sha1:7b1fb90b93ced7c0772d726e512da01fad456852 OpenSSL is mandatory now, it is no longer possible to build without https support either. 2024-12-22T21:55:39Z Julian Andres Klode julian.klode@canonical.com 2024-12-18T18:37:40Z urn:sha1:90270f0959d490d56db891809d83c91b3d4b9bf0 Introduce an OpenSSL::Crypto backend for the hashes library and an OpenSSL::SSL backend for the TLS support in our https method. Many thanks to curl for showing the way with how to handle a CRL file. There are some memory leaks here with the TlsFd itself as well as the proxy support; and we should reorganize the code to generate the ssl object as late as possible. A peculiar aspect of OpenSSL is that SSL_has_pending() returns 1 even if SSL_read() will fail to read anything and return the equivalent of EAGAIN. We work around this here by also peeking ahead 1 byte. I was running a very high RTT connection from Germany to Australia for testing, and with the peeking it's using negligible amounts of CPU; before that, it was busy looping at 100%. Bad OpenSSL! 2024-11-22T12:13:25Z David Kalnischkies david@kalnischkies.de 2024-11-19T22:42:44Z urn:sha1:8c760266c8c736bff62055c008ab74d78f3ed82a gcc reports `warning: Declaring type ‘class X’ final would enable devirtualization of Y calls [-Wsuggest-final-types]`. Not that this would massively improve performance, but it shouldn't hurt telling the compiler what is obvious for a human. 2024-03-03T07:23:51Z Steve Langasek steve.langasek@canonical.com 2024-03-03T07:10:14Z urn:sha1:9044806c2adc6118399349c70a6c5746cedcc374 Once in a generation, it may be necessary to bootstrap apt in an environment where gnutls is not yet available. This makes gnutls support in apt optional. You may also want a configure flag to force gnutls to be required from outside the buildsystem (e.g. debian/rules). 2024-02-20T12:49:04Z Julian Andres Klode julian.klode@canonical.com 2024-02-20T12:43:08Z urn:sha1:40a75722c43ae24cb9a99d6730a3b25b65819c49 This was automated with sed and git-clang-format, and then I had to fix up the top of policy.cc by hand as git-clang-format accidentally indented it by two spaces. 2021-09-13T14:09:19Z David Kalnischkies david@kalnischkies.de 2021-09-12T22:54:38Z urn:sha1:4e04cbafe7db326b52ee650a4f4ccc3444da6890 The settings used for unwrapping TLS connections depend on the access and hostname we connect to more than what we eventually unwrap. The bugreport mentions CaInfo, but all other https-settings should also apply (regardless of generic or hostname specific) to an https proxy, even if the connection we proxy through it is http-only. Closes: #990555 2021-05-12T11:06:11Z Julian Andres Klode julian.klode@canonical.com 2021-05-11T14:04:10Z urn:sha1:2129ffecc084ca772af75418225c5551631e6278 This makes them retriable, and brings them more into line with TCP, where handshake is also a transient error. LP: #1928100 2020-12-22T23:54:14Z Faidon Liambotis paravoid@debian.org 2020-12-22T23:54:14Z urn:sha1:1663774bf309fbd196fd2b9c5c2afdd7a25fd288 The "last connection" cache is currently being stored and looked up on the combination of (LastHost, LastPort). However, these are not what the arguments to getaddrinfo() were on the first try: the call is to getaddrinfo(Host, ServiceNameOrPort, ...), i.e. with the port *or if 0, the service name* (e.g. http). Effectively this means that the connection cache lookup for: https://example.org/... i.e. Host = example.org, Port = 0, Service = http would end up matching the "last" connection of (if existed): https://example.org/... i.e. Host = example.org, Port = 0, Service = https ...and thus performing a TLS request over an (unrelated) port 80 connection. Therefore, an HTTP request, followed up by an (unrelated) HTTPS request to the same server, would always fail. Address this by using as the cache key the ServiceNameOrPort, rather than Port. 2020-12-22T23:51:50Z Faidon Liambotis paravoid@debian.org 2020-12-22T23:51:50Z urn:sha1:8d4b3a4fcead0ca534b5d1c5a99ae2a4c95eee21 Convert the fixed-size (300) char array "ServStr" to a std::string, and simplify the code by removing snprintfs in the process. While at it, rename to the more aptly named "ServiceNameOrPort" and update the comment to reflect what this variable is meant to be. 2019-07-08T13:51:17Z David Kalnischkies david@kalnischkies.de 2019-07-08T13:48:59Z urn:sha1:2b734a7ec429825c7007c1093883229e069d36c7 Reported-By: cppcheck