apt/methods/connect.cc, branch 3.3.0

apt-pkg: methods: fixed many minor memleaks

2026-05-01T16:27:11Z

Static analysis has shown that there are many minor memleaks.

tls: Do not trigger assertion after closing connection

2025-06-24T16:52:46Z

In HasPending(), we assert that there is an open connection object (ssl), but it seems we can end up calling HasPending() after calling Close(). Therefore, remove the assertion and include ssl != nullptr as the first requirement. Closes: #1107827

Fix regression that prevented sending intermediate client certificates

2025-01-23T22:24:37Z

The change from the GNUTLS backend to the OpenSSL backend only loads the first certificate from a client certificate file. As a result it is no longer possible to send intermediate client certificates to the server to assist in certificate verification. Instead call ssl_ctx_use_certificate_chain_file so intermediate certificates can be sent. Signed-off-by: Sam Hartman

methods/connect: Avoid unused argument warning

2025-01-14T10:26:31Z

Merge branch 'fix/cleanup' into 'main'

2025-01-14T08:26:23Z

Drop unused and obsolete macros as well as documentation See merge request apt-team/apt!428

ssl: Explictly return -1 (error) or 0 (server closed connection)

2025-01-08T18:22:36Z

SSL_read() and SSL_write may return 0 for errors, whereas our callers only expect -1 for errors and 0 for closed connections, so map this accordingly.

ssl: Set an error when we receive SSL_ERROR_SYSCALL

2025-01-08T18:22:34Z

The OpenSSL docs say: > For socket I/O on Unix systems, consult errno for details but also: > This value can also be returned for other errors, > check the error queue for details. This means it's possible errno isn't set, in which case we may appear to have reached an EOF when we did not.

Drop usage of macro APT_OVERRIDE for simple override

2025-01-05T22:16:08Z

We were rather inconsistent in using it and as our public headers contain deduction guides (a c++17 feature) it seems silly to try to hide a c++11 feature in a macro, so lets stop this charade and drop the macro and while we are changing all these lines lets apply [[nodiscard]] (another c++17 feature) and other suggestions from clang-tidy and formatting for a little more consistency.

Remove GnuTLS and gcrypt support

2024-12-22T22:45:15Z

OpenSSL is mandatory now, it is no longer possible to build without https support either.

hashes, methods: Add OpenSSL backends

2024-12-22T21:55:39Z

Introduce an OpenSSL::Crypto backend for the hashes library and an OpenSSL::SSL backend for the TLS support in our https method. Many thanks to curl for showing the way with how to handle a CRL file. There are some memory leaks here with the TlsFd itself as well as the proxy support; and we should reorganize the code to generate the ssl object as late as possible. A peculiar aspect of OpenSSL is that SSL_has_pending() returns 1 even if SSL_read() will fail to read anything and return the equivalent of EAGAIN. We work around this here by also peeking ahead 1 byte. I was running a very high RTT connection from Germany to Australia for testing, and with the peeking it's using negligible amounts of CPU; before that, it was busy looping at 100%. Bad OpenSSL!