apt/methods/gpgv.cc, branch 2.4.0Debians commandline package managerhttps://git.kalnischkies.de/apt/atom?h=2.4.02022-02-22T17:25:06ZWarn if the legacy trusted.gpg keyring is used for verification2022-02-22T17:25:06ZJulian Andres Klodejak@debian.org2022-01-07T11:43:32Zurn:sha1:56adf743b02b80a9acc9a2e480bfd15acb94f755
With apt-key going away, people need to manage key files, rather
than keys, so they need to know if any keys are in the legacy keyring.
Add support for embedding PGP keys into Signed-By in deb822 sources2021-10-18T14:12:54ZJulian Andres Klodejulian.klode@canonical.com2021-06-09T11:22:38Zurn:sha1:3f07f5345ec79702c3c769047452041b2c12953f
Extend the Signed-By field to handle embedded public key blocks,
this allows shipping self-contained .sources files, making it
substantially easier to provide third party repositories.
Replace PrintStatus with SendMessage usage2021-02-04T10:00:00ZDavid Kalnischkiesdavid@kalnischkies.de2020-06-28T18:52:09Zurn:sha1:96dc40b19623621a9cc2c5541fb3adbbceb553b1
varg API is a nightmare as the symbols seems different on ever other
arch, but more importantly SendMessage does a few checks on the content
of the message and it is all outputted via C++ iostreams and not mixed
in FILE* which is handy for overriding the streams.
Implement encoded URI handling in all methods2020-12-18T18:31:19ZDavid Kalnischkiesdavid@kalnischkies.de2020-07-09T22:02:25Zurn:sha1:97d6c3b2d05fe0d965657197adf56cc78f9edf81
Every method opts in to getting the encoded URI passed along while
keeping compat in case we are operated by an older acquire system.
Effectively this is just a change for the http-based methods as the
others just decode the URI as they work with files directly.
gpgv: Rename master to primary2020-08-04T10:12:11ZJulian Andres Klodejulian.klode@canonical.com2020-07-14T14:19:08Zurn:sha1:9cb5a81168307e15f209173ad9286835bff2df65Rename _count() macro to APT_ARRAY_SIZE()2020-01-07T21:51:41ZJulian Andres Klodejulian.klode@canonical.com2020-01-07T21:37:36Zurn:sha1:df4b92bd1df204e7fb0d22e73e143d205d74aea6Fix some style warnings from cppcheck2019-11-26T11:36:46ZDavid Kalnischkiesdavid@kalnischkies.de2019-09-13T10:01:47Zurn:sha1:35012abf30ec1cfc9b5ee29647d4b1e25d98e99f
Unused variable, std::algorithms instead of raw for-loops.
There should be no observeable difference in behaviour.
Reported-By: cppcheck
Gbp-Dch: Ignore
apt-pkg: URI: Add 'explicit' to single argument constructor2019-04-30T15:43:56ZJulian Andres Klodejulian.klode@canonical.com2019-04-30T10:32:54Zurn:sha1:af74a9e2d55d6a9532eb3fbb9b96c65b7ddc1e4d
This needs a fair amount of changes elsewhere in the code,
hence this is separate from the previous commits.
Communicate back which key(s) were used for signing2019-01-22T11:24:22ZDavid Kalnischkiesdavid@kalnischkies.de2018-09-11T23:44:18Zurn:sha1:7bf533967fb385b9625a1ee4dd7c6542a84b489c
Telling the acquire system which keys caused the gpgv method to
succeed allows us for now just a casual check if the gpgv method
really executed catching bugs like CVE-2018-0501, but we will make use
of the information for better features in the following commits.
Refactor internal Signers information storage in gpgv2019-01-22T11:24:22ZDavid Kalnischkiesdavid@kalnischkies.de2018-09-11T14:45:06Zurn:sha1:6b01cd087e6f92c5511fe6eea73699e075aa699a
Having a method take a bunch of string vectors is bad style, so we
change this to a wrapping struct and adapt the rest of the code brushing
it up slightly in the process, which results even in a slightly "better"
debug output, no practical change otherwise.
Gbp-Dch: Ignore