apt/methods/http.cc, branch 1.7.0

Use steady clock source for bandwidth limitation

2018-05-29T11:04:59Z

Using the time of day for this is slightly wrong just like it is for progress, just less visible.

Remove unused time-tracking from http method

2018-05-28T15:59:38Z

The Stats method isn't called anywhere, was partly commented out before, but we keep updating the time for it – lets avoid this pointless busywork. Gbp-Dch: Ignore

Lower default timeout from 120s to 30s

2018-05-24T12:31:31Z

120s is an insanely high default time out, lower it to 30s to make things a bit nicer.

Remove obsolete RCS keywords

2018-05-07T11:41:31Z

Prompted-by: Jakub Wilk

reimplement and simplify mirror:// method

2018-01-03T17:55:41Z

Embedding an entire acquire stack and HTTP logic in the mirror method made it rather heavy weight and fragile. This reimplement goes the other way by doing only the bare minimum in the method itself and instead redirect the actual download of files to their proper methods. The reimplementation drops the (in the real world) unused query-string feature as it isn't really implementable in the new architecture.

report transient errors as transient errors

2017-12-13T22:56:29Z

The Fail method for acquire methods has a boolean parameter indicating the transient-nature of a reported error. The problem with this is that Fail is called very late at a point where it is no longer easily identifiable if an error is indeed transient or not, so some calls were and some weren't and the acquire system would later mostly ignore the transient flag and guess by using the FailReason instead. Introducing a tri-state enum we can pass the information about fatal or transient errors through the callstack to generate the correct fails.

Also look at https_proxy for https URLs

2017-11-19T12:59:30Z

We accidentally regressed here in 1.5 when replacing the https method.

Sandbox methods with seccomp-BPF; except cdrom, gpgv, rsh

2017-10-22T21:38:31Z

This reduces the number of syscalls to about 140 from about 350 or so, significantly reducing security risks. Also change prepare-release to ignore the architecture lists in the build dependencies when generating the build-depends package for travis. We might want to clean up things a bit more and/or move it somewhere else.

Run Proxy-Auto-Detect script from main process

2017-10-22T16:52:16Z

This avoids running the Proxy-Auto-Detect script inside the untrusted (well, less trusted for now) sandbox. This will allow us to restrict the http method from fork()ing or exec()ing via seccomp.

allow the auth.conf to be root:root owned

2017-07-26T17:09:04Z

Opening the file before we drop privileges in the methods allows us to avoid chowning in the acquire main process which can apply to the wrong file (imagine Binary scoped settings) and surprises users as their permission setup is overridden. There are no security benefits as the file is open, so an evil method could as before read the contents of the file, but it isn't worse than before and we avoid permission problems in this setup.