apt/methods, branch 2.9.8Debians commandline package managerhttps://git.kalnischkies.de/apt/atom?h=2.9.82024-07-15T17:17:55ZOnly revoke weak RSA keys for now, add 'next' and 'future' levels2024-07-15T17:17:55ZJulian Andres Klodejulian.klode@canonical.com2024-07-15T17:13:58Zurn:sha1:47deb766c0a11c54d122197531279677545459af
Algorithms not in the next level give a warning, algorithms
in not in the future level introduce an audit message for
the --audit flag.
next: >=rsa2048,ed25519,ed448,nistp256,nistp384,nistp512
future: >=rsa3072,ed25519,ed448
LP: #2073126
gpgv: Add a LaterWorthless level, a SoonWorthless but at 'audit' level2024-07-15T17:17:04ZJulian Andres Klodejulian.klode@canonical.com2024-07-15T15:58:08Zurn:sha1:04cb5104a018184fe1fac114cbc212a9395d6845worker: Add an audit level to log audit messages2024-07-15T17:16:27ZJulian Andres Klodejulian.klode@canonical.com2024-07-15T15:57:42Zurn:sha1:c51ea9f44e9742c88a252b86cb0260798b4b9f7bRevert "Temporarily downgrade key assertions to "soon worthless""2024-04-09T17:59:52ZJulian Andres Klodejulian.klode@canonical.com2024-04-09T17:56:26Zurn:sha1:81c65f7e86b8f16eaaa91d9c205a594b0ebde159
We temporarily downgraded the errors to warnings to give the
launchpad PPAs time to be fixed, but warnings are not safe:
Untrusted keys could be hiding on your system, but just not
used at the moment. Hence revert this so we get the errors we
want.
This reverts commit 66998ed3d299bede651ad40368bdb270f5f5b0f9.
LP: #2060721
Gbp-Dch: full
Support building without gnutls2024-03-03T07:23:51ZSteve Langaseksteve.langasek@canonical.com2024-03-03T07:10:14Zurn:sha1:9044806c2adc6118399349c70a6c5746cedcc374
Once in a generation, it may be necessary to bootstrap apt in an
environment where gnutls is not yet available. This makes gnutls
support in apt optional.
You may also want a configure flag to force gnutls to be required from
outside the buildsystem (e.g. debian/rules).
Temporarily downgrade key assertions to "soon worthless"2024-02-28T17:22:01ZJulian Andres Klodejulian.klode@canonical.com2024-02-28T16:04:05Zurn:sha1:66998ed3d299bede651ad40368bdb270f5f5b0f9
This will only issue warnings instead of errors while we continue
cleaning up our repositories.
Rename 'weak digest algorithm' to 'weak algorithm'2024-02-28T17:22:01ZJulian Andres Klodejulian.klode@canonical.com2024-02-28T15:52:33Zurn:sha1:8a14c18c5b487139948dcb22abd37bffdd9cf5f4
This allows us to render public key algorithms as weak as well.
Implement gpgv --assert-pubkey-algo=>=rsa2048,ed25519,ed4482024-02-28T17:22:01ZJulian Andres Klodejulian.klode@canonical.com2024-02-28T14:14:43Zurn:sha1:50e3fee26ae843a812b1c9ec8531946931773fd3
The assertion can be overriden using apt::key::assert-pubkey-algo,
the default is the most opinionated one.
This will inform the user during apt-cdrom add as we do not
pass --quiet to user, so adjust test case.
Add a simple test case for it to test-method-gpgv.
LP: #2055193
gpgv: Add a reason to worthless signers2024-02-28T17:21:01ZJulian Andres Klodejulian.klode@canonical.com2024-02-28T13:49:48Zurn:sha1:60d653634f889abe09c0f4d88f2559eab9202635gpgv: Surface [GNUPG:] ERROR and [GNUPG:] WARNING status messages2024-02-28T17:21:01ZJulian Andres Klodejulian.klode@canonical.com2024-01-18T17:35:35Zurn:sha1:066121ac4de3f1e07e203583a2c5d00a0289f84a