<feed xmlns='http://www.w3.org/2005/Atom'>
<title>apt/test/integration/test-cve-2013-1051-InRelease-parsing, branch master</title>
<subtitle>Debians commandline package manager</subtitle>
<id>https://git.kalnischkies.de/apt/atom?h=master</id>
<link rel='self' href='https://git.kalnischkies.de/apt/atom?h=master'/>
<link rel='alternate' type='text/html' href='https://git.kalnischkies.de/apt/'/>
<updated>2019-01-23T18:10:47Z</updated>
<entry>
<title>Fail instead of warn for unsigned lines in InRelease</title>
<updated>2019-01-23T18:10:47Z</updated>
<author>
<name>David Kalnischkies</name>
<email>david@kalnischkies.de</email>
</author>
<published>2019-01-23T16:47:49Z</published>
<link rel='alternate' type='text/html' href='https://git.kalnischkies.de/apt/commit/?id=3734cceb44b02ca4d5ee3c6f5cbfe1e12f17cffb'/>
<id>urn:sha1:3734cceb44b02ca4d5ee3c6f5cbfe1e12f17cffb</id>
<content type='text'>
The warnings were introduced 2 years ago without any reports from the
wild about them actually appearing for anyone, so now seems to be an as
good time as any to switch them to errors.

This allows rewritting the code by failing earlier instead of trying to
keep going which makes the diff a bit hard to follow but should help
simplifying reasoning about it.

References: 6376dfb8dfb99b9d182c2fb13aa34b2ac89805e3
</content>
</entry>
<entry>
<title>warn if clearsigned file has ignored content parts</title>
<updated>2016-12-31T01:29:19Z</updated>
<author>
<name>David Kalnischkies</name>
<email>david@kalnischkies.de</email>
</author>
<published>2016-12-16T18:50:48Z</published>
<link rel='alternate' type='text/html' href='https://git.kalnischkies.de/apt/commit/?id=6376dfb8dfb99b9d182c2fb13aa34b2ac89805e3'/>
<id>urn:sha1:6376dfb8dfb99b9d182c2fb13aa34b2ac89805e3</id>
<content type='text'>
Clearsigned files like InRelease, .dsc, .changes and co can potentially
include unsigned or additional messages blocks ignored by gpg in
verification, but a potential source of trouble in our own parsing
attempts – and an unneeded risk as the usecases for the clearsigned
files we deal with do not reasonably include unsigned parts (like emails
or some such).

This commit changes the silent ignoring to warnings for now to get an
impression on how widespread unintended unsigned parts are, but
eventually we want to turn these into hard errors.
</content>
</entry>
<entry>
<title>tests: support spaces in path and TMPDIR</title>
<updated>2015-12-19T22:04:34Z</updated>
<author>
<name>David Kalnischkies</name>
<email>david@kalnischkies.de</email>
</author>
<published>2015-12-15T16:20:26Z</published>
<link rel='alternate' type='text/html' href='https://git.kalnischkies.de/apt/commit/?id=3abb6a6a1e485b3bc899b64b0a1b7dc2db25a9c2'/>
<id>urn:sha1:3abb6a6a1e485b3bc899b64b0a1b7dc2db25a9c2</id>
<content type='text'>
This doesn't allow all tests to run cleanly, but it at least allows to
write tests which could run successfully in such environments.

Git-Dch: Ignore
</content>
</entry>
<entry>
<title>tests: use quiet level 0 by default in tests</title>
<updated>2015-11-19T16:13:56Z</updated>
<author>
<name>David Kalnischkies</name>
<email>david@kalnischkies.de</email>
</author>
<published>2015-11-19T15:00:33Z</published>
<link rel='alternate' type='text/html' href='https://git.kalnischkies.de/apt/commit/?id=87d6947d51717e8b0e975d913986161598a7259a'/>
<id>urn:sha1:87d6947d51717e8b0e975d913986161598a7259a</id>
<content type='text'>
Git-Dch: Ignore
</content>
</entry>
<entry>
<title>support arch:all data e.g. in separate Packages file</title>
<updated>2015-11-04T17:42:27Z</updated>
<author>
<name>David Kalnischkies</name>
<email>david@kalnischkies.de</email>
</author>
<published>2015-10-28T13:38:49Z</published>
<link rel='alternate' type='text/html' href='https://git.kalnischkies.de/apt/commit/?id=1dd20368486820efb6ef4476ad739e967174bec4'/>
<id>urn:sha1:1dd20368486820efb6ef4476ad739e967174bec4</id>
<content type='text'>
Based on a discussion with Niels Thykier who asked for Contents-all this
implements apt trying for all architecture dependent files to get a file
for the architecture all, which is treated internally now as an official
architecture which is always around (like native). This way arch:all
data can be shared instead of duplicated for each architecture requiring
the user to download the same information again and again.

There is one problem however: In Debian there is already a binary-all/
Packages file, but the binary-any files still include arch:all packages,
so that downloading this file now would be a waste of time, bandwidth
and diskspace. We therefore need a way to decide if it makes sense to
download the all file for Packages in Debian or not. The obvious answer
would be a special flag in the Release file indicating this, which would
need to default to 'no' and every reasonable repository would override
it to 'yes' in a few years time, but the flag would be there "forever".

Looking closer at a Release file we see the field "Architectures", which
doesn't include 'all' at the moment. With the idea outlined above that
'all' is a "proper" architecture now, we interpret this field as being
authoritative in declaring which architectures are supported by this
repository. If it says 'all', apt will try to get all, if not it will be
skipped. This gives us another interesting feature: If I configure a
source to download armel and mips, but it declares it supports only
armel apt will now print a notice saying as much. Previously this was a
very cryptic failure. If on the other hand the repository supports mips,
too, but for some reason doesn't ship mips packages at the moment, this
'missing' file is silently ignored (= that is the same as the repository
including an empty file).

The Architectures field isn't mandatory through, so if it isn't there,
we assume that every architecture is supported by this repository, which
skips the arch:all if not listed in the release file.
</content>
</entry>
<entry>
<title>tests: don't use hardcoded port for http and https</title>
<updated>2015-09-15T08:16:09Z</updated>
<author>
<name>David Kalnischkies</name>
<email>david@kalnischkies.de</email>
</author>
<published>2015-09-14T22:33:12Z</published>
<link rel='alternate' type='text/html' href='https://git.kalnischkies.de/apt/commit/?id=6c0765c096ffb4df14169236c865bbb2b10974ae'/>
<id>urn:sha1:6c0765c096ffb4df14169236c865bbb2b10974ae</id>
<content type='text'>
This allows running tests in parallel.

Git-Dch: Ignore
</content>
</entry>
<entry>
<title>Fix test case breakage from the new policy implementation</title>
<updated>2015-08-10T13:36:51Z</updated>
<author>
<name>Julian Andres Klode</name>
<email>jak@debian.org</email>
</author>
<published>2015-08-10T13:36:51Z</published>
<link rel='alternate' type='text/html' href='https://git.kalnischkies.de/apt/commit/?id=76b004d1a2122206925abc1a412e055430cef283'/>
<id>urn:sha1:76b004d1a2122206925abc1a412e055430cef283</id>
<content type='text'>
Everything's working now.
</content>
</entry>
<entry>
<title>show URI.Path in all acquire item descriptions</title>
<updated>2015-06-11T08:56:31Z</updated>
<author>
<name>David Kalnischkies</name>
<email>david@kalnischkies.de</email>
</author>
<published>2015-06-11T08:56:31Z</published>
<link rel='alternate' type='text/html' href='https://git.kalnischkies.de/apt/commit/?id=1da3b7b8e15b642135b54684e70a0c271471f07a'/>
<id>urn:sha1:1da3b7b8e15b642135b54684e70a0c271471f07a</id>
<content type='text'>
It is a rather strange sight that index items use SiteOnly which strips
the Path, while e.g. deb files are downloaded with NoUserPassword which
does not. Important to note here is that for the file transport Path is
pretty important as there is no Host which would be displayed by Site,
which always resulted in "interesting" unspecific errors for "file:".

Adding a 'middle' ground between the two which does show the Path but
potentially modifies it (it strips a pending / at the end if existing)
solves this "file:" issue, syncs the output and in the end helps to
identify which file is meant exactly in progress output and co as a
single site can have multiple repositories in different paths.
</content>
</entry>
<entry>
<title>do not request files if we expect an IMS hit</title>
<updated>2015-06-09T10:57:36Z</updated>
<author>
<name>David Kalnischkies</name>
<email>david@kalnischkies.de</email>
</author>
<published>2015-06-08T13:22:01Z</published>
<link rel='alternate' type='text/html' href='https://git.kalnischkies.de/apt/commit/?id=8d041b4f4f353079268039dcbfd8b5e575196b66'/>
<id>urn:sha1:8d041b4f4f353079268039dcbfd8b5e575196b66</id>
<content type='text'>
If we have a file on disk and the hashes are the same in the new Release
file and the old one we have on disk we know that if we ask the server
for the file, we will at best get an IMS hit – at worse the server
doesn't support this and sends us the (unchanged) file and we have to
run all our checks on it again for nothing. So, we can save ourselves
(and the servers) some unneeded requests if we figure this out on our
own.
</content>
</entry>
<entry>
<title>test exitcode as well as string equality</title>
<updated>2015-03-16T17:01:54Z</updated>
<author>
<name>David Kalnischkies</name>
<email>david@kalnischkies.de</email>
</author>
<published>2015-03-09T23:59:44Z</published>
<link rel='alternate' type='text/html' href='https://git.kalnischkies.de/apt/commit/?id=25b86db159fbc3c043628e285c0c1ef24dec2c6e'/>
<id>urn:sha1:25b86db159fbc3c043628e285c0c1ef24dec2c6e</id>
<content type='text'>
We use test{success,failure} now all over the place in the framework, so
its only consequencial to do this in the situations in which we test for
a specific output as well.

Git-Dch: Ignore
</content>
</entry>
</feed>
