apt/test, branch 2.9.14Debians commandline package managerhttps://git.kalnischkies.de/apt/atom?h=2.9.142024-11-22T16:12:34ZMerge branch 'fix/partialfilemirror' into 'main'2024-11-22T16:12:34ZJulian Andres Klodejak@debian.org2024-11-22T16:12:34Zurn:sha1:1818699c1bc8a5be2d6542fe3212f26af7fa912a
Support uncompressed indexes from partial file:/ mirrors
See merge request apt-team/apt!235Merge branch 'test-gpgv-sq' into 'main'2024-11-22T16:09:41ZJulian Andres Klodejak@debian.org2024-11-22T16:09:41Zurn:sha1:f9069c2498f74c09b4a4d7da8bb677756b371dae
Test gpgv-sq
See merge request apt-team/apt!403test: Ensure we test both gpgv-g10code and gpgv-sq2024-11-22T15:44:02ZJulian Andres Klodejulian.klode@canonical.com2024-11-22T15:20:05Zurn:sha1:e983d98c4fcd952ffcbc010b185455913c8af650test: Accept empty output from gpgv/apt-key2024-11-22T15:44:02ZJulian Andres Klodejulian.klode@canonical.com2024-11-21T19:10:47Zurn:sha1:de3f663d823f9c185514af69296d011e22161479
Our internal code always generates ENODATA for empty output and
this is checked by the previous commit, so this is entirely safe.
test-releasefile-verification: Test empty/invalid signatures2024-11-22T15:44:02ZJulian Andres Klodejulian.klode@canonical.com2024-11-21T19:01:57Zurn:sha1:d2e34a441bad904798bf62fb850d4fb5b1b90656Accept BADSIG instead of EXPSIG for expired signatures2024-11-22T15:20:36ZJulian Andres Klodejulian.klode@canonical.com2024-11-21T17:51:10Zurn:sha1:222301d7a36a09db80a8832cd16db41f7946a9ea
Sequioa emits KEYEXPIRED + BADSIG instead of EXPSIG + VALIDSIG
test-releasefile-verification: Fix signature time2024-11-22T15:20:36ZJulian Andres Klodejulian.klode@canonical.com2024-11-21T17:49:28Zurn:sha1:27012a496a9da78f26e9e412a7118dbe00e5c1ec
The key was only generated in 2010 and only bound in 2016,
so we cannot have signatures from before then, so update
the key accordingly, and change the default expiry to 2017.
Look at non by-hash paths in copy and file methods2024-11-22T12:40:10ZDavid Kalnischkiesdavid@kalnischkies.de2022-05-09T09:42:48Zurn:sha1:7adf8c1fa8d519b8b57292763eb7703e7d3cc580
Ideally copy and file mirrors would support by-hash as well, but its
harder to setup and maintain especially if you want to cache an online
mirror who has by-hash enabled.
We can avoid unneeded roundtrips (in the best case) and entire cache
misses (in the usual worst case) by "just" telling methods that the URI
we passed it has the requested file perhaps also in other paths.
This is done in pseudo-relative paths as we would otherwise need to
teach redirection code to rewrite those URIs as well. A method like http
can easily ignore this value and await explicit instructions to look at
that file, but inspecting the path in local sources via file or copy is
(comparatively) free, so we just do it immediately. If that ends up
being the wrong version of the file as by-hash would have protected us
from we are in this feature branch now falling back to other mirrors
which are like the ones online and in support of by-hash.
Allow HashSum mismatches to fallback to other mirrors2024-11-22T12:40:10ZDavid Kalnischkiesdavid@kalnischkies.de2022-04-29T14:58:23Zurn:sha1:15124923b4cdb19af6bf642f396dab7c3e6bd074
Perhaps a common error in the past nowadays thanks to by-hash we rarely
get mismatches due to our calling behaviour and more because the mirror
is genuinely bad especially if this mirror didn't work with by-hash.
Using our "normal" error handling allows falling back to other mirrors
which hopefully do support by-hash and/or are not broken on a filesystem
level making us more resistent to the occasional bad apple in a wild
mirror forest.
Do not assume mirror-URIs end in a filename causing a hang2024-11-22T12:40:10ZDavid Kalnischkiesdavid@kalnischkies.de2022-04-28T14:44:13Zurn:sha1:afc7b0dbf1114f3d723ff0e1ab9d0796cd799970
In practice most of them will, but making the acquire process hang in
response if they don't seems like an overly excessive response if we can
just support it gracefully to reply with an error (or actually succeed
in the unlikely event this URI is actually correct).