summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Release 1.2.71.2.7Julian Andres Klode2016-03-1557-58/+356
|
* Fix bug where the problemresolve can put a pkg into a heisenstateMichael Vogt2016-03-155-2/+56
| | | | | | | | | | | | | | | | The problemresolver will set the candidate version for pkg P back to the current version if it encounters an impossible to satisfy critical dependency on P. However it did not set the State of the package back as well which lead to a situation where P is neither in Keep,Install,Upgrade,Delete state. Note that this can not be tested via the traditional sh based framework. I added a python-apt based test for this. LP: #1550741 [jak@debian.org: Make the test not fail if apt_pkg cannot be imported]
* methods/gpgv: Warn about SHA1 (and RIPEMD-160)Julian Andres Klode2016-03-151-3/+29
| | | | | | | We will drop support for those in the future. Also adjust the std::array to be a std::vector, as that's easier to maintain.
* apt-pkg/acquire-worker.cc: Introduce 104 Warning messageJulian Andres Klode2016-03-152-0/+12
| | | | | | | | | This can be used by workers to send warnings to the main program. The messages will be passed to _error->Warning() by APT with the URI prepended. We are not going to make that really public now, as the interface might change a bit.
* methods/gpgv: Correctly handle weak signatures with multiple keysJulian Andres Klode2016-03-151-1/+6
| | | | | | | | | | | | We added weak signatures to BadSigners, meaning that a Release file signed by both a weak signature and a strong signature would be rejected; preventing people from migrating from DSA to RSA keys in a sane way. Instead of using BadSigners, treat weak signatures like expired keys: They are no good signatures, and they are worthless. Gbp-Dch: ignore
* zh_CN.po: fix translation bug. (Closes: #818177)Zhou Mo2016-03-151-1/+1
|
* methods/gpgv: Reject weak digest algorithmsJulian Andres Klode2016-03-141-0/+16
| | | | | This keeps a list of weak digest algorithms. For now, only MD5 is disabled, as SHA1 breaks to many repos.
* Revert "Handle ERRSIG in the gpgv method like BADSIG"Julian Andres Klode2016-03-141-7/+0
| | | | | | | | This reverts commit 76a71a1237d22c1990efbc19ce0e02aacf572576. That commit broke the test suite. Gbp-Dch: ignore
* Handle ERRSIG in the gpgv method like BADSIGJulian Andres Klode2016-03-141-0/+7
| | | | | | | | | | | | ERRSIG is created whenever a key uses an unknown/weak digest algorithm, for example. This allows us to report a more useful error than just "unknown apt-key error.": The following signatures were invalid: ERRSIG 13B00F1FD2C19886 1 2 01 1457609403 5 While still not being the best reportable error message, it's better than unknown apt-key error and hopefully redirects users to complain to their repository owners.
* test: Move --weak-digest initialization to the right placeJulian Andres Klode2016-03-141-3/+6
| | | | | | | This was wrong and caused some issues because apt-key invoked host apt-config with our library. Gbp-Dch: ignore
* test: Use SHA512 digests for GPG, reject SHA1-based signaturesJulian Andres Klode2016-03-141-1/+5
| | | | | This makes the test suite safe if we ever need to reject SHA1 signatures in an update.
* Spanish apt-mark translation fixManuel "Venturi" Porras Peralta2016-03-141-1/+1
| | | | | | | | | | | | | | "%s can not be marked as it is not installed." was incorrectly translated as "%s no se puede marcar como no instalado.\n", which means "%s can not be marked as not installed." Thanks to Marcos Del Sol Vives for reporting & to the spanish translation team – and in particular Camaleón and Venturi – for review and correction of this issue! [commit message by commiter] Closes: 817999
* enforce verify of filesize in 'apt-get source'David Kalnischkies2016-03-142-7/+40
| | | | | The structure we parse the data into has a dedicated size field, but it tends to be easier to handle it as a (very weak) checksum.
* don't use Desc.URI to calculate .diff/Index filenamesDavid Kalnischkies2016-03-142-12/+39
| | | | | | | The URI descibing an item can change via mirrors/redirectors which causes the .diff/Index files to get the wrong names in storage. Git-Dch: Ignore
* streamline dpkgpm cleanup-handlingDavid Kalnischkies2016-03-141-14/+17
| | | | | | | | | | | | | | | | | The (unlikely) waitpid failure case should fallthrough the code just like the other failures (and successes) instead of taking a shortcut avoiding all the cleanup (progress) and finishing touches (log, state). This also delays the cleanup of the progress until apt is really done with everything and "just" has the post-invokes left to do, so the period of 'apt looks finished as it stopped the progress' and 'apt really finished as I have the shell-prompt back' is shorter even if there is no progress reported anymore, so the bar lingers at 100%… Ideally even the post-invokes would be covered by progress, but they can have their own output and dealing with that could be hard. Git-Dch: Ignore
* flush line-clearing on progress stop before post-invokeDavid Kalnischkies2016-03-142-2/+6
| | | | | | | | | All other interactions with std::cout are flushed directly, just in the stop case we hadn't done it – no problem expect if there is still output coming after apt is done like in the case of a post-invoke script producing output. Closes: 793672
* aptwebserver: fix html validation issuesDavid Kalnischkies2016-03-141-5/+5
| | | | | | | | Iceweasel^WFirefox complains about the missing encoding in its console which can be a bit annoying in interactive sessions, so fixing these issues has no effect on apt itself, but on the testers. Git-Dch: Ignore
* require $(HASH)-Download field in .diff/Index filesDavid Kalnischkies2016-03-142-60/+58
| | | | | | | | | | | | Now that we ignore SHA1-only files it makes sense to require also the provision of hashes for the compressed patches as this was introduced in the same patchset as support for non-SHA1 hashes in the file itself in dak and adding support in other archive creators (if they support pdiffs at all) will likely be in the same batch. The reason for the change itself is simple: If you are 'scared' enough about the security of SHA1, you shouldn't uncompress a file you haven't verified at all – after all, it could be exploiting a bug or a zip bomb.
* test: remove SHA1 support testing as unsupportedDavid Kalnischkies2016-03-141-71/+19
| | | | | | | | Given that we refuse to use SHA1-only .diff/Indexes no point in shipping and running code which pretends to check support for it which given that all these tests are run 3 times eats a noticeable amount of time. Git-Dch: Ignore
* Test that SHA1-only .diff/Index files are not usedJulian Andres Klode2016-03-131-2/+32
| | | | | Ensure that .diff/Index files that only contain SHA1 values and no SHA2 values are not used.
* Do not consider SHA1 usableJulian Andres Klode2016-03-136-20/+37
| | | | | SHA1 is not reasonably secure anymore, so we should not consider it usable anymore. The test suite is adjusted to account for this.
* Use native architecture instead of amd64 for build-dep-purge testJulian Andres Klode2016-03-101-9/+12
| | | | | | | | Using amd64 broke the test case on non-amd64 architectures. Query the native architecture from dpkg and use that instead. The definition of NATIVE is copied from the test test-architecture-specification-parsing.
* Dutch manpages translation updateFrans Spiesschaert2016-03-081-724/+824
| | | | Closes: 817062
* Dutch program translation updateFrans Spiesschaert2016-03-081-142/+196
| | | | Closes: 817060
* Release 1.2.61.2.6Julian Andres Klode2016-03-0713-13/+26
|
* apt-pkg/algorithms.cc: Avoid stack buffer overflow in KillListJulian Andres Klode2016-03-071-10/+9
| | | | | | | | Dynamically allocate KillList in order to avoid an overflow when more than 100 elements would be written to it. This happened while playing around with the status file from Bug#701069 on a modern system.
* Fix several typosVeres Lajos2016-03-0718-37/+37
| | | | | | | | | | | | | This effectively merges branch 'typofixes-vlajos-20150807' of github.com:vlajos/apt with the following commit: commit 13cacb3e2e2352ba701e769fc889e3344fabbf7e Author: Veres Lajos <vlajos@gmail.com> Date: Sun Aug 9 00:12:53 2015 +0100 typofix - https://github.com/vlajos/misspell_fixer It has been rebased for a better commit message.
* Release 1.2.51.2.5Julian Andres Klode2016-03-0613-13/+35
|
* debian/control: Set Standards-Version to 3.9.7Julian Andres Klode2016-03-061-1/+1
| | | | | | | We do not follow the recommendation with regards to placement of documentation in apt-doc, as we install in apt-doc, but it's only a recommendation and I don't want think we should move them.
* get group again after potential remap in Source: parseDavid Kalnischkies2016-03-061-1/+3
| | | | | | | | | | | | | | | | Mysteriously segfaults only on i386 for me, but at least one reporter had the same behavior and it makes sense that this is the problem as the parsing of Source: was fixed in 1.2.2 – before the not remapped group was not used. We don't use our usual Dynamic<> trick here as we don't have it in the parser. Its a bit of a layer violation to do this parsing here, but its how it is always was… Until next time with this lovely kind of problem. Closes: 812251 Thanks: Francesco Poli and Marc Haber for testdata.
* Prevent double remapping of iterators and string viewsJulian Andres Klode2016-03-061-8/+22
| | | | | | | | | | | If an iterator or a stringview has multiple dynamic objects registered with it, it may be remapped twice. Prevent that by noting which iterators/views we have seen and not remapping one if we have already seen it. We most likely do not have any instance of multiple dynamics on a single object, but let's play safe - the overhead is not high.
* do not move not-failed pdiff-patches into CWD on failureDavid Kalnischkies2016-03-062-0/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | If a single pdiff fails, we have to fail the entire patching endeavour and fall back to getting the complete file instead. That is easy in serverside merged pdiffs as we get them one by one. For clientside we get them all at once through, which means that a failure in one has to stop the entire pipeline, which works as expected (as proven by the bugreporters as they don't even notice it happening). The problem is just that the first failing pdiff will do the cleanup, so another pdiff which happens to be successfully acquired after we processed the failure doesn't find the file it is supposed to use as a basename anymore, so the patch is renamed to what should be the unique extension and moved into the current working directory. Processing is then stopped as the patch realizes that it isn't the last one which completed downloading. On the plus side this means this is neither us using a bad temporary location nor a security problem. It "just" overrides unconditionally files in your current working directory (if you happen to have them named like a pdiff patch – a bit unlikely perhaps) and so drops files there which are never used again. I guess this was introduced in 4e3c5633b1e74b4f58b95f339cfbbf4cbf21ab3e for real as I made the need for the existence of the base file rather explicit, but the potential lingers in the code for far longer. Closes: #816837
* Fix lzma write support to handle "try again" caseColin Watson2016-03-061-4/+25
| | | | | | | | | | | | The liblzma-based write code needs the same tweaks that the read code already has to cope with the situation where lzma_code returns zero the first time through because avail_out is zero, but will do more work if called again. This ports the read tweaks to the write code as closely as possible (including matching comments etc.). Closes: #751688
* add test for apt-key 0xKEY and use parameter expansionDavid Kalnischkies2016-03-062-1/+12
| | | | | | | | | Fixed in f7bd44bae0d7cb7f9838490b5eece075da83899e already, but the commit misses the Closes tag and while we are at it we can add a simple regression test and micro-optimize it a bit. Thanks: James McCoy for the suggestion. Closes: 816691
* support APT::Get::Build-Dep-Automatic again in build-depDavid Kalnischkies2016-03-062-0/+47
| | | | | | | | | | | In a249b3e6fd798935a02b769149c9791a6fa6ef16 I dropped with the manual first resolver step also the support for installing build-deps as automatic in such a way that it behaved like this option was enabled by default. Restoring support for it means that we go back to mark build- dependencies as manually installed again by default and provide this option to keep them as automatically installed.
* tests: expect no output while compiling noopchrootDavid Kalnischkies2016-03-062-4/+8
| | | | | | This way we hopefully notice (new) warnings in this little helper. Git-Dch: Ignore
* deal with partially downloaded changelogsDavid Kalnischkies2016-03-062-2/+25
| | | | | | | | | | | | Changelogs are relatively small and we have no hashes for them, but we had partial support for them before, so lets stick to it. This also deletes the (partial) file before moving the downloaded file into its place – rename(2) should be doing this by itself, but testing on semaphoreci suggests that this isn't always the case (error is "Stale file handle") and we don't need an atomic replace here, so be explicit. Git-Dch: Ignore
* apt-key del should correctly handle keyids prefixed with 0xDaniel Kahn Gillmor2016-03-041-0/+4
|
* Release 1.2.41.2.4Julian Andres Klode2016-02-2713-13/+27
|
* Add missing numeric includes in files using std::accumulate()Julian Andres Klode2016-02-262-0/+2
| | | | Reported-By: Helmut Grohne on IRC
* Fix crash with empty architecture listJulian Andres Klode2016-02-252-4/+19
| | | | | | If the architecture list is empty somehow, fail normally. LP: #1549819
* pass versioned provides to external solvers in EDSPDavid Kalnischkies2016-02-162-117/+165
| | | | | | The EDSP output generated by apt didn't include the versioned provides information so that every provides looked like an unversioned one in the eyes of an external resolver.
* Fix maintscript to properly remove 20changelogJulian Andres Klode2016-02-151-1/+1
| | | | Closes: #814754
* always download changelogs into /tmp firstDavid Kalnischkies2016-02-114-43/+50
| | | | | | | | | | pkgAcqChangelog has the default behaviour of downloading a changelog to a temporary directory (inside /tmp, not /tmp directly), which is cleaned up on shutdown, but this can be overridden to store the changelog more permanently – but that caries a permission problem. For changelog we can 'easily' solve this by always downloading to a temporary directory and only move it out of there on done.
* use local changelog from /usr/share/doc if possibleDavid Kalnischkies2016-02-115-2/+60
| | | | | | | | | | | If pkgAcqChangelog is told to acquire the changelog for a version it will check first if this version is installed on the disk and if so will use the local changelog in /usr/share/doc (possibily/likely gz compressed) instead of downloading the file from the web. An option is provided to disable this, which is enabled by default for the Ubuntu vendor as they truncate the local changelogs – and for apts --print-uris action.
* Release 1.2.31.2.3Julian Andres Klode2016-02-1057-3554/+2939
| | | | | Build system messed up the 1.2.2 commit by not updating the .po files properly, so they are now.
* test: use our special downloaded dir for 'source' resultDavid Kalnischkies2016-02-101-0/+2
| | | | | | | | | | | Otherwise the test run as root fails seeing the W: Can't drop privileges for downloading as file 'foo_1.tar.gz' couldn't be accessed by user '_apt'. - pkgAcquire::Run (13: Permission denied) warning in a command which isn't supposed to warn. One trivial test, two fixups and still counting… Git-Dch: Ignore
* accept any tarball compression in 814139 testcaseDavid Kalnischkies2016-02-101-2/+2
| | | | | | | | Travis still uses a dpkg version which defaults to gz and as which compression is picked isn't all to important as long as one is just accept any. Git-Dch: Ignore
* test that seeking to a position earlier in the file worksJulian Andres Klode2016-02-101-0/+12
| | | | | | This tests the fix for #812994, #813000 Gbp-Dch: ignore
* get dpkg lock in build-dep if cache was invalid againDavid Kalnischkies2016-02-103-6/+64
| | | | | | | | | | | | | | | | Regression introduced in a249b3e6fd798935a02b769149c9791a6fa6ef16, which in the case of an invalid cache would build the first part unlocked and later pick up the (still unlocked) cache for further processing, so the system got never locked and apt would end up complaining about being unable to release the lock at shutdown. The far more common case of having a valid cache worked as expected and hence covered up the problem – especially as tests who would have noticed it are simulations only, which do not lock. Closes: 814139 Reported-By: Balint Reczey <balint@balintreczey.hu> Reported-By: Helmut Grohne <helmut@subdivi.de> on IRC
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2026-05-14 23:36:56 +0000