summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Release 1.5~beta11.5_beta1Julian Andres Klode2017-07-0357-122/+128
|
* Russian translation updateАлексей Шилин2017-07-031-16/+17
|
* Stop bragging about old speeds in http.cc commentsJulian Andres Klode2017-07-031-8/+0
| | | | | | That's just ridiculous these days. Gbp-Dch: ignore
* formatter: support running from subdirectoriesDavid Kalnischkies2017-07-031-0/+1
| | | | Gbp-Dch: Ignore
* don't set ip addresses as server names for SNIDavid Kalnischkies2017-07-031-2/+12
| | | | | | | | | It is kinda unlikely that apt will ever encounter a certificate for an IP and a user actually using it, but the API documentation for gnutls_server_name_set explicitly says that "IPv4 or IPv6 addresses are not permitted to be set by this function.", so we should follow it. [jak@d.o: Slightly rebased]
* Swap file descriptors before the handshakeJulian Andres Klode2017-07-031-2/+4
| | | | | | | | | | This makes more sense. If the handshake failed midway, we still should run the gnutls bye stuff. The thinking here is to only set the fd after the session setup, as we do not modify it before, so if it fails in session setup, you retain a usable file descriptor. Gbp-Dch: ignore
* Do not error out, only warn if ca certificates are not availableJulian Andres Klode2017-07-031-5/+5
| | | | This probably makes more sense if Verify-Peer is set to off.
* tls: Add more details to error messages, and detect more errorsJulian Andres Klode2017-07-031-9/+11
| | | | | This should make it easier to figure out what was going on.
* travis/docker: Various improvementsJulian Andres Klode2017-07-022-3/+4
| | | | | | | | | | | - Use a tmpfs for /tmp - not really a benefit here, except for travis as it's writing less now. - Use the fastly CDN - about twice as fast as ftp.de, and seems more stable than cloudfront - Run apt-get clean to keep container smaller - should not be needed really, but let's just do it. Gbp-Dch: ignore
* Ignore download order in test-apt-update-failure-propagationJulian Andres Klode2017-07-011-17/+2
| | | | This caused spurious test failures.
* http: A response with Content-Length: 0 has no contentJulian Andres Klode2017-07-011-1/+4
| | | | | | APT considered any response with a Content-Length to have a body, even if the value of the header was 0. A 0 length body however, is equal to no body.
* Make Verify-Host and Verify-Peer independent againJulian Andres Klode2017-07-011-2/+2
| | | | | We can actually just pass null as a hostname, so let's just do that when Verify-Host is set to false.
* Upload 1.5~alpha4 to experimental1.5_alpha4Julian Andres Klode2017-06-305-6/+22
|
* shippable: Run tests in parallelJulian Andres Klode2017-06-301-2/+2
| | | | Gbp-Dch: ignore
* CMake: Do not allow FORCE_CURL=ON with WITH_CURL=OFFJulian Andres Klode2017-06-301-1/+4
| | | | | | | This makes no sense. We need both entries in the cache, as we check FORCE_CURL in the test suite. Gbp-Dch: ignore
* TLS support: Error out on unsupported curl optionsJulian Andres Klode2017-06-301-2/+4
| | | | | Silently ignoring the options might be a security issue, so produce an error instead.
* Improve closing the TLS connectionJulian Andres Klode2017-06-301-3/+3
| | | | | | | | | | If gnutls_session_bye() exited with an error, we never closed the underlying file descriptor, causing the method to think the connection was still open. This caused problems especially in test-partial-file-support where we checked that a "complete" file and an incomplete file work. The first GET returns a 416 with Connection: close, and the next GET request then accidentally reads the body of the 416 as the header for its own request.
* Switch to 'http' as the default https methodJulian Andres Klode2017-06-3011-15/+39
| | | | | The old curl based method is still available as 'curl', 'curl+http', and 'curl+https'.
* travis: Switch to DockerJulian Andres Klode2017-06-302-26/+23
| | | | | | | | | | | | | | | | | This runs parallel builds on docker, based on debian:testing docker images, with ccache enabled and parallel running of the test suite (ccache supports coverage builds these days, and parallel testing just needs unbuffer to handle the stty stuff) This is a huge step up from building on a mix of trusty, wily, and xenial. Most importantly, coverage now correctly detects partial covered lines instead of just reporting almost all of them as fully covered. We use ftp.de.debian.org as deb.debian.org backed by Amazon 503s too often. Gbp-Dch: ignore
* Allow http(s) and socks5h for http and https in proxy auto detectJulian Andres Klode2017-06-301-1/+16
| | | | This makes it possible to write sensible auto detect scripts.
* http: Add support for https:// proxiesJulian Andres Klode2017-06-301-3/+8
| | | | | | HTTPS proxies just require unwrapping the TLS layer at the proxy connection, that's easy, and of course sending proxy-specific headers that are sent on "http" proxies.
* http: Add support for CONNECT proxying to HTTPS locationsJulian Andres Klode2017-06-303-1/+132
| | | | | | | | | | | | | | | | | | | Proxying HTTPS traffic requires the proxy providing the CONNECT method. This implements the client side of it, although it is a bit hacky. HTTP connect is a normal HTTP CONNECT request, followed by a normal HTTP response, just that the body of the response is the TCP stream of the target host. We use a special wrapper in case there are data bytes in the header packets - in that case, the bytes are stored in a buffer and the buffer will be drained first, afterwards the connection continues directly with the TCP stream (with one more vcall). Also: Do not send full URI to https destinations when proxying, as we are directly interfacing with the destination data stream.
* Allow running the TLS stack on any lower connectionJulian Andres Klode2017-06-301-1/+19
| | | | | This is especially needed if we use an HTTPS proxy to CONNECT to an HTTPS URI, as we run TLS-inside-TLS then.
* Reset failure reason when connection was successfulJulian Andres Klode2017-06-302-2/+4
| | | | | | | | | | | | When APT was trying multiple addresses, any later error somewhere else would be reported with ConnectionRefused or ConnectionTimedOut as the FailReason because that was set by early connect attempts. This causes APT to handle the failures differently, leading to some weirdly breaking test cases (like the changed one). Add debugging to the previously failing test case so we can find out when something goes wrong there again.
* Upload 1.5~alpha3 to experimental1.5_alpha3Julian Andres Klode2017-06-3015-16/+23
|
* Don't read CaInfo if not specified (missing else)Julian Andres Klode2017-06-301-0/+1
| | | | | | | This fixes a regression from ~alpha2. Closes: #866559 Gbp-Dch: Full
* Upload 1.5~alpha2 to experimental1.5_alpha2Julian Andres Klode2017-06-2915-16/+35
|
* Build-Depend on debhelper (>= 10) to shut up lintianJulian Andres Klode2017-06-291-1/+1
|
* Bump Standards-Version (and wrap-and-sort a bit)Julian Andres Klode2017-06-291-3/+3
|
* http: Only use system CA store if CaInfo is not setJulian Andres Klode2017-06-291-7/+10
| | | | | It turns out that curl only sets the system trust store if the CaInfo option is not set, so let's do the same here.
* Demote gnupg to SuggestsJulian Andres Klode2017-06-291-1/+2
| | | | | stretch was the migration release for gpg->gpgv basically, so let's demote it now.
* Have apt Recommend ca-certificatesJulian Andres Klode2017-06-291-1/+1
| | | | | The http method needs ca-certificates for TLS support, so enable it.
* Improve error message if system CA store is emptyJulian Andres Klode2017-06-291-1/+4
| | | | | | Tell the user to install ca-certificates. Closes: #866377
* fix a "critical" typo in old changelog entryRobert Luberda2017-06-291-1/+1
| | | | | | | | | This typo exposes a bug in apt-listchanges that prevents commands like `apt-listchanges --show-all apt_*.deb' from showing the changelog. The bug will be fixed in next upload of apt-listchanges, but I think it would be nice have the typo fixed as well. Closes: 866358
* use port from SRV record instead of initial portDavid Kalnischkies2017-06-291-1/+5
| | | | | | | | | | | An SRV record includes a portnumber to use with the host given, but apt was ignoring the portnumber and instead used either the port given by the user for the initial host or the default port for the service. In practice the service usually runs on another host on the default port, so it tends to work as intended and even if not and apt can't get a connection there it will gracefully fallback to contacting the initial host with the right port, so its a user invisible bug most of the time.
* support tor+https being handled by httpDavid Kalnischkies2017-06-282-4/+18
| | | | | | The apt-transport-tor package operates via simple symlinks which can result in 'http' being called as 'tor+https', so it must pick up the right configuration pieces and trigger https support also in plus names.
* Upload 1.5~alpha1 to experimental1.5_alpha1Julian Andres Klode2017-06-2860-847/+3385
|
* Strip 0: epochs from the version hashJulian Andres Klode2017-06-282-0/+49
| | | | | | | This should fix some issues with dpkg normalizing such values. Suprisingly enough apt treats the Version: field the same, even with epoch vs without, but not when searching, and does not strip the 0: from the output.
* Merge branch 'feature/releaseinfochange'David Kalnischkies2017-06-2817-58/+416
|\
| * ask for releaseinfo change interactively in aptDavid Kalnischkies2017-06-286-13/+42
| | | | | | | | | | | | | | If we have a user sitting around we can let 'apt' ask the user for a confirmation rather than print errors at the end and require the user to figure out which commandline flags are needed to confirm the changes non-interactively.
| * allow frontends to override releaseinfo change behaviourDavid Kalnischkies2017-06-283-30/+105
| | | | | | | | | | | | | | | | Having messages being printed on the error stack and confirm them by commandline flags is an okayish first step, but some frontends will probably want to have a more interactive feeling here with a proper question the user can just press yes/no for as for some frontends a commandline flag makes no sense…
| * show a Release-Notes URI if infos were changedDavid Kalnischkies2017-06-285-2/+22
| | | | | | | | | | | | | | | | This gives the repository owner a chance to explain why this change was needed – e.g. explaining the organisational changes or simply detailing the changes in the new release made. Note that this URI is also shown if the change is accepted, so it also draws attention to release notes of minor updates (if users watch apt output closely).
| * error in update on Release information changesDavid Kalnischkies2017-06-2811-43/+277
|/ | | | | | | | | | | The value of Origin, Label, Codename and co can be used in user configuration from apts own pinning to unattended upgrades. A repository changing this values can therefore have serious effects on the behaviour of apt and other tools using these values. In a first step we will generate error messages for these changes now explaining the need for explicit confirmation and provide config options and commandline flags to accept them.
* fail instead of warn on insecure repositories in apt-getDavid Kalnischkies2017-06-286-19/+23
| | | | | | | | | The exception was made to give (script) users a one-release grace period to adapt their setup to deal with apt enforcing signing of repositories. As we are now at the start of a new release cycle its as good a time as any to lift it now. Removes-Exception: 952ee63b0af14a534c0aca00c11d1a99be6b22b2
* Merge branch 'feature/http-https'Julian Andres Klode2017-06-2819-272/+601
|\
| * Introduce Acquire::AllowTLS to turn off TLS supportJulian Andres Klode2017-06-283-0/+14
| | | | | | | | | | | | As requested by Henrique de Moraes Holschuh, here comes an option to disable TLS support. If the option is set to false, the internal TLS layer is disabled.
| * Fix test suite and enable non-curl testing on travis, shippableJulian Andres Klode2017-06-283-1/+8
| | | | | | | | Gbp-Dch: ignore
| * Fix https->http redirect issuesDavid Kalnischkies2017-06-282-8/+4
| | | | | | | | Gbp-Dch: ignore
| * methods: http: Drain pending data before selectingJulian Andres Klode2017-06-283-1/+20
| | | | | | | | | | | | | | | | GnuTLS can already have data pending in its buffers, we need to to drain that first otherwise select() might block indefinitely. Gbp-Dch: ignore
| * Allow building without curlJulian Andres Klode2017-06-283-7/+30
| | | | | | | | | | This makes testing easier and prepares us for the transition.
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-11-02 09:31:25 +0000