summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Release 1.8.0~alpha3.11.8.0_alpha3.1Julian Andres Klode2019-01-225-6/+13
|
* SECURITY UPDATE: content injection in http method (CVE-2019-3462)Julian Andres Klode2019-01-222-0/+72
| | | | | | | | | | | | | | | | | | This fixes a security issue that can be exploited to inject arbritrary debs or other files into a signed repository as followed: (1) Server sends a redirect to somewhere%0a<headers for the apt method> (where %0a is \n encoded) (2) apt method decodes the redirect (because the method encodes the URLs before sending them out), writting something like somewhere\n <headers> into its output (3) apt then uses the headers injected for validation purposes. Regression-Of: c34ea12ad509cb34c954ed574a301c3cbede55ec LP: #1812353 (cherry picked from commit 5eb01ec13f3ede4bae5e60eb16bd8cffb7c03e1b)
* Release 1.8.0~alpha31.8.0_alpha3Julian Andres Klode2018-12-1860-186/+552
|
* Merge branch 'pu/dpkg-path' into 'master'Julian Andres Klode2018-12-108-0/+67
|\ | | | | | | | | Set PATH=/usr/sbin:/usr/bin:/sbin:/bin when running dpkg See merge request apt-team/apt!38
| * Set PATH=/usr/sbin:/usr/bin:/sbin:/bin when running dpkgJulian Andres Klode2018-12-108-0/+67
| | | | | | | | | | | | | | | | | | This avoids a lot of problems from local installations of scripting languages and other stuff in /usr/local for which maintainer scripts are not prepared. [v3: Inherit PATH during tests, check overrides work] [v2: Add testing]
* | Merge branch 'pu/netrcparts' into 'master'Julian Andres Klode2018-12-045-13/+56
|\ \ | |/ |/| | | | | Add support for /etc/apt/auth.conf.d/*.conf (netrcparts) See merge request apt-team/apt!37
| * Add support for /etc/apt/auth.conf.d/*.conf (netrcparts)Julian Andres Klode2018-12-045-13/+56
|/ | | | | | | | | This allows us to install matching auth files for sources.list.d files, for example; very useful. This converts aptmethod's authfd from one FileFd to a vector of pointers to FileFd, as FileFd cannot be copied, and move operators are hard.
* Override FileFd copy constructor to prevent copyingJulian Andres Klode2018-12-041-0/+1
| | | | | FileFd could be copied using the default copy constructor, which does not work, and then causes code to crash.
* Merge branch 'bugfix/spaceinconfig' into 'master'Julian Andres Klode2018-12-044-3/+17
|\ | | | | | | | | Use quoted tagnames in config dumps See merge request apt-team/apt!32
| * Use quoted tagnames in config dumpsDavid Kalnischkies2018-11-294-3/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Tagnames in configuration can include spaces (and other nasties) e.g. in repository-specific configuration options due to Origin/Label potentially containing a space. The configuration file format supports parsing quoted as well as encoded spaces, but the output generated by apt-config and other places which might be feedback into apt via parsing (e.g. before calling apt-key in our gpgv method) do not quote and hence produce invalid configuration files. Changing the default to be an encoded tagname ensures that the output of dump can be used as a config file, but other users might not expect this so that is technically a backward-breaking change.
* | Merge branch 'remove_old_derivatives' into 'master'Julian Andres Klode2018-12-043-23/+0
|\ \ | | | | | | | | | | | | Remove old derivatives See merge request apt-team/apt!31
| * | Remove "Tanglu" config for Acquire::Changelogs and as vendorManuel A. Fernandez Montecelo2018-10-263-22/+0
| | | | | | | | | | | | | | | This is an inactive derivative according to the census, and all the URLs which are part of tanglu.org are dead.
| * | Remove "Ultimedia" config for Acquire::ChangelogsManuel A. Fernandez Montecelo2018-10-261-1/+0
| | | | | | | | | | | | | | | This is an inactive derivative according to the census, and all the URLs which are part of .ultimediaos.com are dead.
* | | Merge branch 'l10n-master' into 'master'Julian Andres Klode2018-12-041-51/+18
|\ \ \ | | | | | | | | | | | | | | | | [l10n] Update Italian translation See merge request apt-team/apt!35
| * | | [l10n] Update Italian translationMilo Casagrande2018-12-041-51/+18
| | |/ | |/| | | | | | | Signed-off-by: Milo Casagrande <milo@milo.name>
* | | Merge branch 'u-u-env-utf8' into 'master'Julian Andres Klode2018-12-041-1/+1
|\ \ \ | | | | | | | | | | | | | | | | Set LC_ALL=C.UTF-8 for unattended-upgrades environment when parsing its --help See merge request apt-team/apt!34
| * | | Set LC_ALL=C.UTF-8 for unattended-upgrades environment when parsing its --helpBalint Reczey2018-11-301-1/+1
| |/ / | | | | | | | | | | | | | | | | | | .UTF-8 sets stdio encoding to UTF-8 which may be ASCII on the system making unattended-upgrades crash. LP: #1806076
* | | Provide a "autopurge" shortcutJulian Andres Klode2018-12-035-2/+25
| | | | | | | | | | | | | | | | | | | | | This adds a new "autopurge" command that will is a shortcut for "autoremove --purge" Thanks: Michael Vogt for the initial work
* | | test-pdiff-usage: make transaction failure test case more robustJulian Andres Klode2018-12-031-1/+7
|/ / | | | | | | Try 10 times in a row
* | Fix typo reported by codespell in code commentsDavid Kalnischkies2018-11-2511-16/+16
| | | | | | | | | | | | | | | | No user visible change expect for some years old changelog entries, so we don't really need to add a new one for this… Reported-By: codespell Gbp-Dch: Ignore
* | Russian program translation updateАлексей Шилин2018-11-251-12/+8
| | | | | | | | | | Reviewed-By: Debian L10n Russian <debian-l10n-russian@lists.debian.org> Closes: #914096
* | Allow to override the directory of a request in aptwebserverDavid Kalnischkies2018-11-251-2/+9
| | | | | | | | | | | | | | | | | | The filename can be overridden, but sometimes it is useful to do it only for the directory-part of the filename – e.g. if you want to let a flat archive directory (like /var/cache/apt/archives) serve a pool-based request like /pool/a/apt_version.deb. Gbp-Dch: Ignore
* | Allow setting Referer header for http methodDavid Kalnischkies2018-11-252-0/+5
| | | | | | | | | | | | Not needed for common interactions, but for some download-file interactions it could be useful to set a specific referer as some servers do not serve requested files otherwise.
* | aptwebserver: Prevent XSS in debug and file listingDavid Kalnischkies2018-11-251-24/+36
| | | | | | | | | | | | | | | | | | | | | | We sometimes autogenerate HTML pages e.g. for listing files in a directory or for various error codes. If this would be a serious webserver this would be a security problem (althrough a bit hard to exploit), but as it is not shipped and intended to be used by our testcases only the world hasn't ended &amp; we can ignore it for changelog and fix it for brownie points. Gbp-Dch: Ignore
* | aptwebserver: Guess Content-Type from filename extensionDavid Kalnischkies2018-11-251-1/+85
| | | | | | | | | | | | | | | | | | | | Browsing pages served via aptwebserver is working better if we tell the browser the Content-Type which for this simple usecase we can just do by guessing based on the file extension – and because hardcoding a list would be boring we just reuse the mime.types data from mime-support if available and allow it to be overridden by files and config. Gbp-Dch: Ignore
* | Print useful error on "apt changelog" without argumentsJulian Andres Klode2018-11-212-1/+6
| | | | | | | | Fixes Debian/apt#77
* | Adjust libapt-pkg Breaks aptitude to << 0.8.9Julian Andres Klode2018-11-141-1/+1
| | | | | | | | | | | | | | The << 0.8.11 was stronger than necessary, and breaks Ubuntu, which is unable to build aptitude 0.8.11 atm (the test suite fails since 0.8.10 in C++17 mode, only works in C++14, but 0.8.11 uses C++17 constructs).
* | Release 1.8.0~alpha21.8.0_alpha2Julian Andres Klode2018-11-135-6/+16
| |
* | Drop debian/source/options, not needed anymoreJulian Andres Klode2018-11-131-2/+0
| |
* | Revert "http: Fix handling of server connection closure"Julian Andres Klode2018-11-131-3/+4
| | | | | | | | | | | | | | | | This reverts commit fb3f36593563d09a8d1727cc7c6deb0b49823ca2. It caused downloads to hang on long-lived connections on certain servers. Gbp-Dch: full
* | Release 1.8.0~alpha11.8.0_alpha1Julian Andres Klode2018-11-1213-97/+309
| |
* | http: Fix handling of server connection closureJulian Andres Klode2018-11-121-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | If the server closed the connection while we're reading data, and we end up not having any data left to write; that is, for example, we received 0 bytes, then we did not exit before, as we only returned success if there was data to write. This is wrong: Obviously, if we have reached our limit, we are done anyway. It's a bit unclear if we actually ever reached this part, but it does make some sense wrt the bug below. LP: #1801338
* | Norwegian Bokmål program translation updatePetter Reinholdtsen2018-10-301-25/+33
| | | | | | | | Closes: #912374
* | Fix typos encountered while updating de translationChris Leick2018-10-3016-49/+46
| |
* | German manpage translation updateChris Leick2018-10-302-900/+965
| | | | | | | | Reviewed-By: Helge Kreutzmann <debian@helgefjell.de>
* | Dutch manpage translation updateFrans Spiesschaert2018-10-302-31/+93
| | | | | | | | Closes: #912022
* | Dutch program translation updateFrans Spiesschaert2018-10-302-13/+11
|/ | | | Closes: #912021
* Break pre-gcc8 aptitude and aptJulian Andres Klode2018-10-221-1/+1
| | | | | | | | | | | | | gcc 8 broke the ABI again. After they decided to switch mangling of ABI tags in return values from: U URI::operator std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >[abi:cxx11]() to: U URI::operator std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >() in gcc 7, they now removed the legacy symbol in gcc 8, causing us to break our ABI in turn for that one operator. We need more responsible gcc developers. Closes: #911090
* NeverAutoRemove kernel meta packagesJulian Andres Klode2018-10-221-0/+2
| | | | | | | This gives more protection for people where kernel metapackages are accidentally removed. LP: #1787460
* Merge branch 'feature/subkeys' into 'master'Julian Andres Klode2018-10-1413-166/+383
|\ | | | | | | | | Support subkeys and multiple keyrings in Signed-By options See merge request apt-team/apt!27
| * Support multiple keyrings in sources.list Signed-ByDavid Kalnischkies2018-09-117-106/+194
| | | | | | | | | | | | | | A user can specify multiple fingerprints for a while now, so its seems counter-intuitive to support only one keyring, especially if this isn't really checked or enforced and while unlikely mixtures of both should work properly, too, instead of a kinda random behaviour.
| * Support subkeys properly in Signed-By optionsDavid Kalnischkies2018-09-119-61/+190
| | | | | | | | | | | | | | | | If we limit a file to be signed by a certain key it should usually accept also being signed by any of this keys subkeys instead of requiring each subkey to be listed explicitly. If the later is really wanted we support now also the same syntax as gpg does with appending an exclamation mark at the end of the fingerprint to force no mapping.
* | Merge branch 'master' into 'master'Julian Andres Klode2018-10-141-1/+6
|\ \ | | | | | | | | | | | | apt-get.8: mention --only-source in 'source' and 'build-dep' description See merge request apt-team/apt!24
| * | clarificationDamyan Ivanov2018-09-121-3/+4
| | | | | | | | | | | | | | | do not suggest that 'source' and 'build-dep' arguments are binary package names only
| * | apt-get.8: mention --only-source in 'source' and 'build-dep' descriptionDamyan Ivanov2018-08-091-1/+5
| | |
* | | Merge branch 'master' into 'master'Julian Andres Klode2018-10-144-5/+5
|\ \ \ | | | | | | | | | | | | | | | | Default to https: scheme for fetching Debian changelogs See merge request apt-team/apt!30
| * | | Default to https: scheme for fetching Debian changelogsBen Hutchings2018-10-134-5/+5
|/ / / | | | | | | | | | Closes: #910941
* | | Release 1.7.01.7.0Julian Andres Klode2018-10-0723-38/+58
| | |
* | | prepare-release: Fix last-modification detection for manpagesJulian Andres Klode2018-10-071-2/+3
| | | | | | | | | | | | | | | Pass -i to git log, so "Release foo" is detected as well, not just "release foo", and also handle the rename of Git-Dch to Gbp-Dch.
* | | Set DPKG_FRONTEND_LOCKED when running {pre,post}-invoke scriptsJulian Andres Klode2018-10-053-0/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | Some post-invoke scripts install packages, which fails because the environment variable is not set. This sets the variable for all three kinds of scripts {pre,post-}invoke and pre-install-pkgs, but we will only allow post-invoke at a later time. Gbp-Dch: full
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2024-06-02 07:54:23 +0000