summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* avoid validate/delete/load race in cache generationDavid Kalnischkies2017-01-191-28/+31
| | | | | | | Keeping the Fd of the cache file we have validated around to later load it into the mmap ensures not only that we load the same file (which wouldn't really be a problem in practice), but that this file also still exists and wasn't deleted e.g. by a 'apt clean' call run in parallel.
* don't lock dpkg in update commandsDavid Kalnischkies2017-01-191-2/+2
| | | | | | | | | | The update command acquires a lock on lists/, but at the end it will also require the dpkg/lock while building the binary caches. That seems rather pointless as we are only reading those files, not causing writing in them. This can also cause problems if a package installation is running and a background process (like cron) starts an update: If you are "lucky" enough the update process will pick the dpkg lock in between apt calls causing the installation process to fail.
* don't lock dpkg in 'apt-get clean'David Kalnischkies2017-01-191-1/+1
| | | | | | We get the archives/lock for clean – that is enough to ensure that other apt instances aren't interfering (or are being interfered with). We don't need to block actions involving dpkg.
* don't show update stats if cache generation is disabledDavid Kalnischkies2017-01-192-6/+7
| | | | | | Unlikely that anyone is actually running into this, but if we asked to not generate a cache and avoid it in the first step we shouldn't create one implicitly anyway by displaying the statistics.
* test: use downloadfile instead of apthelper download-fileJulian Andres Klode2017-01-171-4/+4
| | | | | | | This prevents CI failures from happening in 1.3 and 1.2 and might actually be more complete. Gbp-Dch: ignore
* Release 1.4~beta41.4_beta4Julian Andres Klode2017-01-1715-16/+26
| | | | | | | We are basically frozen now, but (a) this wildcard thing is a bit "explosive" to call this RC and (b) you never know if you might need to add a new tiny feature and freeze can be long...
* Update symbols file for changes in 1.3.1, 1.4~beta{1,3,4}Julian Andres Klode2017-01-171-0/+6
| | | | | | This is very important stuff, especially for the ParseDepends thingy as otherwise a new python-apt build would always require the apt it was built against instead of 1.4~beta3.
* CMake: Document that the globs are expanded during CMakeJulian Andres Klode2017-01-175-4/+15
| | | | | | | This will avoid people from thinking that they have to do nothing when they change the set of files. Gbp-Dch: ignore
* https: Quote path in URL before passing it to curlJulian Andres Klode2017-01-172-0/+23
| | | | | | | | | | | | | | | | | | | | | | | Curl requires URLs to be urlencoded. We are however giving it undecoded URLs. This causes it go completely nuts if there is a space in the URI, producing requests like: GET /a file HTTP/1.1 which the servers then interpret as a GET request for "/a" with HTTP version "file" or some other non-sense. This works around the issue by encoding the path component of the URL. I'm not sure if we should encode other parts of the URL as well, this one seems to do the trick for the actual issue at hand. A more correct fix is to avoid the dequoting and (re-)quoting of URLs when a redirect occurs / a new request is sent. That's been on the radar for probably a year or two now, but nobody bothered implementing that yet. LP: #1651923
* CMake: Find the Perl executable, and use it to run perl scriptsJulian Andres Klode2017-01-172-2/+4
| | | | | | | | This is somewhat more portable than just hardcoding perl or in the triehash case /usr/bin/perl in the shebang. Thanks: Guillem Jover for the hint Gbp-Dch: ignore
* Read dpkg tables to handle architecture wildcardsJulian Andres Klode2017-01-177-51/+246
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Our implementation of wildcards was rudimentary. It worked for some common ones, but it was also broken: For example, armel matched any-armel, but should match any-arm. With this commit, we load the correct tables from dpkg. Supported are both triplets and quadruplet tables (the latter introduced in dpkg 1.18.11). There are some odd things we have to deal with in the cache filter for historical and API reasons: * The character "*" must be accepted as an alternative to any - in fact it may appear anywhere in the wildcard as we also allow fnmatch() style wildcard matching on the commandline. * The code might get passed an arch with a minus at the end, for example the cmdline "install apt:any-arm-" will first try to check if any-arm- is a valid architecture. We deal with this by rejecting any wildcard ending in a minus. * Triplets are actually implemented by extending them to faux quadruplets - by prepending a "base" component for the architecture tuple, and "any" if there is a wildcard component. Once we have constructed a wildcard, it is transformed into an fnmatch() expression for historical reasons. In the future, we should really get a tuple class and implement matching in a better, more explicit way. This does for now though - it passes all the test cases and accepts all things it should accept. Closes: #748936 Thanks: James Clarke <jrtc27@jrtc27.com> for the initial patch
* strutl: Provide an APT::String::Join() functionJulian Andres Klode2017-01-172-0/+14
| | | | | Thanks: James Clarke <jrtc27@jrtc27.com> for the implementation Gbp-Dch: ignore
* Release 1.4~beta31.4_beta3Julian Andres Klode2017-01-0558-2159/+2190
|
* Run parsedepends_test for two different native archsJulian Andres Klode2017-01-021-40/+43
| | | | | | | Run the test for kfreebsd-i386 and amd64 and pass "amd64" as an additional argument to the function. This tests that the argument is used and thus ParseDepends returns the amd64 results even on a different architecture like i386.
* ParseDepends: Support passing the desired architectureNiels Thykier2017-01-022-3/+36
| | | | | | | | | | | This is useful for e.g. Britney, where the Build-Depends would have to be parsed for multiple architectures. With this change, the call can choose the architecture without having to mess with the config. Signed-off-by: Niels Thykier <niels@thykier.net> Closes: #845969 (jak@d.o: made the code compile)
* allow warning generation for non-whitelisted optionsDavid Kalnischkies2016-12-314-247/+688
| | | | | | | | | | | | | | | The idea is simple: Each¹ Find*( call starts with a call check if the given option (with the requested type) exists in the whitelist. The whitelist is specified via our configure-index file so that we have a better chance at keeping it current. the whitelist is loaded via a special (undocumented for now) configuration stanza and if none is loaded the empty whitelist will make it so that no warnings are shown. Much needs to be done still, but that is as good a time as any to take a snapshot of the current state and release it into the wild given that it found some bugs already and has no practical effect on users. ¹ not all in this iteration, but many
* fix minimum pkgs option for dpkg --recursive usageDavid Kalnischkies2016-12-311-1/+1
| | | | | | Interpreting a boolean as an int works just fine – it just hasn't the intended result – it isn't a serious problem through as the disabling of the usage of this dpkg calling style is just an "optimization"
* apt-key: ignore gpg1 already imported secret key import failureDavid Kalnischkies2016-12-311-2/+5
| | | | | | | | | | | | On Travis and co the default gpg implementation is gpg1 which for some reason fails if a secret key which was already imported is imported again. We would prefer it to be a NOP like gpg2 handles it so we crudely check the error message. apt-key usually doesn't deal with secret keys – it only learned to do it for manual testing and the integration framework usage, so no public interface is effected. Triggered-By: 4ce2f35248123ff2366c8c365ad6a94945578d66 Gbp-Dch: Ignore
* use FindB instead of FindI for Debug::pkgAutoRemoveDavid Kalnischkies2016-12-312-2/+2
| | | | | | | | Again no practical difference, but for consistency a boolean option should really be accessed via a boolean method rather than an int especially if you happen to try setting the option to "true" … Gbp-Dch: Ignore
* avoid producing invalid options if repo has no hostDavid Kalnischkies2016-12-311-2/+5
| | | | | | | | This can happen e.g. for file: repositories. There is no inherent problem with setting such values internally, but its bad style, forbidden in the manpage and could be annoying in the future. Gbp-Dch: Ignore
* gets file location via FindFile instead of manual mergeDavid Kalnischkies2016-12-311-5/+6
| | | | | | | Unlikely to have any practical effect, but its more consistent to use the right methods instead of performing it slightly incorrect by hand. Gbp-Dch: Ignore
* rename ServerMethod to BaseHttpMethodDavid Kalnischkies2016-12-317-45/+45
| | | | | | | This 'method' is the abstract base for http and https and should as such be called out like this rather using an easily confused name. Gbp-Dch: Ignore
* separating state variables regarding server/requestDavid Kalnischkies2016-12-316-226/+211
| | | | | | | | | | | | | | Having a Reset(bool) method to partially reset certain variables like the download size always were strange, so this commit splits the ServerState into an additional RequestState living on the stack for as long as we deal with this request causing an automatic "reset". There is much to do still to make this code look better, but this is a good first step which compiles cleanly and passes all tests, so keeping it as history might be beneficial and due to avoiding explicit memory allocations it ends up fixing a small memory leak in https, too. Closes: #440057
* expand -f to --fix-broken in error messagesDavid Kalnischkies2016-12-3160-1034/+1081
| | | | | | | | | | | | | | | | | | | | Users end up believing that this is a --force mode as -f is common for that, but apt doesn't have such a mode and --fix-broken is really not about forcing something but actually trying to fix the breakage which tends to be the result of a user forcing something on its system via low-level forced dpkg calls. Example: The "common" pattern of "dpkg -i ./foo.deb; apt install -f" is nowadays far better dealt with via "apt install ./foo.deb". And while at it the two places handing out this suggestion are changed to use the same strings to avoid needless translation work in the future and the suggestion uses 'apt' instead of 'apt-get' as this will be run interactively by a user, so its a good opportunity to showcase what we can do and will allow us to be more helpful to the user. Closes: #709092 Thanks: Kristian Glass for initial patch!
* allow default build-essentials to be overriddenDavid Kalnischkies2016-12-312-7/+65
| | | | | | | | | The config list APT::Build-Essential gets a similar treatment to other lists now by having the value of the option itself be an override for the list allowing to disable build-essentials entirely as well as adding/overriding as usual by now in other lists. Reported-By: Johannes 'josch' Schauer on IRC
* add --indep-only for build-dep commandDavid Kalnischkies2016-12-314-2/+30
| | | | | | | | The implementation is quite different compared to --arch-only due to ABI reasons but functionality wise they are similar and usually both available for symmetry at least. Closes: #845775
* ensure generation of valid EDSP error stanzasDavid Kalnischkies2016-12-312-3/+16
| | | | | | | | | The crude way of preparing a message to be a multiline value failed at generation valid deb822 in case the error message ended with a new line like the resolving errors from apt do. apt itself can parse these, but other tools like grep-dctrl choke on it, so be nice and print valid. Reported-By: Johannes 'josch' Schauer on IRC
* Dutch manpages translation updateFrans Spiesschaert2016-12-311-14/+20
| | | | Closes: #849235
* do not generate Maximum-Size if we already have that fieldDavid Kalnischkies2016-12-311-3/+5
| | | | | | | Any respective parser will do the right thing and grab the last value, but its better for style to generate that field only once. Gbp-Dch: Ignore
* warn if clearsigned file has ignored content partsDavid Kalnischkies2016-12-315-4/+377
| | | | | | | | | | | | | Clearsigned files like InRelease, .dsc, .changes and co can potentially include unsigned or additional messages blocks ignored by gpg in verification, but a potential source of trouble in our own parsing attempts – and an unneeded risk as the usecases for the clearsigned files we deal with do not reasonably include unsigned parts (like emails or some such). This commit changes the silent ignoring to warnings for now to get an impression on how widespread unintended unsigned parts are, but eventually we want to turn these into hard errors.
* tests: cache the apt-key homedir used for Release signingDavid Kalnischkies2016-12-213-14/+56
| | | | | | | | | Importing a new secret key into gpg(2) can be increadibly slow which prolongs the test runs significantly – by caching the homedir we gain a significant speedbonus as reimporting already present keys seems like a far less costly operation. Git-Dch: Ignore
* Catalan program translation updateOriol Debian2016-12-161-750/+353
| | | | Closes: #846514
* default to --no-check for dpkg-source callDavid Kalnischkies2016-12-161-1/+1
| | | | | | | | | | | | | | | In bug #757534 the opposite direction was initially requested, but what we did end up with was having a possibility to configure the options passed to dpkg. The reasoning given their and in #724744 is specific why apt doesn't need the checks to be performed by dpkg. In fact, what these two reports show is that if those checks are run people end up being confused about the requirement of them being run, so given the best case those checks can do is do nothing (visibly) while the worst cases are warnings and errors which are neither we are from a security point better of with disabling them – as (as mentioned in the bugreports) false positives for issues are really really bad in a security context. Closes: 724744
* remove needless fork() in apt-get sourceDavid Kalnischkies2016-12-161-66/+62
| | | | | | | | We are calling system() in this code paths, so all we do here is having a single child performing the action while the parent waits for it to finish… with the added strangeness of not having our usual error message collection and giving up after first failure even if told to act on multiple packages.
* let {dsc,tar,diff}-only implicitly enable download-onlyDavid Kalnischkies2016-12-163-10/+6
| | | | | | That was the case already for tar-only and diff-only, but in a more confusing way and without a message while dsc "worked" before resulting in a dpkg-source error shortly after as tar/diff files aren't available…
* reword "Can't drop priv" warning messageDavid Kalnischkies2016-12-161-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Note: This is a warning about disabling a security feature. It is supposed to be scary as we are disabling a security feature and we can't just be silent about it! Downloads really shouldn't happen any longer as root to decrease the attack surface – but if a warning causes that much uproar, consider what an error would do… The old WARNING message: | W: Can't drop privileges for downloading as file 'foobar' couldn't be | accessed by user '_apt'. - pkgAcquire::Run (13: Permission denied) is frequently (incorrectly) considered to be an error message indicating that the download didn't happen which isn't the case, it was performed, but without all the security features enabled we could have used if run from some other place… The word "unsandboxed" is chosen as the term 'sandbox(ed)' is a common encounter in feature lists/changelogs and more people are hopefully able to make the connection to 'security' than it is the case for 'privilege dropping' which is more correct, but far less known. Closes: #813786 LP: #1522675
* Merge pull request Debian/apt#31 from paperlessreceipts/https-forceipvJulian Andres Klode2016-12-131-0/+5
|\ | | | | | | Honour Acquire::ForceIPv4/6 in the https transport
| * Honour Acquire::ForceIPv4/6 in the https transportLukasz Kawczynski2016-12-081-0/+5
| |
* | Release 1.4~beta2 security update1.4_beta2Julian Andres Klode2016-12-081-2/+2
| |
* | releasing package apt version 1.4~beta2Julian Andres Klode2016-12-0814-15/+29
| |
* | gpgv: Flush the files before checking for errorsJulian Andres Klode2016-12-081-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a follow up to the previous issue where we did not check if getline() returned -1 due to an end of file or due to an error like memory allocation, treating both as end of file. Here we ensure that we also handle buffered writes correctly by flushing the files before checking for any errors in our error stack. Buffered writes themselves were introduced in 1.1.9, but the function was never called with a buffered file from inside apt until commit 46c4043d741cb2c1d54e7f5bfaa234f1b7580f6c which was first released with apt 1.2.10. The function is public, though, so fixing this is a good idea anyway. Affected: >= 1.1.9
* | SECURITY UPDATE: gpgv: Check for errors when splitting files (CVE-2016-1252)Julian Andres Klode2016-12-081-1/+22
|/ | | | | | | | | | | | | | | | | | | | | This fixes a security issue where signatures of the InRelease files could be circumvented in a man-in-the-middle attack, giving attackers the ability to serve any packages they want to a system, in turn giving them root access. It turns out that getline() may not only return EINVAL as stated in the documentation - it might also return in case of an error when allocating memory. This fix not only adds a check that reading worked correctly, it also implicitly checks that all writes worked by reporting any other error that occurred inside the loop and was logged by apt. Affected: >= 0.9.8 Reported-By: Jann Horn <jannh@google.com> Thanks: Jann Horn, Google Project Zero for reporting the issue LP: #1647467
* bash-completion: Only complete understood file paths for installJohn R. Lenton2016-11-301-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previouosly apt's bash completion was such that, given $ mkdir xyzzz $ touch xyzzy.deb xyzzx.two.deb you'd get $ apt install xyzz<tab> xyzzx.two.deb xyzzz/ $ apt install /tmp/foo/xyzz<tab> xyzzx.two.deb xyzzz/ this is inconsistent (xyzzx.two.deb is listed but not xyzzy.deb), but worse than that it offered things that apt would not actually recognise as candidates for install: $ sudo apt install xyzzx.two.deb Reading package lists... Done Building dependency tree Reading state information... Done E: Unable to locate package xyzzx.two.deb E: Couldn't find any package by glob 'xyzzx.two.deb' E: Couldn't find any package by regex 'xyzzx.two.deb' With this small (trival, really) change, apt's bash completion will only offer things apt understands, and won't recquire an aditional period in the filename to offer it: $ apt install xyzz<tab>^C $ # (no completions!) $ apt install ./xyzz<tab> xyzzx.two.deb xyzzy.deb xyzzz/ $ apt install /tmp/foo/xyzz xyzzx.two.deb xyzzy.deb xyzzz/ fixes #28 LP: #1645815
* Release 1.4~beta11.4_beta1Julian Andres Klode2016-11-2564-210/+622
|
* Add apt-pkg/tagfile-keys.cc to the gitignore fileJulian Andres Klode2016-11-251-0/+1
| | | | | | This is output of triehash. Gbp-Dch: ignore
* gpgv: Untrust SHA1, RIPE-MD/160, but allow downgrading to weakJulian Andres Klode2016-11-252-4/+22
| | | | | | | Change the trust level check to allow downgrading an Untrusted option to weak (APT::Hashes::SHA1::Weak "yes";), so it prints a warning instead of an error; and change the default values for SHA1 and RIPE-MD/160 from Weak to Untrusted.
* show output as documented for APT::Periodic::Verbose 2Paul Wise2016-11-251-2/+2
| | | | | | | | The documentation of APT::Periodic::Verbose doesn't match the code, specifically level 2 should apply some things differently to level 1 but does not because it uses `-le 2` instead of `-lt 2` or `-le 1`. Closes: 845599
* optional write aptwebserver log to client specific filesDavid Kalnischkies2016-11-259-96/+200
| | | | | | | | | | | | The test test-handle-redirect-as-used-mirror-change serves multiple clients at the same time, so the order of the output is undefined and once in a while the two clients will intermix their lines causing the grep we perform on it later to fail making our tests fail. Solved by introducing client-specific logfiles which we all grep and sort the result to have the results more stable. Git-Dch: Ignore
* follow the googletest merge in build-dependsDavid Kalnischkies2016-11-252-3/+5
|
* get pdiff files from the same mirror as the indexDavid Kalnischkies2016-11-253-36/+52
| | | | | | | | | | | In ad9416611ab83f7799f2dcb4bf7f3ef30e9fe6f8 we fall back to asking the original mirror (e.g. a redirector) if we do not get the expected result. This works for the indexes, but patches are a different beast and much simpler. Adding this fallback code here seems like overkill as they are usually right along their Index file, so actually forward the relevant settings to the patch items which fixes pdiff support combined with a redirector and partial mirrors as in such a situation the pdiff patches would be 404 and the complete index would be downloaded.
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-11-02 04:29:16 +0000