| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| |\ |
|
| | |
| |
| |
| |
| |
| |
| | |
Hand edit 2.7.14build2 to 2.7.14
The funny 999:0misbuilt version number gets auto-reduced to
the current version when building which is sad, but it works.
|
| | |
| |
| |
| | |
This allows merging symbol diffs from the various build logs
|
| |\ \
| |/
|/|
| |
| | |
methods: Add new sqv method
See merge request apt-team/apt!409
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Our goal is for each platform to have one blessed OpenPGP verification
system: Platforms that support sqv get sqv, platforms that don't get
gpgv. To do so we hardcode the architecture list at build time.
At build time we check if /usr/bin/sqv exists, which is the condition
that apt uses to see if it should build with sqv support.
We use a slight hack here to build with sqv on the official Debian
buildds but use gpgv on Ubuntu by abusing the fact that Ubuntu
resolves alternative build dependencies, and gpgv is installed
in the buildd image.
|
| | |
| |
| |
| |
| |
| |
| |
| | |
Many repositories still have SHA-1 self-signatures, and they are not
security relevant for APT repositories in the first place since we
do not use a web of trust model, but rather a set of trusted keyrings,
and the subkey can essentially be always considered trusted even if
it cannot be verified.
|
| |/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The new sqv method uses sequoia's sqv tool to verify files. The
tool's interface is quite simple: It returns 0 on success, and
prints one line per good signer with the fingerprint.
sqv has a configurable crypto policy. We have defined apt-specific
override mechanisms for sequoia's standard policy, allowing both
users, distributions, and apt package to provide overrides for
Sequoia's default policy in meaningful ways.
The sqv method will be built and be the standard method for
verifying OpenPGP signatures provided that `sqv` is in the
PATH during building. It is not built if there was no sqv
at build time, so you need a rebuild to enable sqv later
on.
On the flip side, the gpgv method is always built, but it
does need to be always built: If APT::Key::GPGVCommand is
set, we need to fallback to it - this is important to
support existing users of that interface such as
mmdebstrap. Also we want to fall back to it when /usr/bin/sqv
disappears - for example in our CI :D
A couple of concessions have been made for test suite purposes:
- Failure to split a clearsigned file only shows the summary,
as the gpgv method also only showed it, and no details why
it failed.
- We write "Got GOODSIG <fingerprint>" in debug mode to mimic
the gpgv code to keep the test suite happy.
- In various places in the test suite we assert minimal output
from sqv, but sqv's human output is not intended to be stable.
This will incur additional work when it breaks. However we do
not _parse_ the output, so actual operation of apt is unaffected.
A couple of things are suboptimal here:
- We are still doing clearsigned splitting ourselves. sqv only
has support for detached signatures right now, whereas sqopv
has support for clearsigned files as well (but sqopv does not
provide any reasons for why signature verification fails or
means to set a policy).
- Deprecation of algorithms happens on a timebomb basis in
sequoia. We have no means to give users warnings ahead of
time if their configuration is outdated.
We have implemented various bits that probably should be going away:
- Fallback to trusted.gpg
This is just annoying...
- Support for fingerprints in Signed-By (no subkey matching though)
The extra work here is arguably less compared to gpgv.
- Check the keyring for correctness.
With Signed-By everywhere, we should just error out rather than
skip broken keyrings.
Moo
|
| |\
| |
| |
| |
| | |
Switch to OpenSSL in a convoluted path of commits
See merge request apt-team/apt!412
|
| | |
| |
| |
| |
| | |
OpenSSL is mandatory now, it is no longer possible to build
without https support either.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Introduce an OpenSSL::Crypto backend for the hashes library
and an OpenSSL::SSL backend for the TLS support in our https
method.
Many thanks to curl for showing the way with how to handle
a CRL file. There are some memory leaks here with the
TlsFd itself as well as the proxy support; and we should
reorganize the code to generate the ssl object as late
as possible.
A peculiar aspect of OpenSSL is that SSL_has_pending() returns
1 even if SSL_read() will fail to read anything and return the
equivalent of EAGAIN. We work around this here by also peeking
ahead 1 byte. I was running a very high RTT connection from
Germany to Australia for testing, and with the peeking it's
using negligible amounts of CPU; before that, it was busy
looping at 100%. Bad OpenSSL!
|
| | |
| |
| |
| |
| |
| |
| | |
The GnuTLS backend avoids the need to link in libgcrypt, and
gets us another certified library people will be happy with.
This should be an intermediate step on the road to OpenSSL.
|
| | |
| |
| |
| | |
Everything is abstracted away now.
|
| | | |
|
| |/ |
|
| |\
| |
| |
| |
| | |
Use sq in the test suite, remove apt-key
See merge request apt-team/apt!413
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Remove the test case for MD5 and expired signatures, as we can't
create them (can't set signing digest, and can't set signature
expiry).
Tests for them have been added to test-method-gpgv instead.
We override sq in a function with cert-store and key-store
set to none.
This supports both sq 0.40 and sq 1.0.
|
| |/ |
|
| | |
|
| |
|
|
|
| |
Add new fields `APT-Pin`, `APT-Candidate`, and `APT-Release` to the
output, same as in EDSP (limited to one release for now).
|
| |
|
|
|
|
|
|
|
|
|
| |
There could be | or ; or other stuff in PAGER that needs
special handling, let's encode a list of known-good characters
instead. This covers all known pagers.
You could also try to execvp() PAGER in its entirety and if
it fails with ENOENT fall back to the shell but then you
don't get correct error handling if the pager really doesn't
exist (in which case we should abort trying to page).
|
| |\
| |
| |
| |
| | |
Introduce automatic pager for read commands
See merge request apt-team/apt!410
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Automatically show the output of `show`, `policy`, `list`,
`search`, `showsrc` in a pager.
The pager setup is inspired by git's pager setup. Notably,
the pager is found using APT_PAGER and PAGER variables.
We wait for the pager to be setup somewhat correctly by
using a notify pipe to figure out whether execvp() was
succesful - then the pipe will read EOF as the other end
got closed by CLOEXEC during exec - or not, then the pipe
will contain an errno.
We set up the correct handlers for signals and exit to close
the fds and wait for the pager. Notably inside the signal
handler we cannot flush our streams, only close them, so
there is some duplication.
We call the InitOutputPager() function from inside the
various Do...() functions rather than setting it up
generally in InitOutput(). Doing so allows us to first
render the progress without a pager, and then setup
the pager for the content only which improves user
experience.
When we setup a pager we also take care to disable
standard input, as we should not be prompting users
while a pager is running (the pager will be reading
from the tty directly). We do this by dup2-ing() a
/dev/null over it; if we just close()d the fd, another
open() might reuse the fd number and problems could
occur.
|
| |/
|
|
|
| |
This is a pretty standalone function, extract it for later
reuse.
|
| |
|
|
|
|
|
|
| |
We tried to access str.size() - 1 on a 0-sized string, which
does not work, and now that we build with assertions triggers
it.
Closes: #1090068
|
| | |
|
| |\
| |
| |
| |
| | |
Stop using apt-key for verification and move apt-key to test/
See merge request apt-team/apt!406
|
| | | |
|
| | |
| |
| |
| |
| |
| |
| | |
We move the user configuration section to the top of the manual
page as that is going to be what most are interested in and rewrite
it to cover all the modern ways to configure keys in a succinct
way.
|
| | | |
|
| |/ |
|
| |\
| |
| |
| |
| | |
gpgv: Merge all keyrings into a single one again
See merge request apt-team/apt!408
|
| |/
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
gpgv is quite picky, it takes at most 40 keyrings but it also doesn't
even take keyrings with : in the name, generating an ERROR message
instead.
So instead let's always merge the configured keyrings for the source
into a single one.
While we are at it, since we are merging now, let's also add some
rudimentary error checking to what we write into the merged keyring:
If copying into it fails, we should abort.
Reported-by: SuShY on IRC
|
| |
|
|
|
|
|
|
| |
Reimplement strict pinning by rejecting the non-candidates when
translating the problem from the depcache to the solver. This is
substantially better than restricting the list of alternatives for
an or group to only include allowed ones for debugging purposes,
albeit a bit slower.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We only compared candidate to installed version, but candidate
should dominate all versions, otherwise we end up in the fancy
problem of elpa-notmuch in
upgrade-noble-t64-remove-desktop-2024-03-29.edsp
Where we had three versions:
not-installable 0.38.3-1ubuntu1
candidate 0.38.2-1.1ubuntu2
installed 0.38.2-1ubuntu2
And received an ordering:
installed > non-installable > candidate
despite
candidate > installed
This is only visible with no-strict-pinning right now, as we are
otherwise filtering out invalid choices (and hence we only have
candidate and installed otherwise).
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
| |
We only ever documented .gpg and .asc and have ensured that
only such files exist in the keyring, but people can set the
Signed-By option to keys with any random extension, as that
was not validated before by apt-key.
This doesn't change the behavior for trusted.gpg.d: We filter
the directory listing and only look at .gpg and .asc files.
Closes: #1088656
|
| | |
|
| |\
| |
| |
| |
| | |
Stop using apt-key
See merge request apt-team/apt!407
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This gains us support for not using an absolute path, which
is nice, and we can now cache the invocation across fork() in
the method.
Still keep preferring absolute paths, this avoids execvp() having
to iterate the path and reduces bug potential with custom gpgv in
/usr/local.
Fix the last entry in the list of gpgvs to say gpgv1
|
| | | |
|
| | | |
|
| | | |
|
| | | |
|
| | |
| |
| |
| |
| |
| |
| |
| | |
Lifted from the dpkg mtree code that mjg59 submitted in
https://lists.debian.org/debian-dpkg/2018/05/msg00005.html
Which as dpkg is GPL-2.0+ also is GPL-2.0+
|
| | |
| |
| |
| |
| | |
This is a bit more overhead here, but if we need to build temporary
strings this is a lot cleaner.
|
| | | |
|
| | | |
|
| | | |
|
