summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Release 2.9.212.9.21Julian Andres Klode2025-01-016-7/+27
| | | | | | We updated po/ with libunistring 1.3 as before, but had no doc changes since the manual update with libunstring 1.2, so no churn there. Hooray.
* Run update-po4aJulian Andres Klode2025-01-0110-68/+200
| | | | With libunistring5 to avoid https://bugs.debian.org/1091871
* Unfuzzy documentation translationsJulian Andres Klode2025-01-0110-238/+238
| | | | | | | | | | | s#ftp://ftp.debian.org#ftp://example.org#g s#at ftp.debian.org#at ftp.example.org# s#debian-non-US/ stable/(non-US/)?#debian/ stable/#g s#debian-non-US/ unstable/(non-US/)?#debian/ unstable/#g s#stable/ Packages#stable/main Packages#g s#http://ftp.de.debian.org/debian,#http://deb.debian.org/debian,#g s#testing non-US#testing# s#ftp.debian.org#ftp.example.org#
* Merge branch 'improve-sqv-testsuite' into 'main'Julian Andres Klode2025-01-014-5/+7
|\ | | | | | | | | test: Check "${METHODSDIR}/sqv" not "/usr/bin/sqv" See merge request apt-team/apt!424
| * test: Check "${METHODSDIR}/sqv" not "/usr/bin/sqv"Julian Andres Klode2025-01-014-5/+7
|/ | | | | This is the correct check to find out whether we have built with sqv support.
* Merge branch 'openssl-directory' into 'main'Julian Andres Klode2025-01-011-1/+1
|\ | | | | | | | | http: seccomp: Allow reading directories See merge request apt-team/apt!421
| * http: seccomp: Allow reading directoriesJulian Andres Klode2025-01-011-1/+1
| | | | | | | | | | | | This is needed by OpenSSL. Closes: #1091351
* | Merge branch 'sqv-error-propagation' into 'main'Julian Andres Klode2025-01-012-5/+31
|\ \ | | | | | | | | | | | | sqv: Avoid propagating errors between files See merge request apt-team/apt!422
| * | sqv: Avoid propagating errors between filesJulian Andres Klode2025-01-012-5/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We inadvertently did not discard pending errors when the fallback to Dir::Etc::trusted succeeded, do so. Also add some quick safety checks to make sure we enter the verification in a good state, and that if somehow errors are pending after a verification we return false. Closes: #1091679
* | | Merge branch 'pu/obsolete-ftp' into 'main'Julian Andres Klode2025-01-019-28/+23
|\ \ \ | | | | | | | | | | | | | | | | Cleanup non-US and ftp references from code and documentation See merge request apt-team/apt!231
| * | | Use deb.debian.org instead of ftp.debian.org URLsGuillem Jover2024-12-284-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | While the ftp.debian.org URLs are still functional in Debian, they can confuse people as the protocol is mismatched. Using the deb.debian.org frontend should also generally give generally good performance regardless of the client location.
| * | | Remove obsolete references to ftp://ftp.debian.orgGuillem Jover2024-12-284-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Although Debian does not support FTP, this might still be used by other organizations, or local users, so replaced these instances with an example.org URL. Ref: https://lists.debian.org/debian-announce/2017/msg00001.html
| * | | Remove non-US leftovers in code and documentationGuillem Jover2024-12-284-12/+7
| | | | | | | | | | | | | | | | | | | | This has long been obsoleted, and there have been previous patches cleaning them up, but some left overs remained.
* | | | Merge branch 'v3-signatures' into 'main'Julian Andres Klode2025-01-011-0/+2
|\ \ \ \ | | |/ / | |/| | | | | | | | | | Extend v3 subkey expiry to 2026, owing to OBS use See merge request apt-team/apt!420
| * | | Extend v3 subkey expiry to 2026, owing to OBS useJulian Andres Klode2025-01-011-0/+2
|/ / / | | | | | | | | | | | | SUSE's Open Build Service is signing multiple repositories using v3 signing keys.
* | | Merge tag '2.9.20'Julian Andres Klode2024-12-287-34/+330
|\ \ \ | |/ / |/| / | |/ apt Debian release 2.9.20
| * Release 2.9.202.9.20Julian Andres Klode2024-12-285-6/+13
| |
| * Re-include std:: symbols in the symbols file as optional againJulian Andres Klode2024-12-282-28/+317
| | | | | | | | | | | | | | This will restore most of the symbols from before and ensure reverse dependencies not depending on new symbols can migrate. It also ensures we see any missing symbols.
* | Merge branch 'sources-suggest' into 'main'Julian Andres Klode2024-12-241-0/+10
|\ \ | |/ |/| | | | | sources.list(5): Suggest VENDOR.sources for new systems See merge request apt-team/apt!418
| * sources.list(5): Suggest VENDOR.sources for new systemsSimon McVittie2024-12-241-0/+10
|/ | | | | | | | | This matches the filename used by default in Ubuntu since Ubuntu 24.04, and in Debian cloud images and the Debian images provided by docker.io since Debian 12 (although not currently used in new installations via debian-installer). Signed-off-by: Simon McVittie <smcv@debian.org>
* symbols: Merge 2.9.19 and fix version for InsertErrnoJulian Andres Klode2024-12-231-2/+2
| | | | | | | | | | Somehow InsertErrno was wrongly formatted as symbol 0.8.11.4 1 and that caused dedup to miss-handle it. The 2.9.19 merge fixes that but kept "1" as the version, change it to say 0.8.11.4 instead.
* Release 2.9.192.9.19Julian Andres Klode2024-12-2349-546/+830
|
* Merge branch 'symbols'Julian Andres Klode2024-12-232-119/+280
|\
| * Symbols: Merge stable, noble, testing, unstableJulian Andres Klode2024-12-231-119/+74
| | | | | | | | | | | | | | Hand edit 2.7.14build2 to 2.7.14 The funny 999:0misbuilt version number gets auto-reduced to the current version when building which is sad, but it works.
| * abicheck: Add symbol-merge.py helperJulian Andres Klode2024-12-231-0/+206
| | | | | | | | This allows merging symbol diffs from the various build logs
* | Merge branch 'sqv' into 'main'Julian Andres Klode2024-12-2319-52/+465
|\ \ | |/ |/| | | | | methods: Add new sqv method See merge request apt-team/apt!409
| * debian: Plug sqv into the package buildJulian Andres Klode2024-12-224-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Our goal is for each platform to have one blessed OpenPGP verification system: Platforms that support sqv get sqv, platforms that don't get gpgv. To do so we hardcode the architecture list at build time. At build time we check if /usr/bin/sqv exists, which is the condition that apt uses to see if it should build with sqv support. We use a slight hack here to build with sqv on the official Debian buildds but use gpgv on Ubuntu by abusing the fact that Ubuntu resolves alternative build dependencies, and gpgv is installed in the buildd image.
| * debian: Add default policy to allow SHA-1 self-signatures until 2026Julian Andres Klode2024-12-222-0/+3
| | | | | | | | | | | | | | | | Many repositories still have SHA-1 self-signatures, and they are not security relevant for APT repositories in the first place since we do not use a web of trust model, but rather a set of trusted keyrings, and the subkey can essentially be always considered trusted even if it cannot be verified.
| * methods: Add new sqv methodJulian Andres Klode2024-12-2213-49/+456
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The new sqv method uses sequoia's sqv tool to verify files. The tool's interface is quite simple: It returns 0 on success, and prints one line per good signer with the fingerprint. sqv has a configurable crypto policy. We have defined apt-specific override mechanisms for sequoia's standard policy, allowing both users, distributions, and apt package to provide overrides for Sequoia's default policy in meaningful ways. The sqv method will be built and be the standard method for verifying OpenPGP signatures provided that `sqv` is in the PATH during building. It is not built if there was no sqv at build time, so you need a rebuild to enable sqv later on. On the flip side, the gpgv method is always built, but it does need to be always built: If APT::Key::GPGVCommand is set, we need to fallback to it - this is important to support existing users of that interface such as mmdebstrap. Also we want to fall back to it when /usr/bin/sqv disappears - for example in our CI :D A couple of concessions have been made for test suite purposes: - Failure to split a clearsigned file only shows the summary, as the gpgv method also only showed it, and no details why it failed. - We write "Got GOODSIG <fingerprint>" in debug mode to mimic the gpgv code to keep the test suite happy. - In various places in the test suite we assert minimal output from sqv, but sqv's human output is not intended to be stable. This will incur additional work when it breaks. However we do not _parse_ the output, so actual operation of apt is unaffected. A couple of things are suboptimal here: - We are still doing clearsigned splitting ourselves. sqv only has support for detached signatures right now, whereas sqopv has support for clearsigned files as well (but sqopv does not provide any reasons for why signature verification fails or means to set a policy). - Deprecation of algorithms happens on a timebomb basis in sequoia. We have no means to give users warnings ahead of time if their configuration is outdated. We have implemented various bits that probably should be going away: - Fallback to trusted.gpg This is just annoying... - Support for fingerprints in Signed-By (no subkey matching though) The extra work here is arguably less compared to gpgv. - Check the keyring for correctness. With Signed-By everywhere, we should just error out rather than skip broken keyrings. Moo
* Merge branch 'refactor-hashes' into 'main'Julian Andres Klode2024-12-2213-327/+374
|\ | | | | | | | | Switch to OpenSSL in a convoluted path of commits See merge request apt-team/apt!412
| * Remove GnuTLS and gcrypt supportJulian Andres Klode2024-12-228-471/+6
| | | | | | | | | | OpenSSL is mandatory now, it is no longer possible to build without https support either.
| * hashes, methods: Add OpenSSL backendsJulian Andres Klode2024-12-229-20/+409
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce an OpenSSL::Crypto backend for the hashes library and an OpenSSL::SSL backend for the TLS support in our https method. Many thanks to curl for showing the way with how to handle a CRL file. There are some memory leaks here with the TlsFd itself as well as the proxy support; and we should reorganize the code to generate the ssl object as late as possible. A peculiar aspect of OpenSSL is that SSL_has_pending() returns 1 even if SSL_read() will fail to read anything and return the equivalent of EAGAIN. We work around this here by also peeking ahead 1 byte. I was running a very high RTT connection from Germany to Australia for testing, and with the peeking it's using negligible amounts of CPU; before that, it was busy looping at 100%. Bad OpenSSL!
| * hashes: Add GnuTLS backend, make it defaultJulian Andres Klode2024-12-213-1/+71
| | | | | | | | | | | | | | The GnuTLS backend avoids the need to link in libgcrypt, and gets us another certified library people will be happy with. This should be an intermediate step on the road to OpenSSL.
| * hashes: Refactor backend into PrivateHashesJulian Andres Klode2024-12-211-55/+82
| | | | | | | | Everything is abstracted away now.
| * apt-helper: Add a hash-file helper to debug file hashingJulian Andres Klode2024-12-211-10/+41
| |
| * Remove gnupg and versioned gpgv test dependsJulian Andres Klode2024-12-202-6/+1
|/
* Merge branch 'replace-apt-key-sq' into 'main'Julian Andres Klode2024-12-1913-1433/+102
|\ | | | | | | | | Use sq in the test suite, remove apt-key See merge request apt-team/apt!413
| * Use sq in the test suite, remove apt-keyJulian Andres Klode2024-12-1911-964/+102
| | | | | | | | | | | | | | | | | | | | | | | | | | Remove the test case for MD5 and expired signatures, as we can't create them (can't set signing digest, and can't set signature expiry). Tests for them have been added to test-method-gpgv instead. We override sq in a function with cert-store and key-store set to none. This supports both sq 0.40 and sq 1.0.
| * Remove legacy apt-key testsJulian Andres Klode2024-12-192-469/+0
|/
* Release 2.9.182.9.18Julian Andres Klode2024-12-195-6/+20
|
* apt show: Add pinning information for --fullJulian Andres Klode2024-12-192-0/+15
| | | | | Add new fields `APT-Pin`, `APT-Candidate`, and `APT-Release` to the output, same as in EDSP (limited to one release for now).
* Be more strict about which PAGER to execvp() directlyJulian Andres Klode2024-12-192-1/+14
| | | | | | | | | | | There could be | or ; or other stuff in PAGER that needs special handling, let's encode a list of known-good characters instead. This covers all known pagers. You could also try to execvp() PAGER in its entirety and if it fails with ENOENT fall back to the shell but then you don't get correct error handling if the pager really doesn't exist (in which case we should abort trying to page).
* Merge branch 'pager' into 'main'Julian Andres Klode2024-12-1913-7/+322
|\ | | | | | | | | Introduce automatic pager for read commands See merge request apt-team/apt!410
| * Introduce automatic pager for read commandsJulian Andres Klode2024-12-1813-7/+322
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Automatically show the output of `show`, `policy`, `list`, `search`, `showsrc` in a pager. The pager setup is inspired by git's pager setup. Notably, the pager is found using APT_PAGER and PAGER variables. We wait for the pager to be setup somewhat correctly by using a notify pipe to figure out whether execvp() was succesful - then the pipe will read EOF as the other end got closed by CLOEXEC during exec - or not, then the pipe will contain an errno. We set up the correct handlers for signals and exit to close the fds and wait for the pager. Notably inside the signal handler we cannot flush our streams, only close them, so there is some duplication. We call the InitOutputPager() function from inside the various Do...() functions rather than setting it up generally in InitOutput(). Doing so allows us to first render the progress without a pager, and then setup the pager for the content only which improves user experience. When we setup a pager we also take care to disable standard input, as we should not be prompting users while a pager is running (the pager will be reading from the tty directly). We do this by dup2-ing() a /dev/null over it; if we just close()d the fd, another open() might reuse the fd number and problems could occur.
* | gpgv: Extract VerifyDetachedSignatureFile()Julian Andres Klode2024-12-171-73/+90
|/ | | | | This is a pretty standalone function, extract it for later reuse.
* Fix out-of-bounds read in `apt show :`Julian Andres Klode2024-12-162-0/+7
| | | | | | | | We tried to access str.size() - 1 on a 0-sized string, which does not work, and now that we build with assertions triggers it. Closes: #1090068
* Release 2.9.172.9.17Julian Andres Klode2024-12-0759-4013/+3210
|
* Merge branch 'bye-apt-key' into 'main'Julian Andres Klode2024-12-0715-338/+55
|\ | | | | | | | | Stop using apt-key for verification and move apt-key to test/ See merge request apt-team/apt!406
| * methods/gpgv: Remove apt-key mentionsJulian Andres Klode2024-12-072-5/+5
| |
| * Remove the apt-key manual page and add documentation to apt-secureJulian Andres Klode2024-12-076-273/+37
| | | | | | | | | | | | | | We move the user configuration section to the top of the manual page as that is going to be what most are interested in and rewrite it to cover all the modern ways to configure keys in a succinct way.
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2026-10-14 15:14:55 +0000