summaryrefslogtreecommitdiff
path: root/apt-pkg/acquire-item.cc
Commit message (Collapse)AuthorAgeFilesLines
* reenable patchsize limit option for pdiffsDavid Kalnischkies2014-11-081-1/+1
| | | | | | | | One word: "doh!" Commit f6d4ab9ad8a2cfe52737ab620dd252cf8ceec43d disabled the check to prevent apt from downloading bigger patches than the index it tries to patch. Happens rarly of course, but still. Detected by scan-build complaining about a dead assignment. To make up for the mistake a test is included as well.
* Merge remote-tracking branch 'upstream/debian/experimental' into ↵Michael Vogt2014-11-061-74/+48
|\ | | | | | | | | | | | | feature/no-more-acquire-guessing Conflicts: apt-pkg/acquire-item.cc
| * Call "Dequeue()" for items in AbortTransaction() to fix raceMichael Vogt2014-11-041-0/+3
| | | | | | | | | | | | The pkgAcquire::Run() code works uses a while(ToFetch > 0) loop over the items queued for fetching. This means that we need to Deqeueue the item if we call AbortTransaction() to avoid a hang.
| * move permission changing from -item to -workerDavid Kalnischkies2014-10-261-42/+0
| | | | | | | | | | | | | | | | | | | | The worker is the part closest to the methods, which will call the item methods according to what it gets back from the methods, it is therefore a better place to change permissions as it is very central and can do it now at the point the item is assigned to a method rather than then it is queued for download (and as before while dequeued via Done/Failure). Git-Dch: Ignore
| * chown finished partial files earlierDavid Kalnischkies2014-10-231-50/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | partial files are chowned by the Item baseclass to let the methods work with them. Now, this baseclass is also responsible for chowning the files back to root instead of having various deeper levels do this. The consequence is that all overloaded Failed() methods now call the Item::Failed base as their first step. The same is done for Done(). The effect is that even in partial files usually don't belong to _apt anymore, helping sneakernets and reducing possibilities of a bad method modifying files not belonging to them. The change is supported by the framework not only supporting being run as root, but with proper permission management, too, so that privilege dropping can be tested with them.
* | Only support Translation-* that are listed in the {In,}Release fileMichael Vogt2014-10-291-115/+41
|/ | | | | | | | Handle Translation-* files exactly like Packages files (with the expection that it is ok if a download of them fails). Remove all "guessing" on apts side. This will elimimnate a bunch of errors releated to captive portals and similar. Its also more correct and removes another potential attack vector.
* use c++ style instead of the last two c-arraysDavid Kalnischkies2014-10-201-21/+21
| | | | Git-Dch: Ignore
* aborted reverify restores file owner and permissionDavid Kalnischkies2014-10-201-1/+5
| | | | | | | | | | If we get an IMS hit for an InRelease file we use the file we already have and pass it into reverification, but this changes the permissions and on abort of the transaction they weren't switched back. This is now done, additionally, every file in partial which hasn't failed gets permission and owner changed for root access as well, as it is very well possible that the next invocation will (re)use these files.
* run acquire transactions only onceDavid Kalnischkies2014-10-201-0/+2
| | | | | | | | | | Transactions are run and completed from multiple places, so it happens for unsigned repos that the Release file was commited even if it was previously aborted (due to --no-allow-insecure-repositories). The reason is simply that the "failure" of getting an InRelease/Release.gpg is currently ignored, so that the acquire process believes that nothing bad happened and commits the transaction even though the same transaction was previously aborted.
* mark --allow-insecure-repositories message as translateableDavid Kalnischkies2014-10-201-18/+15
| | | | | | | Refactors a bit to ensure the same message is used in all three cases as well. Git-Dch: Ignore
* ignore Acquire::GzipIndexes for cdrom sourcesDavid Kalnischkies2014-10-151-20/+27
| | | | | | We do not support compressed indexes for cdrom sources as we rewrite some of them, so supporting it correctly could be hard. What we do instead in the meantime is probably disabling it for cdrom sources.
* Merge branch 'debian/sid' into debian/experimentalDavid Kalnischkies2014-10-151-5/+5
|\ | | | | | | | | | | | | | | The acquire code changed completely, so this is more an import of the testcase and a new fix than the merge of an existent fix. Conflicts: apt-pkg/acquire-item.cc
| * don't cleanup cdrom files in apt-get updateDavid Kalnischkies2014-10-151-8/+7
| | | | | | | | | | | | | | | | | | | | Regression from merging 801745284905e7962aa77a9f37a6b4e7fcdc19d0 and b0f4b486e6850c5f98520ccf19da71d0ed748ae4. While fine by itself, merged the part fixing the filename is skipped if a cdrom source is encountered, so that our list-cleanup removes what seems to be orphaned files. Closes: 765458
* | do not load filesize in pkgAcqIndexTrans explicitlyDavid Kalnischkies2014-10-131-4/+0
| | | | | | | | | | | | | | | | The constructor is calling the baseclass pkgAcqIndex which does this already – and also does it correctly for compressed files which would overwise lead to the size of uncompressed files to be expected. Git-Dch: Ignore
* | fix compile and tests errorDavid Kalnischkies2014-10-131-4/+4
| | | | | | | | | | | | I am pretty sure I did that before committing broken stuff… Git-Dch: Ignore
* | Fix backward compatiblity of the new pkgAcquireMethod::DropPrivsOrDie()Michael Vogt2014-10-131-3/+9
| | | | | | | | | | | | | | | | Do not drop privileges in the methods when using a older version of libapt that does not support the chown magic in partial/ yet. To do this DropPrivileges() now will ignore a empty Apt::Sandbox::User. Cleanup all hardcoded _apt along the way.
* | trusted=yes sources are secure, we just don't know whyDavid Kalnischkies2014-10-131-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do not require a special flag to be present to update trusted=yes sources as this flag in the sources.list is obviously special enough. Note that this is just disabling the error message, the user will still be warned about all the (possible) failures the repository generated, it is just triggering the acceptance of the warnings on a source-by-source level. Similarily, the trusted=no flag doesn't require the user to pass additional flags to update, if the repository looks fine in the view of apt it will update just fine. The unauthenticated warnings will "just" be presented then the data is used. In case you wonder: Both was the behavior in previous versions, too.
* | display a warning for unsigned reposDavid Kalnischkies2014-10-131-0/+4
| | | | | | | | | | | | | | | | The same message is used for InRelease if fails in gpgv, but the Release/Release.gpg duo needs to handle the failing download case as well (InRelease just defers to the duo if download fails) and print a message accompaning the insecure error to provide a hint on what is going on.
* | make --allow-insecure-repositories message an errorDavid Kalnischkies2014-10-131-3/+3
| | | | | | | | | | | | | | Not using this option, but using unsigned (and co) repositories will cause these repositories to be ignored and data acquiring from them fails, so this is very well in the realms of an error and helps in making 'apt-get update' fail with a non-zero error code as well.
* | remove useless pdiff filename outputDavid Kalnischkies2014-10-101-4/+3
| | | | | | | | | | | | | | Looks like a leftover from debugging. Absolutely no need for it and destroys progess reporting completely. Closes: 764737
* | Only rename StatError files in AbortTransaction()Michael Vogt2014-10-081-4/+7
| | | | | | | | | | | | | | This fixes a race that we see in travis when two copy operations finish at about the same time but the bad one first. This lead to a rename of the good one and triggers a error when apt tries to verify the good version but can no longer find it.
* | pkgAcqArchive::QueueNext(): change owner/permission of DestFileMichael Vogt2014-10-081-1/+1
| | | | | | | | | | The code was using FinalFile before but we only test the existance of DestFile so we use that instead.
* | Send "Fail-Reason: MaximumSizeExceeded" from the methodMichael Vogt2014-10-071-1/+5
| | | | | | | | | | Communicate the fail reason from the methods to the parent and Rename() failed files.
* | Add new Acquire::MaxReleaseFileSize=10*1000*1000 optionMichael Vogt2014-10-071-27/+26
| | | | | | | | | | | | | | | | This option controls the maximum size of Release/Release.gpg/InRelease files. The rational is that we do not know the size of these files in advance and we want to protect against a denial of service attack where someone sends us endless amounts of data until the disk is full (we do know the size all other files (Packages/Sources/debs)).
* | Merge remote-tracking branch 'upstream/debian/experimental' into ↵Michael Vogt2014-10-071-169/+297
|\ \ | | | | | | | | | | | | | | | | | | feature/acq-trans Conflicts: apt-pkg/acquire-item.cc
| * | support parsing of all hashes for pdiffDavid Kalnischkies2014-09-301-139/+271
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The fileformat of a pdiff index stores currently only SHA1 hashes. With this change, we look for all other hashes we support as well and take what we get, so that we can work after the release of jessie to get right of SHA1 if we want to. Note that the completely patched file is and was checked against the hashes collected from the Release file, so this transition isn't mission critical.
* | | UpperCase some functions for consistencyMichael Vogt2014-10-071-25/+25
| | | | | | | | | | | | | | | | | | | | | | | | changeOwnerAndPermissionOfFile->ChangeOwnerAndPermissionOfFile preparePartialFile->GetPartialFileName preparePartialFileFromURI->GetPartialFileNameFromURI Git-Dch: ignore
* | | display errortext for all Err as well as Ign logsDavid Kalnischkies2014-10-071-41/+36
| | | | | | | | | | | | | | | | | | | | | consistently using Item::Failed in all specializec classes helps setting up some information bits otherwise unset, so some errors had an empty reason as an error. Ign is upgraded to display the error message we ignored to further help in understanding what happens.
* | | use _apt:root only for partial directoriesDavid Kalnischkies2014-10-071-54/+79
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Using a different user for calling methods is intended to protect us from methods running amok (via remotely exploited bugs) by limiting what can be done by them. By using root:root for the final directories and just have the files in partial writeable by the methods we enhance this in sofar as a method can't modify already verified data in its parent directory anymore. As a side effect, this also clears most of the problems you could have if the final directories are shared without user-sharing or if these directories disappear as they are now again root owned and only the partial directories contain _apt owned files (usually none if apt isn't running) and the directory itself is autocreated with the right permissions.
* | | fixup foldmarkers in acquire-item.ccDavid Kalnischkies2014-10-071-91/+51
| | | | | | | | | | | | Git-Dch: Ignore
* | | fix warningsMichael Vogt2014-10-061-3/+3
| | |
* | | rename StopAuthentication -> CheckStopAuthentication and make it protectedMichael Vogt2014-10-061-4/+7
| | |
* | | rename AuthDone() -> CheckAuthDone()Michael Vogt2014-10-061-5/+3
| | |
* | | cleanup pkgAcq*::Failed()Michael Vogt2014-10-061-62/+51
| | |
* | | add missing TransactionStageCopy() in pkgAcqDiffIndex::Done()Michael Vogt2014-10-061-12/+5
| | |
* | | Rework pkgAcqMeta{Index,Sig,ClearSig}::Done() for readabilityMichael Vogt2014-10-061-180/+92
| | | | | | | | | | | | | | | | | | Move common code out but do not use subclassing for ::Done to make it easier to understand what each class is doing when its done
* | | fix incorrect docstrings for ↵Michael Vogt2014-10-061-2/+2
| | | | | | | | | | | | AcqMetaBase::TransactionStageRemoval/AcqMetaBase::TransactionStageCopy
* | | add new "SetActiveSubprocess()Michael Vogt2014-10-061-46/+19
| | |
* | | really do not download Release if InRelease does not verifyMichael Vogt2014-10-031-20/+24
| | |
* | | cleanup around pkgAcqMetaSig and improved testsMichael Vogt2014-10-021-47/+44
| | |
* | | add a bunch of docstrings etcMichael Vogt2014-10-021-12/+36
| | |
* | | fix crashMichael Vogt2014-10-021-8/+12
| | |
* | | donkults fixesMichael Vogt2014-10-021-37/+28
| | |
* | | Cleanup pkgAcqIndexMichael Vogt2014-10-021-110/+138
| | |
* | | refactor and add pkgAcqIndex::ValidateFile()Michael Vogt2014-10-011-21/+34
| | |
* | | fix leftover files from Acquire::GzipIndexMichael Vogt2014-10-011-1/+1
| | |
* | | hack around test-apt-update-unauth failureMichael Vogt2014-10-011-0/+9
| | |
* | | update test/integration/test-releasefile-verificationMichael Vogt2014-10-011-9/+9
| | |
* | | Use Acquire::Allow{InsecureRepositories,DowngradeToInsecureRepositories}Michael Vogt2014-10-011-11/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The configuration key Acquire::AllowInsecureRepositories controls if apt allows loading of unsigned repositories at all. The configuration Acquire::AllowDowngradeToInsecureRepositories controls if a signed repository can ever become unsigned. This should really never be needed but we provide it to avoid having to mess around in /var/lib/apt/lists if there is a use-case for this (which I can't think of right now).
* | | add verify for the .diff/Index download and add FIXME for ↵Michael Vogt2014-10-011-0/+19
| | | | | | | | | | | | pkgAcqIndexDiffs/pkgAcqMergeDiffs
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2026-11-13 10:09:41 +0000