summaryrefslogtreecommitdiff
path: root/apt-pkg/acquire-item.cc
Commit message (Collapse)AuthorAgeFilesLines
...
| | * | Fix regression for cdrom: sources from latest security updateMichael Vogt2014-09-211-0/+6
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | Skip a reverify for cdrom: sources. The reverify step is actually harmful here because the apt-cdrom add code uses the indexcopy.cc which will "normalize" the Packages file from the cdrom when it writes it to the local disk. This leads to changing the "MD5sum" field (notice the lower case "s") on the cdrom Packages file to a "MD5Sum" field on the local file in /var/lib/apt/lists. Which of course alters the hash and makes apt fail to reverify the file.
| | * improve test for commit daff4aMichael Vogt2014-09-171-2/+3
| | |
| | * Fix regression for file:/// uris from CVE-2014-0487Michael Vogt2014-09-171-12/+6
| | | | | | | | | | | | | | | | | | | | | | | | Do not run ReverifyAfterIMS() for local file URIs as this will causes apt to mess around in the file:/// uri space. This is wrong in itself, but it will also cause a incorrect verification failure when the archive and the lists directory are on different partitions as rename().
| | * SECURITY UPDATE for CVE-2014-{0488,0487,0489}Michael Vogt2014-09-161-22/+75
| | | | | | | | | | | | | | | | | | incorrect invalidating of unauthenticated data (CVE-2014-0488) incorect verification of 304 reply (CVE-2014-0487) incorrect verification of Acquire::Gzip indexes (CVE-2014-0489)
* | | fix gcc warningsMichael Vogt2014-09-171-5/+5
| | |
* | | use pkgAcqMetaBase as the transactionManagerMichael Vogt2014-09-171-51/+112
| | |
* | | remove pkgAcqSubIndexMichael Vogt2014-09-161-119/+1
| | |
* | | Merge remote-tracking branch 'upstream/debian/experimental' into ↵Michael Vogt2014-09-051-2/+2
|\| | | | | | | | | | | feature/acq-trans
| * | Merge branch 'debian/sid' into debian/experimentalMichael Vogt2014-09-051-2/+2
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: apt-pkg/acquire-item.cc configure.ac debian/changelog doc/apt-verbatim.ent doc/po/apt-doc.pot doc/po/de.po doc/po/es.po doc/po/fr.po doc/po/it.po doc/po/ja.po doc/po/pt.po po/ar.po po/ast.po po/bg.po po/bs.po po/ca.po po/cs.po po/cy.po po/da.po po/de.po po/dz.po po/el.po po/es.po po/eu.po po/fi.po po/fr.po po/gl.po po/hu.po po/it.po po/ja.po po/km.po po/ko.po po/ku.po po/lt.po po/mr.po po/nb.po po/ne.po po/nl.po po/nn.po po/pl.po po/pt.po po/pt_BR.po po/ro.po po/ru.po po/sk.po po/sl.po po/sv.po po/th.po po/tl.po po/tr.po po/uk.po po/vi.po po/zh_CN.po po/zh_TW.po test/integration/test-ubuntu-bug-346386-apt-get-update-paywall
| | * apt-pkg/acquire-item.cc: make pkgAcqDiffIndex more uniformMichael Vogt2014-07-171-2/+2
| | |
* | | add shared code into pkgAcqMetaSigBase::GenerateAuthWarning()Michael Vogt2014-08-251-52/+51
| | |
* | | all tests passMichael Vogt2014-08-241-8/+34
| | |
* | | make the test-pdiff-usage code work againMichael Vogt2014-08-241-0/+11
| | |
* | | make compressed-indexes test pass againMichael Vogt2014-08-241-22/+16
| | |
* | | cleanupMichael Vogt2014-08-241-14/+9
| | |
* | | really move clearsign check into pkgAcqMetaClearSig::Done()Michael Vogt2014-08-021-6/+13
| | |
* | | add ims check verifyMichael Vogt2014-08-021-9/+41
| | |
* | | move clearsign check into pkgAcqMetaClearSig::Failed()Michael Vogt2014-08-021-12/+11
| | |
* | | make i-m-s work againMichael Vogt2014-08-011-4/+7
| | |
* | | check hashes of compressed files as wellMichael Vogt2014-08-011-0/+14
| | |
* | | mve MetaKey into pkgAcqBaseIndexMichael Vogt2014-08-011-1/+0
| | |
* | | fail early (again) on gpg sig failuresMichael Vogt2014-07-311-32/+13
| | |
* | | ensure InRelease->Release is transactional as wellMichael Vogt2014-07-311-2/+3
| | |
* | | make test_inreleae_to_release_reverts_all workMichael Vogt2014-07-311-5/+11
| | |
* | | Rework TransactionID stuffMichael Vogt2014-07-311-48/+92
| | |
* | | WIP cleanup pkgAcqMetaSigMichael Vogt2014-07-221-81/+38
| | |
* | | Download Release first, then Release.gpgMichael Vogt2014-07-211-43/+50
| | | | | | | | | | | | | | | | | | | | | The old way of handling this was that pkgAcqMetaIndex was responsible to check/move both Release and Release.gpg in place. This breaks the assumption of the transaction that each pkgAcquire::Item has a single File that its responsible for.
* | | add pkgAcquire::TransactionHasError()Michael Vogt2014-07-211-3/+4
| | |
* | | WIP transaction based updateMichael Vogt2014-07-181-35/+83
|/ /
* | Merge branch 'debian/sid' into debian/experimentalMichael Vogt2014-07-081-25/+17
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: apt-pkg/deb/deblistparser.cc doc/po/apt-doc.pot doc/po/de.po doc/po/es.po doc/po/fr.po doc/po/it.po doc/po/ja.po doc/po/pl.po doc/po/pt.po doc/po/pt_BR.po po/da.po po/mr.po po/vi.po
| * Try not to parse invalid translation files (LP: #756317)Michael Vogt2014-07-031-25/+17
| |
* | Merge remote-tracking branch 'mvo/feature/update-by-hash' into ↵Michael Vogt2014-06-181-0/+34
|\ \ | | | | | | | | | debian/experimental
| * | move ByHash into its own functionMichael Vogt2014-05-221-26/+34
| | |
| * | Add APT::Acquire::$(host)::By-Hash=1 knob, add Acquire-By-Hash to Release fileMichael Vogt2014-05-221-23/+23
| | | | | | | | | | | | | | | | | | | | | The by-hash can be configured on a per-hostname basis and a Release file can indicate that it has by-hash support via a new flag. The location of the hash now matches the AptByHash spec
| * | add TODOMichael Vogt2014-05-221-0/+5
| | |
| * | Implement simple by-hash for apt updateMichael Vogt2014-05-221-0/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This implements a apt update schema that get the indexfiles by the hash instead of the name. The rational is that updates to the archive servers/mirrors are not atomic so the client may have the previous version of the Release file when the server updates to a new Release file and new Packages/Sources/Translations indexes. By keeping the files around by their hash we can still get the previous indexfile without a hashsum mismatch. Enable with APT::Acquire::By-Hash=1
* | | Fix more warnings from clangMichael Vogt2014-05-291-1/+0
|/ / | | | | | | | | | | | | | | | | Reported-By: clang++ -Werror Conflicts: apt-pkg/acquire-item.cc apt-pkg/acquire-item.h apt-pkg/deb/debmetaindex.h
* | Merge remote-tracking branch 'donkult/debian/experimental' into ↵Michael Vogt2014-05-141-114/+102
|\ \ | | | | | | | | | | | | | | | | | | | | | debian/experimental Conflicts: apt-pkg/acquire-item.cc apt-pkg/acquire-item.h
| * | promote ExpectedHashes to a pkgAcquire::Item memberDavid Kalnischkies2014-05-091-26/+23
| | | | | | | | | | | | | | | | | | Beside being another big API break with hopefully zero fallout in reality it avoids having the same member and helper code in each and every subclass.
| * | use HashStringList in the acquire systemDavid Kalnischkies2014-05-091-107/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is not very extensible to have the supported Hashes hardcoded everywhere and especially if it is part of virtual method names. It is also possible that a method does not support the 'best' hash (yet), so we might end up not being able to verify a file even though we have a common subset of supported hashes. And those are just two of the cases in which it is handy to have a more dynamic selection. The downside is that this is a MAJOR API break, but the HashStringList has a string constructor for compatibility, so with a bit of luck the few frontends playing with the acquire system directly are okay.
* | | Add new pkgAcqBaseIndex as base class for ↵Michael Vogt2014-05-141-16/+8
| | | | | | | | | | | | pkgAcq{DiffIndex,IndexMerge,pkgAcqBaseIndex, pkgAcqIndex}
* | | Pass struct IndexTarget/indexRecords to pkgAcqIndex{,Merge}DiffsMichael Vogt2014-05-141-29/+39
|/ / | | | | | | | | | | If one of the pkgAcqIndex{,Merge}Diffs fails, they will run pkgAcqIndex() which needs the IndexTarget/indexRecords data. So we pass it along.
* | Merge remote-tracking branch 'mvo/bugfix/update-progress-reporting' into ↵Michael Vogt2014-05-081-0/+2
|\ \ | | | | | | | | | debian/experimental
| * | Merge remote-tracking branch 'upstream/debian/sid' into ↵Michael Vogt2014-05-081-0/+2
| |\| | | | | | | | | | bugfix/update-progress-reporting
| | * initialize Verify in second pkgAcqIndex constructorDavid Kalnischkies2014-04-281-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | gcc reports in testcase ./test-bug-596498-trusted-unsigned-repo: apt-pkg/acquire-item.cc:1059:7: runtime error: load of value 234, which is not a valid value for type 'bool' This happens as the bool Verify is initialized only in one of the two constructors of the pkgAcqIndex class. It isn't a problem through as the verification controlled by this flag is optional and used to fail early on garbage files (like network portal pages) instead of later on in the hashsum verification or while parsing (the then untrusted) file. Reported-By: gcc-4.9 -fsanitize=undefined
* | | Merge remote-tracking branch 'mvo/bugfix/update-progress-reporting' into ↵Michael Vogt2014-05-071-20/+70
|\| | | | | | | | | | | debian/experimental
| * | pass Target/MetaIndexParser around into pkgAcqDiffIndex so that this can be ↵Michael Vogt2014-04-171-20/+26
| | | | | | | | | | | | used to create a proper pkgAcqIndex() with size information
| * | use correct compression extension when loading the size of the size into the ↵Michael Vogt2014-04-161-7/+18
| | | | | | | | | | | | fetcher
| * | add Debug::acquire::progress debug option and fixme for index file loading ↵Michael Vogt2014-04-161-0/+1
| | | | | | | | | | | | with the correct extension
| * | load the size from the metaindex into the fetcher to have even more accurate ↵Michael Vogt2014-04-161-3/+12
| | | | | | | | | | | | progress information
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2026-11-13 07:51:33 +0000