| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| |\ |
|
| | |
| |
| |
| |
| |
| |
| | |
Hand edit 2.7.14build2 to 2.7.14
The funny 999:0misbuilt version number gets auto-reduced to
the current version when building which is sad, but it works.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Our goal is for each platform to have one blessed OpenPGP verification
system: Platforms that support sqv get sqv, platforms that don't get
gpgv. To do so we hardcode the architecture list at build time.
At build time we check if /usr/bin/sqv exists, which is the condition
that apt uses to see if it should build with sqv support.
We use a slight hack here to build with sqv on the official Debian
buildds but use gpgv on Ubuntu by abusing the fact that Ubuntu
resolves alternative build dependencies, and gpgv is installed
in the buildd image.
|
| |/
|
|
|
|
|
|
| |
Many repositories still have SHA-1 self-signatures, and they are not
security relevant for APT repositories in the first place since we
do not use a web of trust model, but rather a set of trusted keyrings,
and the subkey can essentially be always considered trusted even if
it cannot be verified.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Introduce an OpenSSL::Crypto backend for the hashes library
and an OpenSSL::SSL backend for the TLS support in our https
method.
Many thanks to curl for showing the way with how to handle
a CRL file. There are some memory leaks here with the
TlsFd itself as well as the proxy support; and we should
reorganize the code to generate the ssl object as late
as possible.
A peculiar aspect of OpenSSL is that SSL_has_pending() returns
1 even if SSL_read() will fail to read anything and return the
equivalent of EAGAIN. We work around this here by also peeking
ahead 1 byte. I was running a very high RTT connection from
Germany to Australia for testing, and with the peeking it's
using negligible amounts of CPU; before that, it was busy
looping at 100%. Bad OpenSSL!
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Remove the test case for MD5 and expired signatures, as we can't
create them (can't set signing digest, and can't set signature
expiry).
Tests for them have been added to test-method-gpgv instead.
We override sq in a function with cert-store and key-store
set to none.
This supports both sq 0.40 and sq 1.0.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Automatically show the output of `show`, `policy`, `list`,
`search`, `showsrc` in a pager.
The pager setup is inspired by git's pager setup. Notably,
the pager is found using APT_PAGER and PAGER variables.
We wait for the pager to be setup somewhat correctly by
using a notify pipe to figure out whether execvp() was
succesful - then the pipe will read EOF as the other end
got closed by CLOEXEC during exec - or not, then the pipe
will contain an errno.
We set up the correct handlers for signals and exit to close
the fds and wait for the pager. Notably inside the signal
handler we cannot flush our streams, only close them, so
there is some duplication.
We call the InitOutputPager() function from inside the
various Do...() functions rather than setting it up
generally in InitOutput(). Doing so allows us to first
render the progress without a pager, and then setup
the pager for the content only which improves user
experience.
When we setup a pager we also take care to disable
standard input, as we should not be prompting users
while a pager is running (the pager will be reading
from the tty directly). We do this by dup2-ing() a
/dev/null over it; if we just close()d the fd, another
open() might reuse the fd number and problems could
occur.
|
| | |
|
| |
|
|
|
|
|
| |
We move the user configuration section to the top of the manual
page as that is going to be what most are interested in and rewrite
it to cover all the modern ways to configure keys in a succinct
way.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
Oh well I accidentally committed everything from my work email
today but I'm off today ...
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |\
| |
| |
| |
| | |
JSON: Pass options to hooks in hello message
See merge request apt-team/apt!389
|
| | |
| |
| |
| |
| |
| |
| |
| | |
This also ensures that our JSON is actually correct
JSON.
echo may fail now with EPIPE, given that it is multiline, so
wrap it in 2>/dev/null
|
| | | |
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
This is useful on every system and only was in apt-utils for
historical reasons. Move it to the main apt package, and also
move it out of the path.
Add a symbolic link in /usr/bin to apt-utils and keep the manual
pages in tere.
|
| | | |
|
| |/
|
|
|
|
|
|
|
| |
These methods have been unsupported and disabled since 1.8, remove
them for the 3.0 cleanup.
Please migrate to http instead. If you need ad-hoc access to a remote
repository, you can run `python3 -m http.server` on that machine and
use SSH port forwarding to run http over ssh.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
to force upgrades in launchpad buildd chroots
Gbp-Dch: full
|
| | |
|
| |
|
|
|
| |
Annotate the Build-Depends with a <!pkg.apt.ci> profile and use
that in prepare-release when doing build-dep.
|
| |
|
|
|
|
|
| |
apt (2.7.12+nmu1) unstable; urgency=medium
.
* Non-maintainer upload.
* Rename libraries for 64-bit time_t transition. Closes: #1061896
|
| | |
|
| |
|
|
| |
Closes: #1054137
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This moves the functions of the PhasedUpgrader class into
various other classes so they can be publicly exposed.
This introduces three new functions:
pkgDepCache::PhasingApplied() tells you whether phasing should
be applied to the package.
pkgProblemResolver::KeepPhasedUpdates() keeps back updates that
have phasing applied.
pkgCache::VerIterator::IsSecurityUpdate() determines whether this
version contains security fixes.
|
| | |
|
| |
|
|
|
|
|
|
|
|
| |
The APT team is very concerned about the encroachement of its
namespace and the impact on security of its file verification
process. We have expressed those concerns in the ITP bug, but
the package was nonetheless uploaded and accepted, so we have
to take this extraordinary step to protect our users.
Gbp-Dch: full
|
| | |
|
