summaryrefslogtreecommitdiff
path: root/doc/examples
Commit message (Collapse)AuthorAgeFilesLines
* Have Grp.FindPreferredPkg return very foreign pkgs as last resortDavid Kalnischkies2023-12-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Usually this method will return the package in the most preferred architecture (e.g. native) as that is usually what the user talks about and also information wise for our internal usage the most dense. Early on in parsing Packages files through it can happen that we encounter stanzas about packages in architectures we are not even configured to know about – we have to collect them anyhow as we might be requested to show info about them or they could be in the status file and we can't ignore stanzas in the status file… trouble is that this method used to not return anything if only such an architecture was present if we later discover other architectures which causes Provides and Conflicts which are added lazily on discovery of an architecture to not be added correctly. The result is like in the testcase that apt could be instructed to install a package without respecting its negative dependencies, which is bad even if its discovered by dpkg and refused. It does only happen with unknown architectures through which mostly happens if you are unlucky (amd64 users tend to be very lucky as that sorts early) and use flat-style repositories containing multiple architectures. Reported-By: Tianyu Chen (billchenchina) on IRC
* update: Add notice about missing Signed-By in deb822 sourcesJulian Andres Klode2023-06-271-0/+1
| | | | | | | We want to gently steer users towards having Signed-By for each source such that we can retire a shared keyring across sources which improves resilience against configuration issues and incompetent malicious actors.
* Seed snapshot servers for well-known hostsJulian Andres Klode2023-05-241-0/+1
| | | | | This will attempt to fallback to a per-server setting if we could not determine a value from the release file.
* Initial support for snapshot servers, apt --snapshot optionJulian Andres Klode2023-05-021-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Provide snapshot support for offical Debian and Ubuntu archives. There are two ways to enable snapshots for sources: 1. Add Snapshot: yes to your sources file ([snapshot=yes]). This will allow you to specify a snapshot to use when updating or installing using the --snapshot,-S option. 2. Add Snapshot: ID to your sources files to request a specific snapshot for this source. Snapshots are discovered using Label and Origin fields in the Release file of the main source, hence you need to have updated the source at least once before you can use snapshots. The Release file may also declare a snapshots server to use, similar to Changelogs, it can contain a Snapshots field with the values: 1. `Snapshots: https://example.com/@SNAPSHOTID@` where `@SNAPSHOTID@` is a placeholder that is replaced with the requested snapshot id 2. `Snapshots: no` to disable snapshot support for this source. Requesting snapshots for this source will result in a failure to load the source. The implementation adds a SHADOWED option to deb source entries, and marks the main entry as SHADOWED when a snapshot has been requested, which will cause it to be updated, but not included in the generated cache. The concern here was that we need to keep generating the shadowed entries because the cleanup in `apt update` deletes any files not queued for download, so we gotta keep downloading the main source. This design is not entirely optimal, but avoids the pitfalls of having to reimplement list cleanup. Gaps: - Ubuntu Pro repositories and PPAs are not yet supported.
* Add apt install,upgrade,... -U,--update optionsJulian Andres Klode2023-05-021-1/+1
| | | | | This runs update before opening the cache and sources.list for installing/upgrading.
* Suggest using non-free-firmware in update for DebianDavid Kalnischkies2023-02-041-1/+5
| | | | | | | | | | | | | | | | | | | In an ideal world everyone would read release notes, but if the last sources.list change is any indication a lot of people wont. This is even more a problem in so far as apt isn't producing errors for invalid repositories, but instead carries on as normal even through it will not be able to install upgrades for the moved packages. This commit implements two scenarios and prints a notice in those cases pointing to the release notes: a) User has 'non-free' but not 'non-free-firmware' b) User has a firmware package which isn't available from anywhere Both only happen if we are talking about a repository which identifies itself as one of Debian and is for a release codenamed bookworm (or sid). Note that as (usually) apt/oldstable is used to upgrade to the new stable release these suggestions only show for users after they have upgraded to bookworm on apt command line usage after that.
* Add non-free-firmware component in documentationDavid Kalnischkies2023-01-301-0/+7
| | | | | | This changes a lot of lines technically, but its easy enough to unfuzzy the translations as most of the mentions are examples to be copied literally in translations (sadly po4a isn't clever enough for this).
* Add flag to disable upgrade by source and test caseJulian Andres Klode2022-07-241-0/+1
|
* (Temporarily) Rewrite phased updates using a keep-back approachJulian Andres Klode2022-06-281-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | This is a lot closer to the original implementation in update-manager, but still has a couple of differences that might cause bugs: - When checking whether a version is a security update, we only check versions in between and not any later version. This happens mostly because we do not know the suite, so we just check if there is any version between the installed version and our target that is a security update - We only keep already installed packages, as we run before the resolver. update-manager first runs the resolver, and then marks for keep all packages that were upgraded or newly installed that are phasing (afaict). This approach has a significant caveat that if you have version 1 installed from a release pocket, version 2 is in security, and version 3 is phasing in updates, that it installs version 3 rather than 2 from security as the policy based implementation does. It also means that apt install does not respect phasing and would always install version 3 in such a scenario. LP: #1979244
* Do not remove Essential/Protected due to dependenciesJulian Andres Klode2021-11-171-0/+1
| | | | | | | | Suggesting the removal of Essential and Protected packages as a solution leads to situations where YouTubers end up removing their desktop. Let's not remove such packages ourselves.
* Merge branch 'pu/ifrange' into 'main'Julian Andres Klode2021-10-181-3/+4
|\ | | | | | | | | Add AllowRange option to disable HTTP Range usage See merge request apt-team/apt!188
| * Add AllowRange option to disable HTTP Range usageDavid Kalnischkies2021-09-161-3/+4
| | | | | | | | | | | | | | | | apt makes heavy usage of HTTP1.1 features including Range and If-Range. Sadly it is not obvious if the involved server(s) (and proxies) actually support them all. The Acquire::http::AllowRange option defaults to true as before, but now a user can disable Range usage if it is known that the involved server is not dealing with such requests correctly.
* | Streamline access to barbarian architecture functionalityDavid Kalnischkies2021-09-041-0/+1
|/ | | | | | | | | | | | | | | | | | | | | | APT is not the place this information should be stored at, but it is a good place to experiment and see what will be (not) needed in the future for a proper implementation higher up the stack. This is why "BarbarianArchitectures" is chosen instead of a more neutral and/or sensible "VeryForeign" and isn't readily exported in the API to other clients for this PoC as a to be drawn up standard will likely require potentially incompatible changes. Having a then outdated and slightly different implementation block a "good" name would be bad. The functionality itself mostly exists (ignoring bugs) since the introduction of MultiArch as we always had the risk of encountering packages of architectures not known to dpkg (forced onto the system, potentially before MultiArch) we had to deal with somehow and other edge cases. All this commit really does is allowing what could previously only be achieved with editing sources.list and some conf options via a single config option: -o APT::BarbarianArchitectures=foo,bar
* Add support for a maximum delay and testing of delayJulian Andres Klode2021-07-281-1/+4
| | | | | | This is very basic support on the testing side, we just test the debug output but not how long it actually took. Would be nice to check time really.
* Implement exponential delay between retriesJulian Andres Klode2021-07-281-1/+3
| | | | | | | Add a new Item field called FetchAfter, which determines the earliest time the item should be fetched at. Adjust insertion into queue to take it into account alongside priority, and only fill pipelines with items that are ready.
* Remove inversed comment for AllowUnsizedPackagesJulian Andres Klode2021-04-131-1/+1
| | | | It defaults to false, like the other options there do.
* Error on packages without a Size field (option Acquire::AllowUnsizedPackages)Julian Andres Klode2021-04-131-0/+1
| | | | | | | | | Repositories without Size information for packages are not proper and need fixing. This ensures people see an error in CI, and get notifications and hence the ability to fix it. It can be turned off by setting Acquire::AllowUnsizedPackages to true.
* Implement update --error-on=anyJulian Andres Klode2021-01-081-0/+1
| | | | | | | | | | | People have been asking for a feature to error out on transient network errors for a while, this gives them one while keeping the door open for other modes we need, such as --error-on=no-success which we need to determine when to retry the daily update job. Closes: #594813 (and a whole bunch of duplicates...)
* Add support for Phased-Update-PercentageJulian Andres Klode2021-01-081-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | This adds support for Phased-Update-Percentage by pinning upgrades that are not to be installed down to 1. The output of policy has been changed to add the level of phasing, and documentation has been improved to document how phased updates work. The patch detects if it is running in a chroot, and if so, always includes phased updates, restoring classic apt behavior to avoid behavioral changes on buildd chroots. Various options are added to control this all: * APT::Get::{Always,Never}-Include-Phased-Updates and their legacy update-manager equivalents to always or never include phased updates * APT::Machine-ID can be set to a UUID string to have all machines in a fleet phase the same * Dir::Etc::Machine-ID is weird in that it's default is sort of like ../machine-id, but not really, as ../machine-id would look up $PWD/../machine-id and not relative to Dir::Etc; but it allows you to override the path to machine-id (as opposed to the value) * Dir::Bin::ischroot is the path to the ischroot(1) binary which is used to detect whether we are running in a chroot.
* Automatically remove unused kernels on dist-upgradeJulian Andres Klode2021-01-041-1/+3
| | | | | Kernels clutter /boot and /boot is small size, so we need to take extra care to remove kernels when possible.
* Determine autoremovable kernels at run-timeJulian Andres Klode2021-01-041-0/+3
| | | | | | | | | | | | | | | | | | | | | | | Our kernel autoremoval helper script protects the currently booted kernel, but it only runs whenever we install or remove a kernel, causing it to protect the kernel that was booted at that point in time, which is not necessarily the same kernel as the one that is running right now. Reimplement the logic in C++ such that we can calculate it at run-time: Provide a function to produce a regular expression that matches all kernels that need protecting, and by changing the default root set function in the DepCache to make use of that expression. Note that the code groups the kernels by versions as before, and then marks all kernel packages with the same version. This optimized version inserts a virtual package $kernel into the cache when building it to avoid having to iterate over all packages in the cache to find the installed ones, significantly improving performance at a minor cost when building the cache. LP: #1615381
* Keep URIs encoded in the acquire systemDavid Kalnischkies2020-12-181-0/+2
| | | | | | | | | | | | | | | | | | | We do not deal a lot with URIs which need encoding, but then we do it is a pain that we store it decoded in the acquire system as it means we have to decode and reencode URIs eventually which is potentially giving us slightly different URIs. We see that in our own testing framework while setting up redirects as the config options are effectively double-encoded and decoded to pass them around successfully as otherwise %2f and / in an URI are treated the same. This commit adds the infrastructure for methods to opt into getting URIs send in encoded form (and returning them to us in encoded form, too) so that we eventually do not have to touch the URIs which is how it should be. This means though that we have to deal with methods who do not support this yet (aka: all at the moment) for which we decode and encode while communicating with them.
* Support compressed output from rred similar to apt-helper cat-filefeature/rredDavid Kalnischkies2020-11-071-0/+1
|
* Prepare rred binary for external usageDavid Kalnischkies2020-11-071-0/+2
| | | | | | | | | | | Merging patches is a bit of non-trivial code we have for client-side work, but as we support also server-side merging we can export this functionality so that server software can reuse it. Note that this just cleans up and makes rred behave a bit more like all our other binaries by supporting setting configuration at runtime and supporting --help and --version. If you can make due without this, the now advertised functionality is provided already in earlier versions.
* Merge branch 'master' into 'master'Julian Andres Klode2020-08-041-0/+1
|\ | | | | | | | | Support marking all newly installed packages as automatically installed See merge request apt-team/apt!110
| * Support marking all newly installed packages as automatically installedNicolas Schier2020-06-081-0/+1
| | | | | | | | | | | | | | Add option '--mark-auto' to 'apt install' that marks all newly installed packages as automatically installed. Signed-off-by: Nicolas Schier <nicolas@fjasle.eu>
* | Add basic support for the Protected fieldJulian Andres Klode2020-06-291-0/+1
|/ | | | This will be mapped to Important for the time being.
* Allow 20 instead of 10 loops for pkgProblemResolverDavid Kalnischkies2020-06-031-0/+1
| | | | | | | | Especially if a lot packages have to be removed due to not to explicitly expressed conflicts the problem resolver can take a few turns to remove them all. Allowing it to try a little longer if needed seems beneficial as the worst which can happen is that we now take two times as long to present an error message to the user.
* ubuntu: http: Add non-interactive to user agent if run by systemdJulian Andres Klode2020-04-091-0/+1
| | | | | | | | | | | | | | | Include that apt is being run from a service in the user agent, so traffic can be analysed for interactive vs non-interactive use, and prioritised accordingly. It looks like this now: User-Agent: Debian APT-HTTP/1.3 (2.0.1) non-interactive A previous version included the full service names, but this raised some privacy concerns. LP: #1825000
* configure-index: Add APT::Color optionJulian Andres Klode2020-03-241-0/+1
| | | | | | | | | | | This caused unbound error list growth, because each time we dumped an error, the calls to _config->FindB() inside operator << would add 3 new errors of the form: W: Using unknown config option »apt::color« of type BOOL Hence we are dumping an infinite list of errors, and eventually that list will exceed available memory.
* Show absolute time while waiting for lock instead of %, rework messageJulian Andres Klode2020-03-061-0/+2
| | | | | | | | | | | | | | | | | | | | | Showing a percentage for a timeout is pretty non-standard. Rework the progress class so it can show an absolute progress (currently hardcoded to use seconds as a unit). If there is a timeout (aka if it's not the maximum long long unsigned -1llu), then show the timeout, otherwise just count up seconds, e.g. Waiting for cache lock: Could not get lock /var/lib/dpkg/lock-frontend. It is held by process 33842 (apt)... 1/120s or Waiting for cache lock: Could not get lock /var/lib/dpkg/lock-frontend. It is held by process 33842 (apt)... 1s Also improve the error message to use "Waiting for cache lock: %s" instead of "... (%s)", as having multiple sentences inside parenthesis is super weird, as is having two closing parens. We pass the information via _config, as that's reasonably easy and avoids ABI hackage. It also provides an interesting debugging tool for other kinds of progress.
* apt(8): Wait for frontend and cache lockJulian Andres Klode2020-02-261-0/+2
| | | | | | This is a rework of !6 with additional stuff for the frontend lock, so we can lock the frontend lock and then keep looping over dpkg lock.
* apt(8): Disable regular expressions and fnmatchJulian Andres Klode2020-01-151-0/+1
| | | | | This is the first step. Next step will be to add warnings to apt-get and then remove support there as well.
* Introduce apt satisfy and apt-get satisfyJulian Andres Klode2019-06-111-0/+1
| | | | | | | | | | | | | | | | | | Allow to satisfy dependency strings supplied on the command line, optionally prefixed with "Conflicts:" to satisfy them like Conflicts. Build profiles and architecture restriction lists, as used in build dependencies, are supported as well. Compared to build-dep, build-essential is not installed automatically, and installing of recommended packages follows the global default, which defaults to yes. Closes: #275379 See merge request apt-team/apt!63
* Prevent shutdown while running dpkgJulian Andres Klode2019-05-031-0/+3
| | | | | | | As long as we are running dpkg, keep an inhibitor that blocks us from shutting down. LP: #1820886
* Merge branch 'pu/dpkg-path' into 'master'Julian Andres Klode2018-12-101-0/+4
|\ | | | | | | | | Set PATH=/usr/sbin:/usr/bin:/sbin:/bin when running dpkg See merge request apt-team/apt!38
| * Set PATH=/usr/sbin:/usr/bin:/sbin:/bin when running dpkgJulian Andres Klode2018-12-101-0/+4
| | | | | | | | | | | | | | | | | | This avoids a lot of problems from local installations of scripting languages and other stuff in /usr/local for which maintainer scripts are not prepared. [v3: Inherit PATH during tests, check overrides work] [v2: Add testing]
* | Add support for /etc/apt/auth.conf.d/*.conf (netrcparts)Julian Andres Klode2018-12-041-0/+1
|/ | | | | | | | | This allows us to install matching auth files for sources.list.d files, for example; very useful. This converts aptmethod's authfd from one FileFd to a vector of pointers to FileFd, as FileFd cannot be copied, and move operators are hard.
* Allow setting Referer header for http methodDavid Kalnischkies2018-11-251-0/+1
| | | | | | Not needed for common interactions, but for some download-file interactions it could be useful to set a specific referer as some servers do not serve requested files otherwise.
* Default to https: scheme for fetching Debian changelogsBen Hutchings2018-10-131-1/+1
| | | | Closes: #910941
* Lower default timeout from 120s to 30sJulian Andres Klode2018-05-241-3/+3
| | | | | 120s is an insanely high default time out, lower it to 30s to make things a bit nicer.
* Remove obsolete RCS keywordsGuillem Jover2018-05-071-1/+0
| | | | Prompted-by: Jakub Wilk <jwilk@debian.org>
* apt-pkg: Add support for zstdJulian Andres Klode2018-03-121-0/+1
| | | | | | | zstd is a compression algorithm developed by facebook. At level 19, it is about 6% worse in size than xz -6, but decompression is multiple times faster, saving about 40% install time, especially with eatmydata on cloud instances.
* Merge branch 'pu/not-valid-before' into 'master'Julian Andres Klode2018-02-191-0/+3
|\ | | | | | | | | Check that Date of Release file is not in the future See merge request apt-team/apt!3
| * Check that Date of Release file is not in the futureJulian Andres Klode2018-02-191-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | By restricting the Date field to be in the past, an attacker cannot just create a repository from the future that would be accepted as a valid update for a repository. This check can be disabled by Acquire::Check-Date set to false. This will also disable Check-Valid-Until and any future date related checking, if any - the option means: "my computers date cannot be trusted." Modify the tests to allow repositories to be up to 10 hours in the future, so we can keep using hours there to simulate time changes.
* | ensure correct file permissions for auxfilesDavid Kalnischkies2018-02-191-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The interesting takeaway here is perhaps that 'chmod +w' is effected by the umask – obvious in hindsight of course. The usual setup helps with hiding that applying that recursively on all directories (and files) isn't correct. Ensuring files will not be stored with the wrong permissions even if in strange umask contexts is trivial in comparison. Fixing the test also highlighted that it wasn't bulletproof as apt will automatically fix the permissions of the directories it works with, so for this test we actually need to introduce a shortcut in the code. Reported-By: Ubuntu autopkgtest CI
* | add apt-helper drop-privs command…David Kalnischkies2018-02-191-6/+19
|/
* document https options in new apt-transport-https manpageDavid Kalnischkies2018-01-033-190/+1
| | | | | | Same reasoning as with the previous commit for http with the added benefit of moving the hard to discover and untranslated example config into a manpage which could be translated.
* Add rapid "happy eyeballs" connection fallback (RFC 8305)Julian Andres Klode2018-01-031-0/+3
| | | | | | | | | | | | | | | | | | | | | | Try establishing connections in alternating address families in rapid intervals of 250 ms, adding more connections to the wait list until one succeeds (RFC 8305, happy eyeballs 2). It is important that WaitAndCheckErrors() waits until it has a successful connection, a time out, or all connections failed - otherwise the timing between tries might be wrong, and the final long wait might exit early because one connection failed without trying the others. Timing wise, this only works correctly on Linux, as select() counts down there. But we rely on that in some other places too, so this is not the time to fix that. Timeouts are only reported in the final long wait - the short inner waits are expected to time out more often, and multiple times, we do not want to report them. Closes: #668948 LP: #1308200 Gbp-Dch: paragraph
* Print syscall number and arch to stderr when trapped by seccompJulian Andres Klode2017-10-261-0/+1
| | | | | | This should help debugging crashes. The signal handler is a C++11 lambda, yay! Special care has been taken to only use signal handler -safe functions inside there.
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2026-05-12 16:52:10 +0000