summaryrefslogtreecommitdiff
path: root/methods
Commit message (Collapse)AuthorAgeFilesLines
* Allow lowering trust level of a hash via configJulian Andres Klode2016-03-281-12/+12
| | | | | | Introduces APT::Hashes::<NAME> with entries Untrusted and Weak which can be set to true to cause the hash to be treated as untrusted and/or weak.
* handle gpgv's weak-digests ERRSIGDavid Kalnischkies2016-03-221-7/+50
| | | | | | | | | | | Our own gpgv method can declare a digest algorithm as untrusted and handles these as worthless signatures. If gpgv comes with inbuilt untrusted (which is called weak in official terminology) which it e.g. does for MD5 in recent versions we should handle it in the same way. To check this we use the most uncommon still fully trusted hash as a configureable one via a hidden config option to toggle through all of the three states a hash can be in.
* properly check for "all good sigs are weak"David Kalnischkies2016-03-211-9/+14
| | | | | | | | | | Using erase(pos) is invalid in our case here as pos must be a valid and derefenceable iterator, which isn't the case for an end-iterator (like if we had no good signature). The problem runs deeper still through as VALIDSIG is a keyid while GOODSIG is just a longid so comparing them will always fail. Closes: 818910
* Make the weak signature message less ambigiousJulian Andres Klode2016-03-161-1/+1
| | | | | | | | There was a complaint that, in the previous message, the key fingerprint could be mistaken for a SHA1 digest due to the (SHA1) after it. Gbp-Dch: ignore
* methods/gpgv: Rewrite error handling and messageJulian Andres Klode2016-03-161-19/+50
| | | | | | | This should be easy to extend in the future and allow us to simplify the error handling cases somewhat. Thanks: Ron Lee for wording suggestions
* methods/gpgv: Warn about SHA1 (and RIPEMD-160)Julian Andres Klode2016-03-151-3/+29
| | | | | | | We will drop support for those in the future. Also adjust the std::array to be a std::vector, as that's easier to maintain.
* apt-pkg/acquire-worker.cc: Introduce 104 Warning messageJulian Andres Klode2016-03-151-0/+8
| | | | | | | | | This can be used by workers to send warnings to the main program. The messages will be passed to _error->Warning() by APT with the URI prepended. We are not going to make that really public now, as the interface might change a bit.
* methods/gpgv: Correctly handle weak signatures with multiple keysJulian Andres Klode2016-03-151-1/+6
| | | | | | | | | | | | We added weak signatures to BadSigners, meaning that a Release file signed by both a weak signature and a strong signature would be rejected; preventing people from migrating from DSA to RSA keys in a sane way. Instead of using BadSigners, treat weak signatures like expired keys: They are no good signatures, and they are worthless. Gbp-Dch: ignore
* methods/gpgv: Reject weak digest algorithmsJulian Andres Klode2016-03-141-0/+16
| | | | | This keeps a list of weak digest algorithms. For now, only MD5 is disabled, as SHA1 breaks to many repos.
* Revert "Handle ERRSIG in the gpgv method like BADSIG"Julian Andres Klode2016-03-141-7/+0
| | | | | | | | This reverts commit 76a71a1237d22c1990efbc19ce0e02aacf572576. That commit broke the test suite. Gbp-Dch: ignore
* Handle ERRSIG in the gpgv method like BADSIGJulian Andres Klode2016-03-141-0/+7
| | | | | | | | | | | | ERRSIG is created whenever a key uses an unknown/weak digest algorithm, for example. This allows us to report a more useful error than just "unknown apt-key error.": The following signatures were invalid: ERRSIG 13B00F1FD2C19886 1 2 01 1457609403 5 While still not being the best reportable error message, it's better than unknown apt-key error and hopefully redirects users to complain to their repository owners.
* rred: If there were I/O errors, failJulian Andres Klode2016-02-041-0/+5
| | | | | We basically ignored errors from writing and flushing, let's not do that.
* act on various suggestions from cppcheckDavid Kalnischkies2016-01-262-1/+6
| | | | | Reported-By: cppcheck Git-Dch: Ignore
* Only enable pipelining if server is HTTP/1.1Julian Andres Klode2016-01-122-1/+10
| | | | | | | Just enabling it for anyone breaks with HTTP/1.0 servers and proxies sometimes. Closes: #810796
* allow pdiff bootstrap from all supported compressorsDavid Kalnischkies2016-01-081-2/+2
| | | | | | | There is no reason to enforce that the file we start the bootstrap with is compressed with a compressor which is available online. This allows us to change the on-disk format as well as deals with repositories adding/removing support for a specific compressor.
* use one 'store' method to rule all (de)compressorsDavid Kalnischkies2016-01-082-37/+45
| | | | | | | | | | | Adding a new compressor method meant adding a new method as well – even if that boilt down to just linking to our generalized decompressor with a new name. That is unneeded busywork if we can instead just call the generalized decompressor and let it figure out which compressor to use based on the filenames rather than by program name. For compatibility we ship still 'gzip', 'bzip2' and co, but they are just links to our "new" 'store' method.
* rred: Run in parallelJulian Andres Klode2016-01-071-1/+1
| | | | | Remove the SingleInstance flag so we can use the new randomized queue feature to run parallel.
* Do not remove a not working SrvRecords server twiceMichael Vogt2016-01-051-3/+1
| | | | | | | The PopFromSrvRecs() already removed the entry from the active list, so the extra SrvRecords.erase() was incorrect. Git-Dch: ignore
* rred: Use buffered writesJulian Andres Klode2015-12-271-3/+7
| | | | | Buffered writes improve performance a lot, given that we spent about 78% of the time in _write.
* rred: Only call pkgInitConfig() in test modeJulian Andres Klode2015-12-271-2/+2
| | | | | | | This accidentally slipped in in a previous commit, but it should be used only for testing mode. Reported-By: David Kalnischkies <david@kalnischkies.de>
* Convert most callers of isspace() to isspace_ascii()Julian Andres Klode2015-12-273-2/+5
| | | | | This converts all callers that read machine-generated data, callers that might work with user input are not converted.
* rred: Allow passing files as arguments for compressor testingJulian Andres Klode2015-12-261-2/+14
| | | | | | | | This introduces a -t mode in which the first argument is input, the second is output and the remaining are diffs. This allows us to test patching compressed files, which are detected using their file extension.
* disable privilege dropping for rsh/ssh method by defaultDavid Kalnischkies2015-11-281-0/+4
| | | | | | | | | ssh expects various configuration bits to be usable like known hosts, possibly keys and co. Setting this up needs some user work for probably not a whole lot of benefits, so instead of forcing it upon users on upgrade disable dropping for it by default. Closes: 806511
* fix program name detection in rsh methodDavid Kalnischkies2015-11-282-6/+6
| | | | Regression intoduced in 23e64f6d0facf9610c1042326ad9850e071e8349
* ignore lost+found in private directory cleanupDavid Kalnischkies2015-11-191-0/+1
| | | | | | | | | | In ce1f3a2c we started warning about failing unlinking, which we consistently do for directories. That isn't a problem as directories usually aren't in the places we do want to clean up – with the potential exeception of "lost+found", so lets ignore it like we ignore our own partial/ subdirectory. Closes: 805424
* activate AI_IDN by default to support IDN domainsDavid Kalnischkies2015-11-051-0/+2
| | | | | | | AI_IDN is a glibc extension, but we can worry about this at the time actually anyone is seriously trying apt on non-glibc systems. Closes: 763437
* apply various suggestions made by cppcheckDavid Kalnischkies2015-11-057-12/+10
| | | | | Reported-By: cppcheck Git-Dch: Ignore
* allow acquire method specific options via Binary scopeDavid Kalnischkies2015-11-0512-109/+65
| | | | | | | | Allows users who know what they are getting themselves into with this trick to e.g. disable privilege dropping for e.g. file:// until they can fix up the permissions on those repositories. It helps also the test framework and people with a similar setup (= me) to run in less modified environments.
* drop privileges in copy:// method as we do for file://David Kalnischkies2015-11-053-38/+54
| | | | | | | | | | | Continueing on the track of dropping privileges in all methods, lets drop it in copy, too, as the reasoning for it is very similar to file and the interaction between the too quiet interesting as copy kinda surfed as a fallback for file not being able to read the file. Both now show a better error message as well as it was previously claiming to have a hashsum mismatch, given that it couldn't read the file. Git-Dch: Ignore
* allow getaddrinfo flag AI_ADDRCONFIG to be disabledDavid Kalnischkies2015-11-041-1/+6
| | | | | | | | | This flags is generally handy to avoid having to deal with ipv6 results on an ipv4-only system, but it prevents e.g. the testcases from working if the testsystem has no configured address at the moment (expect loopback), so allow it to be sidestepped and let the testcases sidestep it. Git-Dch: Ignore
* wrap every unlink call to check for != /dev/nullDavid Kalnischkies2015-11-045-8/+8
| | | | | | | | | | | | | | | | Unlinking /dev/null is bad, we shouldn't do that. Also, we should print at least a warning if we tried to unlink a file but didn't manage to pull it of (ignoring the case were the file is /dev/null or doesn't exist in the first place). This got triggered by a relatively unlikely to cause problem in pkgAcquire::Worker::PrepareFiles which would while temporary uncompressed files (which are set to keep compressed) figure out that to files are the same and prepare for sharing by deleting them. Bad move. That also shows why not printing a warning is a bad idea as this hide the error for in non-root test runs. Git-Dch: Ignore
* set failreasons similar to connect.cc based on curl errorsDavid Kalnischkies2015-11-041-3/+18
| | | | | | | | | | Detecting network errors has some benefits in the acquire system as if we can't connect to a host trying it for a million files is pointless. http and co which use connect.cc deal with this, but https which uses curl had connection failures as "normal" errors which could potentially be worked around (like trying Release instead of the failed InRelease). Git-Dch: Ignore
* unbreak the copy-method claiming hashsum mismatch since ~exp9David Kalnischkies2015-11-042-23/+35
| | | | | | | | | | | | | | | | Commit 653ef26c70dc9c0e2cbfdd4e79117876bb63e87d broke the camels back in sofar that everything works in terms of our internal use of copy:/, but external use is completely destroyed. This is kinda the reverse of what happened in "parallel" in the sid branch, where external use was mostly fine, internal and external exploded on the GzipIndexes option. We fix this now by rewriting our internal use by letting copy:/ only do what the name suggests it does: Copy files and not uncompress them on-the-fly. Then we teach copy and the uncompressors how to deal with /dev/null and use it as destination file in case we don't want to store the uncompressed files on disk. Closes: 799158
* drop privileges in file:// method as we do for decompressorsDavid Kalnischkies2015-11-041-2/+12
| | | | | | | | | We drop it in decompressors, which are the natural next step, so if an archive is used which isn't worldreadable (= not accessible by _apt) it doesn't work anyway, so we just fail a bit earlier now and avoid all the bad things which can happen over file (which could very well still be a network resourc via NFS mounts or similar stuff, so hardly as safe as the name might suggest at first).
* fix two memory leaks reported by gccDavid Kalnischkies2015-09-146-18/+21
| | | | | Reported-By: gcc -fsanitize=address -fno-sanitize=vptr Git-Dch: Ignore
* avoid using global PendingError to avoid failing too often too soonDavid Kalnischkies2015-09-141-1/+1
| | | | | | | | | | | | | | | | | | | Our error reporting is historically grown into some kind of mess. A while ago I implemented stacking for the global error which is used in this commit now to wrap calls to functions which do not report (all) errors via return, so that only failures in those calls cause a failure to propergate down the chain rather than failing if anything (potentially totally unrelated) has failed at some point in the past. This way we can avoid stopping the entire acquire process just because a single source produced an error for example. It also means that after the acquire process the cache is generated – even if the acquire process had failures – as we still have the old good data around we can and should generate a cache for (again). There are probably more instances of this hiding, but all these looked like the easiest to work with and fix with reasonable (aka net-positive) effects.
* fix some unused parameter/variable warningsDavid Kalnischkies2015-08-311-6/+4
| | | | | Reported-By: gcc Git-Dch: Ignore
* implement PDiff patching for compressed filesDavid Kalnischkies2015-08-281-37/+47
| | | | | | | | | | | | | | | | | | Some additional files like 'Contents' are very big and should therefore kept compressed on the disk, which apt-file did in the past. It also implemented pdiff patching of these files by un- and recompressing these files on-the-fly, with this commit we can do the same – but we can do this in both pdiff patching styles (client and server merging) and secured by hashes. Hashes are in so far slightly complicated as we can't compare the hashes of the compressed files as we might compress them differently than the server would (different compressor versions, options, …), so we must compare the hashes of the uncompressed content. While this commit has changes in public headers, the classes it changes are marked as hidden, so nobody can use them directly, which means the ABI break is internal only.
* fix various typos reported by codespellDavid Kalnischkies2015-08-273-4/+4
| | | | Reported-By: codespell
* Fix typoMichael Vogt2015-08-241-1/+1
| | | | | Thanks: Julian Andres Klode Git-Dch: ignore
* Add basic (non weight adjusted) shuffling for SrvRecords selectionMichael Vogt2015-08-201-2/+3
| | | | | Also add "Debug::Acquire::SrvRecs" debug option and the option "Acquire::EnableSrvRecods" to allow disabling this lookup.
* cleanupMichael Vogt2015-08-181-10/+8
|
* Merge remote-tracking branch 'upstream/debian/experimental' into ↵Michael Vogt2015-08-1814-118/+286
|\ | | | | | | feature/srv-records
| * Make apt compile with clang++ againMichael Vogt2015-08-141-1/+1
| | | | | | | | | | This allows us to run the clang static analyzer and to run the testsuite with the clang MemorySanitizer.
| * support setting a port for rsh:// in sources.listDaniel Hartwig2015-08-122-2/+21
| | | | | | | | | | | | | | [Commiter comment: Untested, but looks and compiles fine, so what could possibly go wrong] Closes: 624727
| * add c++11 override marker to overridden methodsDavid Kalnischkies2015-08-1013-56/+57
| | | | | | | | | | | | | | | | | | C++11 adds the 'override' specifier to mark that a method is overriding a base class method and error out if not. We hide it in the APT_OVERRIDE macro to ensure that we keep compiling in pre-c++11 standards. Reported-By: clang-modernize -add-override -override-macros Git-Dch: Ignore
| * implement Signed-By without using gpg for verificationDavid Kalnischkies2015-08-101-9/+60
| | | | | | | | | | | | | | | | | | | | The previous commit returns to the possibility of using just gpgv for verification proposes. There is one problem through: We can't enforce a specific keyid without using gpg, but our acquire method can as it parses gpgv output anyway, so it can deal with good signatures from not expected signatures and treats them as unknown keys instead. Git-Dch: Ignore
| * allow individual targets to be kept compressedDavid Kalnischkies2015-08-101-6/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is an option to keep all targets (Packages, Sources, …) compressed for a while now, but the all-or-nothing approach is a bit limited for our purposes with additional targets as some of them are very big (Contents) and rarely used in comparison, so keeping them compressed by default can make sense, while others are still unpacked. Most interesting is the copy-change maybe: Copy is used by the acquire system as an uncompressor and it is hence expected that it returns the hashes for the "output", not the input. Now, in the case of keeping a file compressed, the output is never written to disk, but generated in memory and we should still validated it, so for compressed files copy is expected to return the hashes of the uncompressed file. We used to use the config option to enable on-the-fly decompress in the method, but in reality copy is never used in a way where it shouldn't decompress a compressed file to get its hashes, so we can save us the trouble of sending this information to the method and just do it always.
| * implement Signed-By option for sources.listDavid Kalnischkies2015-08-101-8/+10
| | | | | | | | | | | | | | | | | | | | Limits which key(s) can be used to sign a repository. Not immensely useful from a security perspective all by itself, but if the user has additional measures in place to confine a repository (like pinning) an attacker who gets the key for such a repository is limited to its potential and can't use the key to sign its attacks for an other (maybe less limited) repository… (yes, this is as weak as it sounds, but having the capability might come in handy for implementing other stuff later).
| * call URIStart in cdrom and file methodDavid Kalnischkies2015-06-152-9/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All other methods call it, so they should follow along even if the work they do afterwards is hardly breathtaking and usually results in a URIDone pretty soon, but the acquire system tells the individual item about this via a virtual method call, so even through none of our existing items contains any critical code in these, maybe one day they might. Consistency at least once… Which is also why this has a good sideeffect: file: and cdrom: requests appear now in the 'apt-get update' output. Finally - it never made sense to hide them for me. Okay, I guess it made before the new hit behavior, but now that you can actually see the difference in an update it makes sense to see if a file: repository changed or not as well.
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-11-02 16:22:22 +0000