summaryrefslogtreecommitdiff
path: root/methods
Commit message (Collapse)AuthorAgeFilesLines
* methods/gpgv: Remove apt-key mentionsJulian Andres Klode2024-12-071-3/+3
|
* Detect working gpgv using gpgv --dump-optionsJulian Andres Klode2024-11-281-0/+6
| | | | | | | | | | | | This gains us support for not using an absolute path, which is nice, and we can now cache the invocation across fork() in the method. Still keep preferring absolute paths, this avoids execvp() having to iterate the path and reduces bug potential with custom gpgv in /usr/local. Fix the last entry in the list of gpgvs to say gpgv1
* Do not implode key file name vector for calling gpgvJulian Andres Klode2024-11-281-2/+1
| | | | Converting it to a comma-separated string and back loses precision.
* Merge branch 'fix/partialfilemirror' into 'main'Julian Andres Klode2024-11-224-86/+135
|\ | | | | | | | | Support uncompressed indexes from partial file:/ mirrors See merge request apt-team/apt!235
| * Look at non by-hash paths in copy and file methodsDavid Kalnischkies2024-11-223-86/+126
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ideally copy and file mirrors would support by-hash as well, but its harder to setup and maintain especially if you want to cache an online mirror who has by-hash enabled. We can avoid unneeded roundtrips (in the best case) and entire cache misses (in the usual worst case) by "just" telling methods that the URI we passed it has the requested file perhaps also in other paths. This is done in pseudo-relative paths as we would otherwise need to teach redirection code to rewrite those URIs as well. A method like http can easily ignore this value and await explicit instructions to look at that file, but inspecting the path in local sources via file or copy is (comparatively) free, so we just do it immediately. If that ends up being the wrong version of the file as by-hash would have protected us from we are in this feature branch now falling back to other mirrors which are like the ones online and in support of by-hash.
| * Do not assume mirror-URIs end in a filename causing a hangDavid Kalnischkies2024-11-221-2/+9
| | | | | | | | | | | | | | In practice most of them will, but making the acquire process hang in response if they don't seems like an overly excessive response if we can just support it gracefully to reply with an error (or actually succeed in the unlikely event this URI is actually correct).
| * Alternatively calculate alternative file hashes in file methodDavid Kalnischkies2024-11-221-0/+2
| | | | | | | | | | | | | | If we do not have the requested file we haven't calculated the hashes for it either and it is likely that the alternative file will be used, so to save the main thread from being busy with calculating hashes we do the calculation here in the method.
* | Tag hidden acquire classes as final for devirtualizationDavid Kalnischkies2024-11-227-9/+9
|/ | | | | | | gcc reports `warning: Declaring type ‘class X’ final would enable devirtualization of Y calls [-Wsuggest-final-types]`. Not that this would massively improve performance, but it shouldn't hurt telling the compiler what is obvious for a human.
* http: use Retry-After HTTP header to optimize retriesFelix Moessbauer2024-11-182-1/+29
| | | | | | | | | | | | | | | | | | | Some mirrors like snapshot.debian.org apply strict http rate limits. While apt already has an exponential backoff mechanism implemented, this is not sufficient due to the following reasons: 1. all retries happen roughly at the same time 2. the retry-after information from the server is not used We fix this by improving the algorithm: First, if present, the timestamp or duration of the Retry-After header is added to the exponential backoff, optimizing for success-on-second-try. Second, a random delay is added (delay += [0, delay]) to distribute the retries to not immediately run into the limit again. To avoid super-long delays, this is capped by the configured maximum delay. This logic only becomes active if the option Acquire::Retries::HandleRetryAfter is enabled. Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
* methods/http.cc: APT::StringView -> std::string_viewнаб2024-11-121-4/+3
|
* Turn char[APT_BUFFER_SIZE] buffers into std::array<char, APT_BUFFER_SIZE>наб2024-11-111-4/+5
|
* Remove ftp, rsh, ssh methods (disabled since 1.8)Julian Andres Klode2024-11-075-1921/+2
| | | | | | | | | These methods have been unsupported and disabled since 1.8, remove them for the 3.0 cleanup. Please migrate to http instead. If you need ad-hoc access to a remote repository, you can run `python3 -m http.server` on that machine and use SSH port forwarding to run http over ssh.
* Bump read()/write() loop buffers from 4k to APT_BUFFER_SIZE (64k). Bump ↵наб2024-11-072-2/+2
| | | | FileFdPrivate's read()/discard buffer from 1k to APT_BUFFER_SIZE (64k)
* Only revoke weak RSA keys for now, add 'next' and 'future' levelsJulian Andres Klode2024-07-151-0/+11
| | | | | | | | | | | Algorithms not in the next level give a warning, algorithms in not in the future level introduce an audit message for the --audit flag. next: >=rsa2048,ed25519,ed448,nistp256,nistp384,nistp512 future: >=rsa3072,ed25519,ed448 LP: #2073126
* gpgv: Add a LaterWorthless level, a SoonWorthless but at 'audit' levelJulian Andres Klode2024-07-151-0/+10
|
* worker: Add an audit level to log audit messagesJulian Andres Klode2024-07-151-2/+10
|
* Revert "Temporarily downgrade key assertions to "soon worthless""Julian Andres Klode2024-04-091-1/+8
| | | | | | | | | | | | | We temporarily downgraded the errors to warnings to give the launchpad PPAs time to be fixed, but warnings are not safe: Untrusted keys could be hiding on your system, but just not used at the moment. Hence revert this so we get the errors we want. This reverts commit 66998ed3d299bede651ad40368bdb270f5f5b0f9. LP: #2060721 Gbp-Dch: full
* Support building without gnutlsSteve Langasek2024-03-033-6/+26
| | | | | | | | | Once in a generation, it may be necessary to bootstrap apt in an environment where gnutls is not yet available. This makes gnutls support in apt optional. You may also want a configure flag to force gnutls to be required from outside the buildsystem (e.g. debian/rules).
* Temporarily downgrade key assertions to "soon worthless"Julian Andres Klode2024-02-281-8/+1
| | | | | This will only issue warnings instead of errors while we continue cleaning up our repositories.
* Rename 'weak digest algorithm' to 'weak algorithm'Julian Andres Klode2024-02-281-1/+1
| | | | This allows us to render public key algorithms as weak as well.
* Implement gpgv --assert-pubkey-algo=>=rsa2048,ed25519,ed448Julian Andres Klode2024-02-281-0/+20
| | | | | | | | | | | | The assertion can be overriden using apt::key::assert-pubkey-algo, the default is the most opinionated one. This will inform the user during apt-cdrom add as we do not pass --quiet to user, so adjust test case. Add a simple test case for it to test-method-gpgv. LP: #2055193
* gpgv: Add a reason to worthless signersJulian Andres Klode2024-02-281-6/+26
|
* gpgv: Surface [GNUPG:] ERROR and [GNUPG:] WARNING status messagesJulian Andres Klode2024-02-281-0/+9
|
* Modernize standard library includesJulian Andres Klode2024-02-2014-47/+47
| | | | | | This was automated with sed and git-clang-format, and then I had to fix up the top of policy.cc by hand as git-clang-format accidentally indented it by two spaces.
* methods: store: Use APT_BUFFER_SIZE (64k) instead of 4k buffersJulian Andres Klode2023-08-301-1/+1
|
* We do not believe rsh was supposed to exclude GPL-3Julian Andres Klode2023-03-061-0/+14
|
* Ignore return of .c_str() in preemptive call for signal handlerDavid Kalnischkies2023-01-293-3/+3
| | | | | Reported-By: gcc-13 -Wunused-result Gbp-Dch: Ignore
* Actually delete temporary apt-key.*.asc helper filesJulian Andres Klode2022-10-311-1/+1
| | | | | | | During development there was an if (0) there for debugging purposes that unfortunately stayed in and caused files to accumulate. LP: #1995247
* Fix mirror method dequeuing incorrect itemsTroy Varney2022-04-281-2/+14
| | | | | | | | | | | | | When the mirror method handles a URI Acquire from apt for a mirror list it already has, it calls the `RedirectItem` function directly. This function assumes that the item being redirected is at the head of the queue, and as such calls `Dequeue` to remove it from the queue. This resulted in incorrect items being removed from the queue when this branch is taken and the queue was already non-empty, as the item to be handled in this case is actually the last item in the queue. This changes `RedirectItem` to properly remove the item passed to it instead of calling Dequeue.
* gpgv: Use Valid instead of Good to determine fallbackJulian Andres Klode2022-03-071-2/+2
| | | | | | | | | | | | Change the logic to use "Valid" instead of "Good" to determine whether we need to fallback and if fallback was successful. That means that if you have an expired key in trusted.gpg.d, and a non-expired in trusted.gpg, verification will now fail directly with the expired key in trusted.gpg.d and not try to fallback. Likewise, if the key in trusted.gpg is expired, this will now also be reported correctly again, instead of producing an error message that the key could not be found.
* gpgv: Fix legacy fallback on unavailable keysJulian Andres Klode2022-03-071-4/+10
| | | | | | | | | | | | | | | | | | | | | If a repository is signed with multiple keys, apt 2.4.0 would ignore the fallback result if some keys were still missing, causing signature verification to fail. Rework the logic such that when checking if fallback was "succesful", missing keys are ignored - it only matters if we managed to verify one key now, whether good or bad. Likewise, simplify the logic when to do the fallback: If there was a bad signature in trusted.gpg.d, do NOT fallback at all - this is a minor security issue, as a key in trusted.gpg.d could fail silently with a bad signature, and then a key in trusted.gpg might allow the signature to succeed (as trusted.gpg.d key is then missing). Only fallback if we are missing a good signature, and there are keys we have not yet checked.
* Warn if the legacy trusted.gpg keyring is used for verificationJulian Andres Klode2022-02-221-1/+43
| | | | | With apt-key going away, people need to manage key files, rather than keys, so they need to know if any keys are in the legacy keyring.
* Spelling fixesVille Skyttä2021-11-271-3/+3
|
* basehttp: Rename HaveContent's TristateCameron Katri2021-11-232-22/+22
| | | | | | Darwin systems define TRUE and FALSE as preprocessor macros for use with bool. This conflicts with the enum values causing the compilation to fail.
* Add support for embedding PGP keys into Signed-By in deb822 sourcesJulian Andres Klode2021-10-181-5/+29
| | | | | | Extend the Signed-By field to handle embedded public key blocks, this allows shipping self-contained .sources files, making it substantially easier to provide third party repositories.
* Merge branch 'pu/content-length-0' into 'main'Julian Andres Klode2021-10-182-15/+28
|\ | | | | | | | | basehttp: Turn HaveContent into a TriState See merge request apt-team/apt!179
| * Set haveContent to FALSE on `Content-Length: 0`Julian Andres Klode2021-07-011-3/+9
| | | | | | | | | | | | | | | | Set haveContent to HaveContent::FALSE when Content-Length is 0, and change remaining code to only set it to TRUE if it has not been set so far. Closes: #990281
| * basehttp: Turn HaveContent into a TriStateJulian Andres Klode2021-07-012-15/+22
| | | | | | | | | | | | We need to be able to set HaveContent to false if the Content-Length is 0, and not have that overriden just because a later header is Content-Type.
* | Merge branch 'pu/ifrange' into 'main'Julian Andres Klode2021-10-181-2/+29
|\ \ | | | | | | | | | | | | Add AllowRange option to disable HTTP Range usage See merge request apt-team/apt!188
| * | Disable HTTP Range usage if varnish < 6.4 is involvedDavid Kalnischkies2021-09-161-0/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Debian buster (oldstable) ships 6.1 while bullseye (stable) ships 6.5 and so the later is 'fixed'. Upstream declares 6.0 still as supported. It might be still a while we encounter "bad" versions in the wild, so if we can detect and work around the issue at runtime automatically we can save some users from running into "persistent" partial files. References: https://varnish-cache.org/docs/6.4/whats-new/changes-6.4.html#changes-in-behavior
| * | Add AllowRange option to disable HTTP Range usageDavid Kalnischkies2021-09-161-2/+2
| |/ | | | | | | | | | | | | | | apt makes heavy usage of HTTP1.1 features including Range and If-Range. Sadly it is not obvious if the involved server(s) (and proxies) actually support them all. The Acquire::http::AllowRange option defaults to true as before, but now a user can disable Range usage if it is known that the involved server is not dealing with such requests correctly.
* / Use https config on https proxies for http serversDavid Kalnischkies2021-09-134-69/+82
|/ | | | | | | | | | The settings used for unwrapping TLS connections depend on the access and hostname we connect to more than what we eventually unwrap. The bugreport mentions CaInfo, but all other https-settings should also apply (regardless of generic or hostname specific) to an https proxy, even if the connection we proxy through it is http-only. Closes: #990555
* Turn TLS handshake issues into transient errorsJulian Andres Klode2021-05-121-1/+1
| | | | | | | This makes them retriable, and brings them more into line with TCP, where handshake is also a transient error. LP: #1928100
* Fix downloads of unsized files that are largest in pipelineJulian Andres Klode2021-04-131-0/+4
| | | | | | | | | The maximum request size is accidentally set to any sized file, so if an unsized file is present, and it turns out to be larger than the maximum size we set, we'd error out when checking if its size is smaller than the maximum request size. LP: #1921626
* Allow merging with empty pdiff patchesDavid Kalnischkies2021-03-061-1/+5
| | | | | | | | There isn't a lot of sense in working on empty patches as they change nothing (quite literally), but they can be the result of merging multiple patches and so to not require our users to specifically detect and remove them, we can be nice and just ignore them instead of erroring out.
* Ensure HTTP status code text has sensible contentDavid Kalnischkies2021-02-042-1/+4
| | | | | | | We use the code in error messages, so at least for that edgecase we should ensure that it has sensible content. Note that the acquire system aborts on non-sensible message content in SendMessage, so you can't really exploit this.
* Replace PrintStatus with SendMessage usageDavid Kalnischkies2021-02-043-15/+27
| | | | | | | varg API is a nightmare as the symbols seems different on ever other arch, but more importantly SendMessage does a few checks on the content of the message and it is all outputted via C++ iostreams and not mixed in FILE* which is handy for overriding the streams.
* Use error reporting instead of assert in rred patchingDavid Kalnischkies2021-02-041-68/+88
| | | | | | | | | | | The rest of our code uses return-code errors and it isn't that nice to crash the rred method on bad patches anyway, so we move to properly reporting errors in our usual way which incidently also helps writing a fuzzer for it. This is not really security relevant though as the patches passed hash verification while they were downloaded, so an attacker has to overtake a trusted repository first which gives plenty better options of attack.
* connect: use ServiceNameOrPort, not Port, as the cache keyFaidon Liambotis2020-12-231-4/+7
| | | | | | | | | | | | | | | | | | | The "last connection" cache is currently being stored and looked up on the combination of (LastHost, LastPort). However, these are not what the arguments to getaddrinfo() were on the first try: the call is to getaddrinfo(Host, ServiceNameOrPort, ...), i.e. with the port *or if 0, the service name* (e.g. http). Effectively this means that the connection cache lookup for: https://example.org/... i.e. Host = example.org, Port = 0, Service = http would end up matching the "last" connection of (if existed): https://example.org/... i.e. Host = example.org, Port = 0, Service = https ...and thus performing a TLS request over an (unrelated) port 80 connection. Therefore, an HTTP request, followed up by an (unrelated) HTTPS request to the same server, would always fail. Address this by using as the cache key the ServiceNameOrPort, rather than Port.
* connect: convert a C-style string to std::stringFaidon Liambotis2020-12-231-11/+8
| | | | | | | | Convert the fixed-size (300) char array "ServStr" to a std::string, and simplify the code by removing snprintfs in the process. While at it, rename to the more aptly named "ServiceNameOrPort" and update the comment to reflect what this variable is meant to be.
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2026-10-14 14:29:57 +0000