From d34690e1dc76c1e572d9f7ac172dd6b12059f774 Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Fri, 28 May 2010 14:10:00 +0200 Subject: * apt-pkg/deb/debsystem.cc: - add better config item for extended_states file --- doc/apt-mark.8.xml | 7 +------ doc/apt.ent | 8 ++++++++ doc/examples/configure-index | 3 +-- 3 files changed, 10 insertions(+), 8 deletions(-) (limited to 'doc') diff --git a/doc/apt-mark.8.xml b/doc/apt-mark.8.xml index 3f6cc78f5..8e07cd7d9 100644 --- a/doc/apt-mark.8.xml +++ b/doc/apt-mark.8.xml @@ -121,12 +121,7 @@ Files - /var/lib/apt/extended_states - Status list of auto-installed packages. - Configuration Item: Dir::State - sets the path to the extended_states file. - - + &file-extended_states; diff --git a/doc/apt.ent b/doc/apt.ent index 494c6b02c..0d037c8bb 100644 --- a/doc/apt.ent +++ b/doc/apt.ent @@ -363,6 +363,14 @@ "> +/var/lib/apt/extended_states + Status list of auto-installed packages. + Configuration Item: Dir::State::extended_states. + + +"> + diff --git a/doc/examples/configure-index b/doc/examples/configure-index index d168417d8..487c09acb 100644 --- a/doc/examples/configure-index +++ b/doc/examples/configure-index @@ -294,9 +294,8 @@ Dir "/" State "var/lib/apt/" { Lists "lists/"; - xstatus "xstatus"; - userstatus "status.user"; status "/var/lib/dpkg/status"; + extended_states "extended_states"; cdroms "cdroms.list"; }; -- cgit v1.2.3-70-g09d2 From c99e48ec26e693d9aa4a2a9f868284f7aa49784d Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Wed, 9 Jun 2010 00:12:14 +0200 Subject: * ftparchive/writer.cc: - add ValidTime option to generate a Valid-Until header in Release file --- debian/changelog | 2 ++ doc/apt-ftparchive.1.xml | 3 ++- ftparchive/writer.cc | 10 ++++++++++ 3 files changed, 14 insertions(+), 1 deletion(-) (limited to 'doc') diff --git a/debian/changelog b/debian/changelog index 2a40d084e..fa0e667e7 100644 --- a/debian/changelog +++ b/debian/changelog @@ -47,6 +47,8 @@ apt (0.7.26~exp5) experimental; urgency=low * apt-pkg/contrib/strutl.cc: - split StrToTime() into HTTP1.1 and FTP date parser methods and use strptime() instead of some selfmade scanf mangling + * ftparchive/writer.cc: + - add ValidTime option to generate a Valid-Until header in Release file [ Michael Vogt ] * methods/http.{cc,h}: diff --git a/doc/apt-ftparchive.1.xml b/doc/apt-ftparchive.1.xml index a3ac45bd3..549aa6a34 100644 --- a/doc/apt-ftparchive.1.xml +++ b/doc/apt-ftparchive.1.xml @@ -122,7 +122,8 @@ e.g. APT::FTPArchive::Release::Origin. The supported fields are: Origin, Label, Suite, Version, Codename, Date, - Architectures, Components, Description. + Valid-Until, Architectures, + Components, Description. diff --git a/ftparchive/writer.cc b/ftparchive/writer.cc index 6cda29b21..650eec57c 100644 --- a/ftparchive/writer.cc +++ b/ftparchive/writer.cc @@ -924,6 +924,15 @@ ReleaseWriter::ReleaseWriter(string const &DB) datestr[0] = '\0'; } + time_t const validuntil = now + _config->FindI("APT::FTPArchive::Release::ValidTime", 0); + char validstr[128]; + if (now == validuntil || + strftime(validstr, sizeof(validstr), "%a, %d %b %Y %H:%M:%S UTC", + gmtime(&validuntil)) == 0) + { + datestr[0] = '\0'; + } + map Fields; Fields["Origin"] = ""; Fields["Label"] = ""; @@ -931,6 +940,7 @@ ReleaseWriter::ReleaseWriter(string const &DB) Fields["Version"] = ""; Fields["Codename"] = ""; Fields["Date"] = datestr; + Fields["Valid-Until"] = validstr; Fields["Architectures"] = ""; Fields["Components"] = ""; Fields["Description"] = ""; -- cgit v1.2.3-70-g09d2 From b02fffa64833e1f8e2617669d89de0a6d0882747 Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Wed, 9 Jun 2010 10:46:35 +0200 Subject: rename the options, document them and reorder the changelog a bit --- apt-pkg/indexrecords.cc | 4 ++-- debian/changelog | 24 ++++++++++++++++-------- doc/apt.conf.5.xml | 24 ++++++++++++++++++++++++ doc/examples/configure-index | 4 ++++ 4 files changed, 46 insertions(+), 10 deletions(-) (limited to 'doc') diff --git a/apt-pkg/indexrecords.cc b/apt-pkg/indexrecords.cc index cdc2897bf..3bde7437d 100644 --- a/apt-pkg/indexrecords.cc +++ b/apt-pkg/indexrecords.cc @@ -104,9 +104,9 @@ bool indexRecords::Load(const string Filename) /*{{{*/ } } // get the user settings for this archive and use what expires earlier - int MaxAge = _config->FindI("APT::Acquire::Max-Default-Age", 0); + int MaxAge = _config->FindI("Acquire::Max-ValidTime", 0); if (Label.empty() == true) - MaxAge = _config->FindI(string("APT::Acquire::Max-Default-Age::" + Label).c_str(), MaxAge); + MaxAge = _config->FindI(string("Acquire::Max-ValidTime::" + Label).c_str(), MaxAge); if(MaxAge == 0) // No user settings, use the one from the Release file return true; diff --git a/debian/changelog b/debian/changelog index 049999230..c3f7a3e25 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,10 +1,25 @@ -apt (0.7.26~exp5) experimental; urgency=low +apt (0.7.26~exp6) UNRELEASED; urgency=low [ David Kalnischkies ] + * doc/apt.conf.5.xml: + - document the new Valid-Until related options * apt-pkg/indexrecords.cc: - backport forgotten Valid-Until patch from the obsolete experimental branch to prevent replay attacks better, thanks to Thomas Viehmann for the initial patch! (Closes: #499897) + * apt-pkg/contrib/strutl.cc: + - split StrToTime() into HTTP1.1 and FTP date parser methods and + use strptime() instead of some self-made scanf mangling + - use the portable timegm shown in his manpage instead of a strange + looking code copycat from wget + * ftparchive/writer.cc: + - add ValidTime option to generate a Valid-Until header in Release file + + -- David Kalnischkies Wed, 09 Jun 2010 10:43:58 +0200 + +apt (0.7.26~exp5) experimental; urgency=low + + [ David Kalnischkies ] * cmdline/apt-get.cc: - rerun dpkg-source in source if --fix-broken is given (Closes: #576752) - don't suggest held packages as they are installed (Closes: #578135) @@ -44,13 +59,6 @@ apt (0.7.26~exp5) experimental; urgency=low - add 'disappear' to the known processing states, thanks Jonathan Nieder * apt-pkg/packagemanager.h: - export info about disappeared packages with GetDisappearedPackages() - * apt-pkg/contrib/strutl.cc: - - split StrToTime() into HTTP1.1 and FTP date parser methods and - use strptime() instead of some selfmade scanf mangling - - use the portable timegm shown in his manpage instead of a strange - looking code copycat from wget - * ftparchive/writer.cc: - - add ValidTime option to generate a Valid-Until header in Release file [ Michael Vogt ] * methods/http.{cc,h}: diff --git a/doc/apt.conf.5.xml b/doc/apt.conf.5.xml index fe005e0f1..0cf4bb663 100644 --- a/doc/apt.conf.5.xml +++ b/doc/apt.conf.5.xml @@ -230,6 +230,30 @@ DPkg::Pre-Install-Pkgs {"/usr/sbin/dpkg-preconfigure --apt";}; and the URI handlers. + Check-Valid-Until + Security related option defaulting to true as an + expiring validation for a Release file prevents longtime replay attacks + and can e.g. also help users to identify no longer updated mirrors - + but the feature depends on the correctness of the time on the user system. + Archive maintainers are encouraged to create Release files with the + Valid-Until header, but if they don't or a stricter value + is volitional the following Max-ValidTime option can be used. + + + + Max-ValidTime + Seconds the Release file should be considered valid after + it was created. The default is "for ever" (0) if the Release file of the + archive doesn't include a Valid-Until header. + If it does then this date is the default. The date from the Release file or + the date specified by the creation time of the Release file + (Date header) plus the seconds specified with this + options are used to check if the validation of a file has expired by using + the earlier date of the two. Archive specific settings can be made by + appending the label of the archive to the option name. + + + PDiffs Try to download deltas called PDiffs for Packages or Sources files instead of downloading whole ones. True diff --git a/doc/examples/configure-index b/doc/examples/configure-index index d168417d8..127feb9e9 100644 --- a/doc/examples/configure-index +++ b/doc/examples/configure-index @@ -176,6 +176,10 @@ Acquire PDiffs::SizeLimit "50"; // don't use diffs if size of all patches excess // 50% of the size of the original file + Check-Valid-Until "true"; + Max-ValidTime "864000"; // 10 days + Max-ValidTime::Debian-Security "604800"; // 7 days, label specific configuration + // HTTP method configuration http { -- cgit v1.2.3-70-g09d2