From 448c38bdcd72b52f11ec5f326f822cf57653f81c Mon Sep 17 00:00:00 2001
From: David Kalnischkies <david@kalnischkies.de>
Date: Sat, 6 Jun 2015 12:28:00 +0200
Subject: rework hashsum verification in the acquire system
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Having every item having its own code to verify the file(s) it handles
is an errorprune process and easy to break, especially if items move
through various stages (download, uncompress, patching, …). With a giant
rework we centralize (most of) the verification to have a better
enforcement rate and (hopefully) less chance for bugs, but it breaks the
ABI bigtime in exchange – and as we break it anyway, it is broken even
harder.

It shouldn't effect most frontends as they don't deal with the acquire
system at all or implement their own items, but some do and will need to
be patched (might be an opportunity to use apt on-board material).

The theory is simple: Items implement methods to decide if hashes need to
be checked (in this stage) and to return the expected hashes for this
item (in this stage). The verification itself is done in worker message
passing which has the benefit that a hashsum error is now a proper error
for the acquire system rather than a Done() which is later revised to a
Failed().
---
 methods/file.cc | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'methods')

diff --git a/methods/file.cc b/methods/file.cc
index 043ab04b8..353e54bd5 100644
--- a/methods/file.cc
+++ b/methods/file.cc
@@ -57,7 +57,11 @@ bool FileMethod::Fetch(FetchItem *Itm)
       Res.LastModified = Buf.st_mtime;
       Res.IMSHit = false;
       if (Itm->LastModified == Buf.st_mtime && Itm->LastModified != 0)
-	 Res.IMSHit = true;
+      {
+	 unsigned long long const filesize = Itm->ExpectedHashes.FileSize();
+	 if (filesize != 0 && filesize == Res.Size)
+	    Res.IMSHit = true;
+      }
    }
 
    // See if the uncompressed file exists and reuse it
-- 
cgit v1.2.3-70-g09d2


From 3679515479136179e0d95325a6559fcc6d0af7f8 Mon Sep 17 00:00:00 2001
From: David Kalnischkies <david@kalnischkies.de>
Date: Sat, 6 Jun 2015 19:16:45 +0200
Subject: check patch hashes in rred worker instead of in the handler
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

rred is responsible for unpacking and reading the patch files in one go,
but we currently only have hashes for the uncompressed patch files, so
the handler read the entire patch file before dispatching it to the
worker which would read it again – both with an implicit uncompress.
Worse, while the workers operate in parallel the handler is the central
orchestration unit, so having it busy with work means the workers do
(potentially) nothing.

This means rred is working with 'untrusted' data, which is bad. Yet,
having the unpack in the handler meant that the untrusted uncompress was
done as root which isn't better either. Now, we have it at least
contained in a binary which we can harden a bit better. In the long run,
we want hashes for the compressed patch files through to be safe.
---
 apt-pkg/acquire-item.cc           | 95 +++++++++++++++++++++++----------------
 apt-pkg/acquire-item.h            |  2 +
 apt-pkg/acquire-method.cc         | 14 +++---
 apt-pkg/acquire-method.h          |  5 ++-
 methods/rred.cc                   | 62 ++++++++++++++++++++-----
 test/integration/test-pdiff-usage |  2 +
 6 files changed, 121 insertions(+), 59 deletions(-)

(limited to 'methods')

diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc
index ec6ec6e84..7b69ee993 100644
--- a/apt-pkg/acquire-item.cc
+++ b/apt-pkg/acquire-item.cc
@@ -95,6 +95,19 @@ static std::string GetCompressedFileName(std::string const &URI, std::string con
    return Name;
 }
 									/*}}}*/
+static std::string GetMergeDiffsPatchFileName(std::string const &Final, std::string const &Patch)/*{{{*/
+{
+   // rred expects the patch as $FinalFile.ed.$patchname.gz
+   return Final + ".ed." + Patch + ".gz";
+}
+									/*}}}*/
+static std::string GetDiffsPatchFileName(std::string const &Final)	/*{{{*/
+{
+   // rred expects the patch as $FinalFile.ed
+   return Final + ".ed";
+}
+									/*}}}*/
+
 static bool AllowInsecureRepositories(indexRecords const * const MetaIndexParser, pkgAcqMetaBase * const TransactionManager, pkgAcquire::Item * const I) /*{{{*/
 {
    if(MetaIndexParser->IsAlwaysTrusted() || _config->FindB("Acquire::AllowInsecureRepositories") == true)
@@ -1860,6 +1873,9 @@ void pkgAcqIndexDiffs::Failed(string const &Message,pkgAcquire::MethodConfig con
 		<< "Falling back to normal index file acquire" << std::endl;
    DestFile = GetPartialFileNameFromURI(Target->URI);
    RenameOnError(PDiffError);
+   std::string const patchname = GetDiffsPatchFileName(DestFile);
+   if (RealFileExists(patchname))
+      rename(patchname.c_str(), std::string(patchname + ".FAILED").c_str());
    new pkgAcqIndex(Owner, TransactionManager, Target);
    Finish();
 }
@@ -1968,28 +1984,13 @@ void pkgAcqIndexDiffs::Done(string const &Message, HashStringList const &Hashes,
 
    Item::Done(Message, Hashes, Cnf);
 
-   // FIXME: verify this download too before feeding it to rred
    std::string const FinalFile = GetPartialFileNameFromURI(Target->URI);
+   std::string const PatchFile = GetDiffsPatchFileName(FinalFile);
 
    // success in downloading a diff, enter ApplyDiff state
    if(State == StateFetchDiff)
    {
-      FileFd fd(DestFile, FileFd::ReadOnly, FileFd::Gzip);
-      class Hashes LocalHashesCalc;
-      LocalHashesCalc.AddFD(fd);
-      HashStringList const LocalHashes = LocalHashesCalc.GetHashStringList();
-
-      if (fd.Size() != available_patches[0].patch_size ||
-	    available_patches[0].patch_hashes != LocalHashes)
-      {
-	 // patchfiles are dated, so bad indicates a bad download, so kill it
-	 unlink(DestFile.c_str());
-	 Failed("Patch has Size/Hashsum mismatch", NULL);
-	 return;
-      }
-
-      // rred excepts the patch as $FinalFile.ed
-      Rename(DestFile,FinalFile+".ed");
+      Rename(DestFile, PatchFile);
 
       if(Debug)
 	 std::clog << "Sending to rred method: " << FinalFile << std::endl;
@@ -2000,18 +2001,17 @@ void pkgAcqIndexDiffs::Done(string const &Message, HashStringList const &Hashes,
       QueueURI(Desc);
       SetActiveSubprocess("rred");
       return;
-   } 
-
+   }
 
    // success in download/apply a diff, queue next (if needed)
    if(State == StateApplyDiff)
    {
       // remove the just applied patch
       available_patches.erase(available_patches.begin());
-      unlink((FinalFile + ".ed").c_str());
+      unlink(PatchFile.c_str());
 
       // move into place
-      if(Debug) 
+      if(Debug)
       {
 	 std::clog << "Moving patched file in place: " << std::endl
 		   << DestFile << " -> " << FinalFile << std::endl;
@@ -2031,6 +2031,18 @@ void pkgAcqIndexDiffs::Done(string const &Message, HashStringList const &Hashes,
    }
 }
 									/*}}}*/
+std::string pkgAcqIndexDiffs::Custom600Headers() const			/*{{{*/
+{
+   if(State != StateApplyDiff)
+      return pkgAcqBaseIndex::Custom600Headers();
+   std::ostringstream patchhashes;
+   HashStringList const ExpectedHashes = available_patches[0].patch_hashes;
+   for (HashStringList::const_iterator hs = ExpectedHashes.begin(); hs != ExpectedHashes.end(); ++hs)
+      patchhashes <<  "\nPatch-0-" << hs->HashType() << "-Hash: " << hs->HashValue();
+   patchhashes << pkgAcqBaseIndex::Custom600Headers();
+   return patchhashes.str();
+}
+									/*}}}*/
 
 // AcqIndexMergeDiffs::AcqIndexMergeDiffs - Constructor			/*{{{*/
 pkgAcqIndexMergeDiffs::pkgAcqIndexMergeDiffs(pkgAcquire * const Owner,
@@ -2079,6 +2091,9 @@ void pkgAcqIndexMergeDiffs::Failed(string const &Message,pkgAcquire::MethodConfi
       std::clog << "Falling back to normal index file acquire" << std::endl;
    DestFile = GetPartialFileNameFromURI(Target->URI);
    RenameOnError(PDiffError);
+   std::string const patchname = GetMergeDiffsPatchFileName(DestFile, patch.file);
+   if (RealFileExists(patchname))
+      rename(patchname.c_str(), std::string(patchname + ".FAILED").c_str());
    new pkgAcqIndex(Owner, TransactionManager, Target);
 }
 									/*}}}*/
@@ -2090,26 +2105,10 @@ void pkgAcqIndexMergeDiffs::Done(string const &Message, HashStringList const &Ha
 
    Item::Done(Message, Hashes, Cnf);
 
-   // FIXME: verify download before feeding it to rred
    string const FinalFile = GetPartialFileNameFromURI(Target->URI);
-
    if (State == StateFetchDiff)
    {
-      FileFd fd(DestFile, FileFd::ReadOnly, FileFd::Gzip);
-      class Hashes LocalHashesCalc;
-      LocalHashesCalc.AddFD(fd);
-      HashStringList const LocalHashes = LocalHashesCalc.GetHashStringList();
-
-      if (fd.Size() != patch.patch_size || patch.patch_hashes != LocalHashes)
-      {
-	 // patchfiles are dated, so bad indicates a bad download, so kill it
-	 unlink(DestFile.c_str());
-	 Failed("Patch has Size/Hashsum mismatch", NULL);
-	 return;
-      }
-
-      // rred expects the patch as $FinalFile.ed.$patchname.gz
-      Rename(DestFile, FinalFile + ".ed." + patch.file + ".gz");
+      Rename(DestFile, GetMergeDiffsPatchFileName(FinalFile, patch.file));
 
       // check if this is the last completed diff
       State = StateDoneDiff;
@@ -2158,7 +2157,7 @@ void pkgAcqIndexMergeDiffs::Done(string const &Message, HashStringList const &Ha
 	    I != allPatches->end(); ++I)
       {
 	 std::string const PartialFile = GetPartialFileNameFromURI(Target->URI);
-	 std::string patch = PartialFile + ".ed." + (*I)->patch.file + ".gz";
+	 std::string const patch = GetMergeDiffsPatchFileName(PartialFile, (*I)->patch.file);
 	 unlink(patch.c_str());
       }
       unlink(FinalFile.c_str());
@@ -2170,6 +2169,24 @@ void pkgAcqIndexMergeDiffs::Done(string const &Message, HashStringList const &Ha
    }
 }
 									/*}}}*/
+std::string pkgAcqIndexMergeDiffs::Custom600Headers() const		/*{{{*/
+{
+   if(State != StateApplyDiff)
+      return pkgAcqBaseIndex::Custom600Headers();
+   std::ostringstream patchhashes;
+   unsigned int seen_patches = 0;
+   for (std::vector<pkgAcqIndexMergeDiffs *>::const_iterator I = allPatches->begin();
+	 I != allPatches->end(); ++I)
+   {
+      HashStringList const ExpectedHashes = (*I)->patch.patch_hashes;
+      for (HashStringList::const_iterator hs = ExpectedHashes.begin(); hs != ExpectedHashes.end(); ++hs)
+	 patchhashes <<  "\nPatch-" << seen_patches << "-" << hs->HashType() << "-Hash: " << hs->HashValue();
+      ++seen_patches;
+   }
+   patchhashes << pkgAcqBaseIndex::Custom600Headers();
+   return patchhashes.str();
+}
+									/*}}}*/
 
 // AcqIndex::AcqIndex - Constructor					/*{{{*/
 pkgAcqIndex::pkgAcqIndex(pkgAcquire * const Owner,
diff --git a/apt-pkg/acquire-item.h b/apt-pkg/acquire-item.h
index 97d5ea1dd..f24af1aec 100644
--- a/apt-pkg/acquire-item.h
+++ b/apt-pkg/acquire-item.h
@@ -774,6 +774,7 @@ class APT_HIDDEN pkgAcqIndexMergeDiffs : public pkgAcqBaseIndex
    virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf);
    virtual void Done(std::string const &Message, HashStringList const &Hashes,
 	 pkgAcquire::MethodConfig const * const Cnf);
+   virtual std::string Custom600Headers() const;
    virtual std::string DescURI() const {return Target->URI + "Index";};
    virtual HashStringList GetExpectedHashes() const;
    virtual bool HashesRequired() const;
@@ -886,6 +887,7 @@ class APT_HIDDEN pkgAcqIndexDiffs : public pkgAcqBaseIndex
 
    virtual void Done(std::string const &Message, HashStringList const &Hashes,
 		     pkgAcquire::MethodConfig const * const Cnf);
+   virtual std::string Custom600Headers() const;
    virtual std::string DescURI() const {return Target->URI + "IndexDiffs";};
    virtual HashStringList GetExpectedHashes() const;
    virtual bool HashesRequired() const;
diff --git a/apt-pkg/acquire-method.cc b/apt-pkg/acquire-method.cc
index b77096efd..a8fc75f8e 100644
--- a/apt-pkg/acquire-method.cc
+++ b/apt-pkg/acquire-method.cc
@@ -388,14 +388,14 @@ int pkgAcqMethod::Run(bool Single)
 	    *I = Tmp;
 	    if (QueueBack == 0)
 	       QueueBack = Tmp;
-	    
+
 	    // Notify that this item is to be fetched.
-	    if (Fetch(Tmp) == false)
+	    if (URIAcquire(Message, Tmp) == false)
 	       Fail();
-	    
-	    break;					     
-	 }   
-      }      
+
+	    break;
+	 }
+      }
    }
 
    Exit();
@@ -403,8 +403,6 @@ int pkgAcqMethod::Run(bool Single)
 }
 									/*}}}*/
 // AcqMethod::PrintStatus - privately really send a log/status message	/*{{{*/
-// ---------------------------------------------------------------------
-/* */
 void pkgAcqMethod::PrintStatus(char const * const header, const char* Format,
 			       va_list &args) const
 {
diff --git a/apt-pkg/acquire-method.h b/apt-pkg/acquire-method.h
index 399454892..6480eb4b5 100644
--- a/apt-pkg/acquire-method.h
+++ b/apt-pkg/acquire-method.h
@@ -76,11 +76,12 @@ class pkgAcqMethod
    std::string FailReason;
    std::string UsedMirror;
    std::string IP;
-   
+
    // Handlers for messages
    virtual bool Configuration(std::string Message);
    virtual bool Fetch(FetchItem * /*Item*/) {return true;};
-   
+   virtual bool URIAcquire(std::string const &/*Message*/, FetchItem *Itm) { return Fetch(Itm); };
+
    // Outgoing messages
    void Fail(bool Transient = false);
    inline void Fail(const char *Why, bool Transient = false) {Fail(std::string(Why),Transient);};
diff --git a/methods/rred.cc b/methods/rred.cc
index 554ac99b4..3da33c126 100644
--- a/methods/rred.cc
+++ b/methods/rred.cc
@@ -388,7 +388,7 @@ class Patch {
 
    public:
 
-   void read_diff(FileFd &f)
+   void read_diff(FileFd &f, Hashes * const h)
    {
       char buffer[BLOCK_SIZE];
       bool cmdwanted = true;
@@ -396,6 +396,8 @@ class Patch {
       Change ch(0);
       while(f.ReadLine(buffer, sizeof(buffer)))
       {
+	 if (h != NULL)
+	    h->Add(buffer);
 	 if (cmdwanted) {
 	    char *m, *c;
 	    size_t s, e;
@@ -519,8 +521,29 @@ class RredMethod : public pkgAcqMethod {
    private:
       bool Debug;
 
+      struct PDiffFile {
+	 std::string FileName;
+	 HashStringList ExpectedHashes;
+	 PDiffFile(std::string const &FileName, HashStringList const &ExpectedHashes) :
+	    FileName(FileName), ExpectedHashes(ExpectedHashes) {}
+      };
+
+      HashStringList ReadExpectedHashesForPatch(unsigned int const patch, std::string const &Message)
+      {
+	 HashStringList ExpectedHashes;
+	 for (char const * const * type = HashString::SupportedHashes(); *type != NULL; ++type)
+	 {
+	    std::string tagname;
+	    strprintf(tagname, "Patch-%d-%s-Hash", patch, *type);
+	    std::string const hashsum = LookupTag(Message, tagname.c_str());
+	    if (hashsum.empty() == false)
+	       ExpectedHashes.push_back(HashString(*type, hashsum));
+	 }
+	 return ExpectedHashes;
+      }
+
    protected:
-      virtual bool Fetch(FetchItem *Itm) {
+      virtual bool URIAcquire(std::string const &Message, FetchItem *Itm) {
 	 Debug = _config->FindB("Debug::pkgAcquire::RRed", false);
 	 URI Get = Itm->Uri;
 	 std::string Path = Get.Host + Get.Path; // rred:/path - no host
@@ -534,11 +557,17 @@ class RredMethod : public pkgAcqMethod {
 	 } else
 	    URIStart(Res);
 
-	 std::vector<std::string> patchpaths;
+	 std::vector<PDiffFile> patchfiles;
 	 Patch patch;
 
 	 if (FileExists(Path + ".ed") == true)
-	    patchpaths.push_back(Path + ".ed");
+	 {
+	    HashStringList const ExpectedHashes = ReadExpectedHashesForPatch(0, Message);
+	    std::string const FileName = Path + ".ed";
+	    if (ExpectedHashes.usable() == false)
+	       return _error->Error("No hashes found for uncompressed patch: %s", FileName.c_str());
+	    patchfiles.push_back(PDiffFile(FileName, ExpectedHashes));
+	 }
 	 else
 	 {
 	    _error->PushToStack();
@@ -546,18 +575,27 @@ class RredMethod : public pkgAcqMethod {
 	    _error->RevertToStack();
 
 	    std::string const baseName = Path + ".ed.";
+	    unsigned int seen_patches = 0;
 	    for (std::vector<std::string>::const_iterator p = patches.begin();
 		  p != patches.end(); ++p)
+	    {
 	       if (p->compare(0, baseName.length(), baseName) == 0)
-		  patchpaths.push_back(*p);
+	       {
+		  HashStringList const ExpectedHashes = ReadExpectedHashesForPatch(seen_patches, Message);
+		  if (ExpectedHashes.usable() == false)
+		     return _error->Error("No hashes found for uncompressed patch %d: %s", seen_patches, p->c_str());
+		  patchfiles.push_back(PDiffFile(*p, ExpectedHashes));
+		  ++seen_patches;
+	       }
+	    }
 	 }
 
 	 std::string patch_name;
-	 for (std::vector<std::string>::iterator I = patchpaths.begin();
-	       I != patchpaths.end();
+	 for (std::vector<PDiffFile>::iterator I = patchfiles.begin();
+	       I != patchfiles.end();
 	       ++I)
 	 {
-	    patch_name = *I;
+	    patch_name = I->FileName;
 	    if (Debug == true)
 	       std::clog << "Patching " << Path << " with " << patch_name
 		  << std::endl;
@@ -569,8 +607,12 @@ class RredMethod : public pkgAcqMethod {
 	       _error->DumpErrors(std::cerr);
 	       abort();
 	    }
-	    patch.read_diff(p);
+	    Hashes patch_hash(I->ExpectedHashes);
+	    patch.read_diff(p, &patch_hash);
 	    p.Close();
+	    HashStringList const hsl = patch_hash.GetHashStringList();
+	    if (hsl != I->ExpectedHashes)
+	       return _error->Error("Patch %s doesn't have the expected hashsum", patch_name.c_str());
 	 }
 
 	 if (Debug == true)
@@ -643,7 +685,7 @@ int main(int argc, char **argv)
 	 _error->DumpErrors(std::cerr);
 	 exit(1);
       }
-      patch.read_diff(p);
+      patch.read_diff(p, NULL);
    }
 
    if (just_diff) {
diff --git a/test/integration/test-pdiff-usage b/test/integration/test-pdiff-usage
index 7d72a6944..73df61895 100755
--- a/test/integration/test-pdiff-usage
+++ b/test/integration/test-pdiff-usage
@@ -170,6 +170,8 @@ SHA256-Patches:
 	generatereleasefiles '+1hour'
 	signreleasefiles
 	testsuccess aptget update "$@"
+	cp -f rootdir/tmp/testsuccess.output rootdir/tmp/aptgetupdate.output
+	testsuccess grep 'have the expected hashsum' rootdir/tmp/aptgetupdate.output
 	testnopackage oldstuff
 	testsuccessequal "$(cat ${PKGFILE}-new)
 " aptcache show apt newstuff
-- 
cgit v1.2.3-70-g09d2


From 6d3e5bd8e08564c5eb12ecd869de5bd71e25f59d Mon Sep 17 00:00:00 2001
From: David Kalnischkies <david@kalnischkies.de>
Date: Sun, 7 Jun 2015 02:17:15 +0200
Subject: add more parsing error checking for rred

The rred parser is very accepting regarding 'invalid' files. Given that
we can't trust the input it might be a bit too relaxed. In any case,
checking for more errors can't hurt given that we support only a very
specific subset of ed commands.
---
 methods/rred.cc                   |  70 +++++++++-----
 test/integration/test-method-rred | 194 ++++++++++++++++++++++++++++++++++++++
 test/integration/test-pdiff-usage |   3 +-
 3 files changed, 245 insertions(+), 22 deletions(-)
 create mode 100755 test/integration/test-method-rred

(limited to 'methods')

diff --git a/methods/rred.cc b/methods/rred.cc
index 3da33c126..81ecf8553 100644
--- a/methods/rred.cc
+++ b/methods/rred.cc
@@ -21,6 +21,7 @@
 #include <vector>
 
 #include <assert.h>
+#include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -35,7 +36,7 @@ class MemBlock {
    char *start;
    size_t size;
    char *free;
-   struct MemBlock *next;
+   MemBlock *next;
 
    MemBlock(size_t size) : size(size), next(NULL)
    {
@@ -116,7 +117,7 @@ struct Change {
    size_t add_len; /* bytes */
    char *add;
 
-   Change(int off)
+   Change(size_t off)
    {
       offset = off;
       del_cnt = add_cnt = add_len = 0;
@@ -388,30 +389,37 @@ class Patch {
 
    public:
 
-   void read_diff(FileFd &f, Hashes * const h)
+   bool read_diff(FileFd &f, Hashes * const h)
    {
       char buffer[BLOCK_SIZE];
       bool cmdwanted = true;
 
-      Change ch(0);
-      while(f.ReadLine(buffer, sizeof(buffer)))
-      {
+      Change ch(std::numeric_limits<size_t>::max());
+      if (f.ReadLine(buffer, sizeof(buffer)) == NULL)
+	 return _error->Error("Reading first line of patchfile %s failed", f.Name().c_str());
+      do {
 	 if (h != NULL)
 	    h->Add(buffer);
 	 if (cmdwanted) {
 	    char *m, *c;
 	    size_t s, e;
-	    s = strtol(buffer, &m, 10);
-	    if (m == buffer) {
-	       s = e = ch.offset + ch.add_cnt;
-	       c = buffer;
-	    } else if (*m == ',') {
-	       m++;
+	    errno = 0;
+	    s = strtoul(buffer, &m, 10);
+	    if (unlikely(m == buffer || s == ULONG_MAX || errno != 0))
+	       return _error->Error("Parsing patchfile %s failed: Expected an effected line start", f.Name().c_str());
+	    else if (*m == ',') {
+	       ++m;
 	       e = strtol(m, &c, 10);
+	       if (unlikely(m == c || e == ULONG_MAX || errno != 0))
+		  return _error->Error("Parsing patchfile %s failed: Expected an effected line end", f.Name().c_str());
+	       if (unlikely(e < s))
+		  return _error->Error("Parsing patchfile %s failed: Effected lines end %lu is before start %lu", f.Name().c_str(), e, s);
 	    } else {
 	       e = s;
 	       c = m;
 	    }
+	    if (s > ch.offset)
+	       return _error->Error("Parsing patchfile %s failed: Effected line is after previous effected line", f.Name().c_str());
 	    switch(*c) {
 	       case 'a':
 		  cmdwanted = false;
@@ -422,6 +430,8 @@ class Patch {
 		  ch.del_cnt = 0;
 		  break;
 	       case 'c':
+		  if (unlikely(s == 0))
+		     return _error->Error("Parsing patchfile %s failed: Change command can't effect line zero", f.Name().c_str());
 		  cmdwanted = false;
 		  ch.add = NULL;
 		  ch.add_cnt = 0;
@@ -430,6 +440,8 @@ class Patch {
 		  ch.del_cnt = e - s + 1;
 		  break;
 	       case 'd':
+		  if (unlikely(s == 0))
+		     return _error->Error("Parsing patchfile %s failed: Delete command can't effect line zero", f.Name().c_str());
 		  ch.offset = s - 1;
 		  ch.del_cnt = e - s + 1;
 		  ch.add = NULL;
@@ -437,9 +449,11 @@ class Patch {
 		  ch.add_len = 0;
 		  filechanges.add_change(ch);
 		  break;
+	       default:
+		  return _error->Error("Parsing patchfile %s failed: Unknown command", f.Name().c_str());
 	    }
 	 } else { /* !cmdwanted */
-	    if (buffer[0] == '.' && buffer[1] == '\n') {
+	    if (strcmp(buffer, ".\n") == 0) {
 	       cmdwanted = true;
 	       filechanges.add_change(ch);
 	    } else {
@@ -465,7 +479,8 @@ class Patch {
 	       }
 	    }
 	 }
-      }
+      } while(f.ReadLine(buffer, sizeof(buffer)));
+      return true;
    }
 
    void write_diff(FILE *f)
@@ -601,14 +616,14 @@ class RredMethod : public pkgAcqMethod {
 		  << std::endl;
 
 	    FileFd p;
+	    Hashes patch_hash(I->ExpectedHashes);
 	    // all patches are compressed, even if the name doesn't reflect it
-	    if (p.Open(patch_name, FileFd::ReadOnly, FileFd::Gzip) == false) {
-	       std::cerr << "Could not open patch file " << patch_name << std::endl;
+	    if (p.Open(patch_name, FileFd::ReadOnly, FileFd::Gzip) == false ||
+		  patch.read_diff(p, &patch_hash) == false)
+	    {
 	       _error->DumpErrors(std::cerr);
-	       abort();
+	       return false;
 	    }
-	    Hashes patch_hash(I->ExpectedHashes);
-	    patch.read_diff(p, &patch_hash);
 	    p.Close();
 	    HashStringList const hsl = patch_hash.GetHashStringList();
 	    if (hsl != I->ExpectedHashes)
@@ -624,7 +639,6 @@ class RredMethod : public pkgAcqMethod {
 	 FILE *out = fopen(Itm->DestFile.c_str(), "w");
 
 	 Hashes hash(Itm->ExpectedHashes);
-
 	 patch.apply_against_file(out, inp, &hash);
 
 	 fclose(out);
@@ -657,6 +671,16 @@ class RredMethod : public pkgAcqMethod {
 	 return true;
       }
 
+      bool Configuration(std::string Message)
+      {
+	 if (pkgAcqMethod::Configuration(Message) == false)
+	    return false;
+
+	 DropPrivsOrDie();
+
+	 return true;
+      }
+
    public:
       RredMethod() : pkgAcqMethod("2.0",SingleInstance | SendConfig), Debug(false) {}
 };
@@ -685,7 +709,11 @@ int main(int argc, char **argv)
 	 _error->DumpErrors(std::cerr);
 	 exit(1);
       }
-      patch.read_diff(p, NULL);
+      if (patch.read_diff(p, NULL) == false)
+      {
+	 _error->DumpErrors(std::cerr);
+	 exit(2);
+      }
    }
 
    if (just_diff) {
diff --git a/test/integration/test-method-rred b/test/integration/test-method-rred
new file mode 100755
index 000000000..a8de3ea28
--- /dev/null
+++ b/test/integration/test-method-rred
@@ -0,0 +1,194 @@
+#!/bin/sh
+set -e
+
+TESTDIR=$(readlink -f $(dirname $0))
+. $TESTDIR/framework
+
+setupenvironment
+configarchitecture 'i386'
+
+echo 'Package: coolstuff
+Version: 0.8.15
+Description: collection of stuff
+ A lot, too much to iterate all, but at least this:
+ - stuff
+ - more stuff
+ - even more stuff
+ .
+ And a cow.
+
+Package: oldstuff
+Version: 0-1
+Description: collection of outdated stuff
+ A lot, but of no use nowadays, but at least this:
+ - stuff
+ - more stuff
+ - even more stuff
+ .
+ And a dog.' > Packages
+
+testrred() {
+	msgtest "$1" "$2"
+	if [ -z "$3" ]; then
+		echo -n '' > Packages.ed
+	else
+		echo "$3" > Packages.ed
+	fi
+	rred() {
+		cat Packages | runapt "${METHODSDIR}/rred" "$@"
+	}
+	testsuccessequal "$4" --nomsg rred -f Packages.ed
+}
+
+testrred 'Remove' 'first line' '1d' "$(tail -n +2 ./Packages)"
+testrred 'Remove' 'empty line' '10d' "$(head -n 9 ./Packages)
+$(tail -n 9 ./Packages)"
+testrred 'Remove' 'line in a paragraph' '5d' "$(head -n 4 ./Packages)
+$(tail -n 14 ./Packages)"
+testrred 'Remove' 'last line' '19d' "$(head -n -1 ./Packages)"
+testrred 'Remove' 'multiple single lines' '17d
+7d' "$(sed -e '/^ - even more stuff$/ d' ./Packages)"
+testrred 'Remove' 'first paragraph' '1,10d' "$(tail -n 9 ./Packages)"
+testrred 'Remove' 'a few lines in the middle' '5,14d' "$(head -n 4 ./Packages)
+$(tail -n 5 ./Packages)"
+testrred 'Remove' 'second paragraph' '10,19d' "$(head -n 9 ./Packages)"
+testrred 'Mass Remove' 'all stuff lines' '15,17d
+13d
+11d
+5,7d
+3d
+1d' "$(sed '/stuff/ d' ./Packages)"
+
+testrred 'Single line add' 'first line' '0a
+Format: 3.0 (native)
+.' "Format: 3.0 (native)
+$(cat ./Packages)"
+testrred 'Single line add' 'last line' '19a
+Multi-Arch: foreign
+.' "$(cat ./Packages)
+Multi-Arch: foreign"
+testrred 'Single line add' 'middle' '9a
+Multi-Arch: foreign
+.' "$(head -n 9 ./Packages)
+Multi-Arch: foreign
+$(tail -n 10 ./Packages)"
+
+testrred 'Multi line add' 'first line' '0a
+Format: 3.0 (native)
+Source: apt
+.' "Format: 3.0 (native)
+Source: apt
+$(cat ./Packages)"
+testrred 'Multi line add' 'last line' '19a
+Multi-Arch: foreign
+Homepage: https://debian.org
+.' "$(cat ./Packages)
+Multi-Arch: foreign
+Homepage: https://debian.org"
+testrred 'Multi line add' 'middle' '9a
+Multi-Arch: foreign
+Homepage: https://debian.org
+.' "$(head -n 9 ./Packages)
+Multi-Arch: foreign
+Homepage: https://debian.org
+$(tail -n 10 ./Packages)"
+
+testrred 'Single line change' 'first line' '1c
+Package: supercoolstuff
+.' "Package: supercoolstuff
+$(tail -n +2 ./Packages)"
+testrred 'Single line change' 'in the middle' '9c
+ And a super cow.
+.' "$(head -n 8 ./Packages)
+ And a super cow.
+$(tail -n 10 ./Packages)"
+testrred 'Single line change' 'an empty line' '10c
+
+.' "$(head -n 9 ./Packages)
+
+$(tail -n 9 ./Packages)"
+testrred 'Single line change' 'a spacy line' '10c
+   	  
+.' "$(head -n 9 ./Packages)
+   	  
+$(tail -n 9 ./Packages)"
+testrred 'Single line change' 'last line' '19c
+ And a cat.
+.' "$(head -n -1 ./Packages)
+ And a cat."
+
+testrred 'Multi line change' 'exchange' '5,7c
+ - good stuff
+ - more good stuff
+ - even more good stuff
+.' "$(head -n 4 ./Packages)
+ - good stuff
+ - more good stuff
+ - even more good stuff
+$(tail -n 12 ./Packages)"
+testrred 'Multi line change' 'less' '5,7c
+ - good stuff
+ - more good stuff
+.' "$(head -n 4 ./Packages)
+ - good stuff
+ - more good stuff
+$(tail -n 12 ./Packages)"
+testrred 'Multi line change' 'more' '5,7c
+ - good stuff
+ - more good stuff
+ - even more good stuff
+ - bonus good stuff
+.' "$(head -n 4 ./Packages)
+ - good stuff
+ - more good stuff
+ - even more good stuff
+ - bonus good stuff
+$(tail -n 12 ./Packages)"
+
+failrred() {
+	msgtest 'Failure caused by' "$1"
+	echo "$2" > Packages.ed
+	rred() {
+		cat Packages | runapt "${METHODSDIR}/rred" "$@"
+	}
+	testfailure --nomsg rred -f Packages.ed
+}
+
+failrred 'Bogus content' '<html>
+</html>'
+
+# not a problem per-se, but we want our parser to be really strict
+failrred 'Empty patch file' ''
+failrred 'Empty line patch file' '
+'
+failrred 'Empty line before command' '
+1d'
+failrred 'Empty line after command' '1d
+'
+failrred 'Empty line between commands' '17d
+
+7d'
+failrred 'Empty spaces lines before command' '   	   
+1d'
+failrred 'Empty spaces lines after command' '1d
+  	   '
+failrred 'Empty spaces lines between commands' '17d
+  	   
+7d'
+
+# the line before the first one can't be deleted/changed
+failrred 'zero line delete' '0d'
+failrred 'zero line change' '0c
+Package: supercoolstuff
+.'
+# and this makes no sense at all
+failrred 'negative line delete' '-1d'
+failrred 'negative line change' '-1c
+Package: supercoolstuff
+.'
+failrred 'negative line add' '-1a
+Package: supercoolstuff
+.'
+failrred 'Wrong order of commands' '7d
+17d'
+failrred 'End before start' '7,6d'
diff --git a/test/integration/test-pdiff-usage b/test/integration/test-pdiff-usage
index 73df61895..7a9f6496b 100755
--- a/test/integration/test-pdiff-usage
+++ b/test/integration/test-pdiff-usage
@@ -165,7 +165,8 @@ SHA256-History:
 SHA256-Patches:
  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 19722 2010-08-18-2013.28
  $(sha256sum $PATCHFILE | cut -d' ' -f 1) $(stat -c%s $PATCHFILE) $(basename $PATCHFILE)" > $PATCHINDEX
-	echo 'I am Mallory and I change files' >> $PATCHFILE
+	# needs to look like a valid command, otherwise the parser will fail before hashes are checked
+	echo '1d' >> $PATCHFILE
 	cat $PATCHFILE | gzip > ${PATCHFILE}.gz
 	generatereleasefiles '+1hour'
 	signreleasefiles
-- 
cgit v1.2.3-70-g09d2


From 4f51fd8636592a96aecf17c8bf4cfdb3ea2207cc Mon Sep 17 00:00:00 2001
From: David Kalnischkies <david@kalnischkies.de>
Date: Mon, 8 Jun 2015 00:06:41 +0200
Subject: support hashes for compressed pdiff files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

At the moment we only have hashes for the uncompressed pdiff files, but
via the new '$HASH-Download' field in the .diff/Index hashes can be
provided for the .gz compressed pdiff file, which apt will pick up now
and use to verify the download. Now, we "just" need a buy in from the
creators of repositories…
---
 apt-pkg/acquire-item.cc           | 72 ++++++++++++++++++++++++++++++++-------
 apt-pkg/acquire-item.h            | 11 +++---
 apt-pkg/contrib/hashes.cc         | 11 ++++--
 apt-pkg/contrib/hashes.h          |  7 ++++
 apt-pkg/indexrecords.cc           |  4 +--
 methods/rred.cc                   |  2 +-
 test/integration/test-pdiff-usage | 46 +++++++++++++++++++++++--
 7 files changed, 125 insertions(+), 28 deletions(-)

(limited to 'methods')

diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc
index 7b69ee993..a3f47242f 100644
--- a/apt-pkg/acquire-item.cc
+++ b/apt-pkg/acquire-item.cc
@@ -152,14 +152,18 @@ HashStringList pkgAcqMetaBase::GetExpectedHashes() const
 
 APT_CONST bool pkgAcqIndexDiffs::HashesRequired() const
 {
-   /* FIXME: We have only hashes for uncompressed pdiffs.
-      rred uncompresses them on the fly while parsing.
-      In StateFetchDiff state we also uncompress on the fly for hash check.
-      Hashes are checked while searching for (next) patch to apply. */
+   /* We don't always have the diff of the downloaded pdiff file.
+      What we have for sure is hashes for the uncompressed file,
+      but rred uncompresses them on the fly while parsing, so not handled here.
+      Hashes are (also) checked while searching for (next) patch to apply. */
+   if (State == StateFetchDiff)
+      return available_patches[0].download_hashes.empty() == false;
    return false;
 }
 HashStringList pkgAcqIndexDiffs::GetExpectedHashes() const
 {
+   if (State == StateFetchDiff)
+      return available_patches[0].download_hashes;
    return HashStringList();
 }
 
@@ -168,11 +172,15 @@ APT_CONST bool pkgAcqIndexMergeDiffs::HashesRequired() const
    /* @see #pkgAcqIndexDiffs::HashesRequired, with the difference that
       we can check the rred result after all patches are applied as
       we know the expected result rather than potentially apply more patches */
+   if (State == StateFetchDiff)
+      return patch.download_hashes.empty() == false;
    return State == StateApplyDiff;
 }
 HashStringList pkgAcqIndexMergeDiffs::GetExpectedHashes() const
 {
-   if (State == StateApplyDiff)
+   if (State == StateFetchDiff)
+      return patch.download_hashes;
+   else if (State == StateApplyDiff)
       return GetExpectedHashesFor(Target->MetaKey);
    return HashStringList();
 }
@@ -1618,7 +1626,7 @@ bool pkgAcqDiffIndex::ParseDiffIndex(string const &IndexDiffFile)	/*{{{*/
 	 std::vector<DiffInfo>::iterator cur = available_patches.begin();
 	 for (; cur != available_patches.end(); ++cur)
 	 {
-	    if (cur->file != filename || unlikely(cur->result_size != size))
+	    if (cur->file != filename)
 	       continue;
 	    cur->result_hashes.push_back(HashString(*type, hash));
 	    break;
@@ -1630,8 +1638,7 @@ bool pkgAcqDiffIndex::ParseDiffIndex(string const &IndexDiffFile)	/*{{{*/
 	    DiffInfo next;
 	    next.file = filename;
 	    next.result_hashes.push_back(HashString(*type, hash));
-	    next.result_size = size;
-	    next.patch_size = 0;
+	    next.result_hashes.FileSize(size);
 	    available_patches.push_back(next);
 	 }
 	 else
@@ -1679,10 +1686,9 @@ bool pkgAcqDiffIndex::ParseDiffIndex(string const &IndexDiffFile)	/*{{{*/
 	 {
 	    if (cur->file != filename)
 	       continue;
-	    if (unlikely(cur->patch_size != 0 && cur->patch_size != size))
-	       continue;
+	    if (cur->patch_hashes.empty())
+	       cur->patch_hashes.FileSize(size);
 	    cur->patch_hashes.push_back(HashString(*type, hash));
-	    cur->patch_size = size;
 	    break;
 	 }
 	 if (cur != available_patches.end())
@@ -1694,6 +1700,48 @@ bool pkgAcqDiffIndex::ParseDiffIndex(string const &IndexDiffFile)	/*{{{*/
       }
    }
 
+   for (char const * const * type = HashString::SupportedHashes(); *type != NULL; ++type)
+   {
+      std::string tagname = *type;
+      tagname.append("-Download");
+      std::string const tmp = Tags.FindS(tagname.c_str());
+      if (tmp.empty() == true)
+	 continue;
+
+      string hash, filename;
+      unsigned long long size;
+      std::stringstream ss(tmp);
+
+      // FIXME: all of pdiff supports only .gz compressed patches
+      while (ss >> hash >> size >> filename)
+      {
+	 if (unlikely(hash.empty() == true || filename.empty() == true))
+	    continue;
+	 if (unlikely(APT::String::Endswith(filename, ".gz") == false))
+	    continue;
+	 filename.erase(filename.length() - 3);
+
+	 // see if we have a record for this file already
+	 std::vector<DiffInfo>::iterator cur = available_patches.begin();
+	 for (; cur != available_patches.end(); ++cur)
+	 {
+	    if (cur->file != filename)
+	       continue;
+	    if (cur->download_hashes.empty())
+	       cur->download_hashes.FileSize(size);
+	    cur->download_hashes.push_back(HashString(*type, hash));
+	    break;
+	 }
+	 if (cur != available_patches.end())
+	       continue;
+	 if (Debug == true)
+	    std::clog << "pkgAcqDiffIndex: " << IndexDiffFile << ": File " << filename
+	       << " wasn't in the list for the first parsed hash! (download)" << std::endl;
+	 break;
+      }
+   }
+
+
    bool foundStart = false;
    for (std::vector<DiffInfo>::iterator cur = available_patches.begin();
 	 cur != available_patches.end(); ++cur)
@@ -1729,7 +1777,7 @@ bool pkgAcqDiffIndex::ParseDiffIndex(string const &IndexDiffFile)	/*{{{*/
    unsigned long long patchesSize = 0;
    for (std::vector<DiffInfo>::const_iterator cur = available_patches.begin();
 	 cur != available_patches.end(); ++cur)
-      patchesSize += cur->patch_size;
+      patchesSize += cur->patch_hashes.FileSize();
    unsigned long long const sizeLimit = ServerSize * _config->FindI("Acquire::PDiffs::SizeLimit", 100);
    if (sizeLimit > 0 && (sizeLimit/100) < patchesSize)
    {
diff --git a/apt-pkg/acquire-item.h b/apt-pkg/acquire-item.h
index f24af1aec..910e4131b 100644
--- a/apt-pkg/acquire-item.h
+++ b/apt-pkg/acquire-item.h
@@ -705,17 +705,14 @@ struct APT_HIDDEN DiffInfo {						/*{{{*/
    /** The filename of the diff. */
    std::string file;
 
-   /** The hashes of the diff */
+   /** The hashes of the file after the diff is applied */
    HashStringList result_hashes;
 
-   /** The hashes of the file after the diff is applied */
+   /** The hashes of the diff */
    HashStringList patch_hashes;
 
-   /** The size of the file after the diff is applied */
-   unsigned long long result_size;
-
-   /** The size of the diff itself */
-   unsigned long long patch_size;
+   /** The hashes of the compressed diff */
+   HashStringList download_hashes;
 };
 									/*}}}*/
 /** \brief An item that is responsible for fetching client-merge patches {{{
diff --git a/apt-pkg/contrib/hashes.cc b/apt-pkg/contrib/hashes.cc
index 11a7e479b..46cf0ba08 100644
--- a/apt-pkg/contrib/hashes.cc
+++ b/apt-pkg/contrib/hashes.cc
@@ -188,6 +188,13 @@ unsigned long long HashStringList::FileSize() const			/*{{{*/
    return strtoull(hv.c_str(), NULL, 10);
 }
 									/*}}}*/
+bool HashStringList::FileSize(unsigned long long const Size)		/*{{{*/
+{
+   std::string size;
+   strprintf(size, "%llu", Size);
+   return push_back(HashString("Checksum-FileSize", size));
+}
+									/*}}}*/
 bool HashStringList::supported(char const * const type)			/*{{{*/
 {
    for (char const * const * t = HashString::SupportedHashes(); *t != NULL; ++t)
@@ -361,9 +368,7 @@ APT_IGNORE_DEPRECATED_PUSH
    if ((d->CalcHashes & SHA512SUM) == SHA512SUM)
       hashes.push_back(HashString("SHA512", SHA512.Result().Value()));
 APT_IGNORE_DEPRECATED_POP
-   std::string SizeStr;
-   strprintf(SizeStr, "%llu", d->FileSize);
-   hashes.push_back(HashString("Checksum-FileSize", SizeStr));
+   hashes.FileSize(d->FileSize);
    return hashes;
 }
 APT_IGNORE_DEPRECATED_PUSH
diff --git a/apt-pkg/contrib/hashes.h b/apt-pkg/contrib/hashes.h
index 176ce4faa..e8d84da9e 100644
--- a/apt-pkg/contrib/hashes.h
+++ b/apt-pkg/contrib/hashes.h
@@ -96,6 +96,13 @@ class HashStringList
     */
    unsigned long long FileSize() const;
 
+   /** sets the filesize hash
+    *
+    * @param Size of the file
+    * @return @see #push_back
+    */
+   bool FileSize(unsigned long long const Size);
+
    /** check if the given hash type is supported
     *
     * @param type to check
diff --git a/apt-pkg/indexrecords.cc b/apt-pkg/indexrecords.cc
index c26868cac..7e6da9558 100644
--- a/apt-pkg/indexrecords.cc
+++ b/apt-pkg/indexrecords.cc
@@ -121,9 +121,7 @@ bool indexRecords::Load(const string Filename)				/*{{{*/
             indexRecords::checkSum *Sum = new indexRecords::checkSum;
             Sum->MetaKeyFilename = Name;
             Sum->Size = Size;
-	    std::string SizeStr;
-	    strprintf(SizeStr, "%llu", Size);
-	    Sum->Hashes.push_back(HashString("Checksum-FileSize", SizeStr));
+	    Sum->Hashes.FileSize(Size);
             APT_IGNORE_DEPRECATED(Sum->Hash = HashString(HashString::SupportedHashes()[i],Hash);)
             Entries[Name] = Sum;
          }
diff --git a/methods/rred.cc b/methods/rred.cc
index 81ecf8553..12cf2b4a5 100644
--- a/methods/rred.cc
+++ b/methods/rred.cc
@@ -627,7 +627,7 @@ class RredMethod : public pkgAcqMethod {
 	    p.Close();
 	    HashStringList const hsl = patch_hash.GetHashStringList();
 	    if (hsl != I->ExpectedHashes)
-	       return _error->Error("Patch %s doesn't have the expected hashsum", patch_name.c_str());
+	       return _error->Error("Hash Sum mismatch for uncompressed patch %s", patch_name.c_str());
 	 }
 
 	 if (Debug == true)
diff --git a/test/integration/test-pdiff-usage b/test/integration/test-pdiff-usage
index 7a9f6496b..3295d5497 100755
--- a/test/integration/test-pdiff-usage
+++ b/test/integration/test-pdiff-usage
@@ -42,6 +42,8 @@ wasmergeused() {
 
 testrun() {
 	msgmsg "Testcase: setup the base with: $*"
+	local DOWNLOADHASH=true
+	if [ "$1" = 'nohash' ]; then DOWNLOADHASH=false; shift; fi
 	find aptarchive -name 'Packages*' -type f -delete
 	cp ${PKGFILE} aptarchive/Packages
 	compressfile 'aptarchive/Packages'
@@ -76,6 +78,15 @@ SHA256-History:
 SHA256-Patches:
  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 19722 2010-08-18-2013.28
  $(sha256sum $PATCHFILE | cut -d' ' -f 1) $(stat -c%s $PATCHFILE) $(basename $PATCHFILE)" > $PATCHINDEX
+	if $DOWNLOADHASH; then
+		echo "SHA1-Download:
+ 2365ac0ac57cde3d43c63145e8251a3bd5410213 197 2010-08-18-2013.28.gz
+ $(sha1sum ${PATCHFILE}.gz | cut -d' ' -f 1) $(stat -c%s ${PATCHFILE}.gz) $(basename ${PATCHFILE}.gz)
+SHA256-Download:
+ d2a1b33187ed2d248eeae3b1223ea71791ea35f2138a713ed371332a6421f467 197 2010-08-18-2013.28.gz
+ $(sha256sum ${PATCHFILE}.gz | cut -d' ' -f 1) $(stat -c%s ${PATCHFILE}.gz) $(basename ${PATCHFILE}.gz)" >> $PATCHINDEX
+	fi
+
 	generatereleasefiles '+1hour'
 	signreleasefiles
 	find aptarchive -name 'Packages*' -type f -delete
@@ -131,6 +142,17 @@ SHA256-Patches:
  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 19722 2010-08-18-2013.28
  $(sha256sum $PATCHFILE | cut -d' ' -f 1) $(stat -c%s $PATCHFILE) $(basename $PATCHFILE)
  $(sha256sum ${PATCHFILE2} | cut -d' ' -f 1) $(stat -c%s ${PATCHFILE2}) $(basename ${PATCHFILE2})" > $PATCHINDEX
+	if $DOWNLOADHASH; then
+		echo "SHA1-Download:
+ 2365ac0ac57cde3d43c63145e8251a3bd5410213 197 2010-08-18-2013.28.gz
+ $(sha1sum ${PATCHFILE}.gz | cut -d' ' -f 1) $(stat -c%s ${PATCHFILE}.gz) $(basename ${PATCHFILE}.gz)
+ $(sha1sum ${PATCHFILE2}.gz | cut -d' ' -f 1) $(stat -c%s ${PATCHFILE2}.gz) $(basename ${PATCHFILE2}.gz)
+SHA256-Download:
+ d2a1b33187ed2d248eeae3b1223ea71791ea35f2138a713ed371332a6421f467 197 2010-08-18-2013.28.gz
+ $(sha256sum ${PATCHFILE}.gz | cut -d' ' -f 1) $(stat -c%s ${PATCHFILE}.gz) $(basename ${PATCHFILE}.gz)
+ $(sha256sum ${PATCHFILE2}.gz | cut -d' ' -f 1) $(stat -c%s ${PATCHFILE2}.gz) $(basename ${PATCHFILE2}.gz)" >> $PATCHINDEX
+	fi
+
 	generatereleasefiles '+2hour'
 	signreleasefiles
 	cp -a aptarchive/Packages Packages-future
@@ -150,6 +172,7 @@ SHA256-Patches:
 	mkdir -p aptarchive/Packages.diff
 	PATCHFILE="aptarchive/Packages.diff/$(date +%Y-%m-%d-%H%M.%S)"
 	diff -e ${PKGFILE} ${PKGFILE}-new > ${PATCHFILE} || true
+	cat $PATCHFILE | gzip > ${PATCHFILE}.gz
 	PATCHINDEX='aptarchive/Packages.diff/Index'
 	echo "SHA1-Current: $(sha1sum ${PKGFILE}-new | cut -d' ' -f 1) $(stat -c%s ${PKGFILE}-new)
 SHA1-History:
@@ -165,14 +188,22 @@ SHA256-History:
 SHA256-Patches:
  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 19722 2010-08-18-2013.28
  $(sha256sum $PATCHFILE | cut -d' ' -f 1) $(stat -c%s $PATCHFILE) $(basename $PATCHFILE)" > $PATCHINDEX
+	if $DOWNLOADHASH; then
+		echo "SHA1-Download:
+ 2365ac0ac57cde3d43c63145e8251a3bd5410213 197 2010-08-18-2013.28.gz
+ $(sha1sum ${PATCHFILE}.gz | cut -d' ' -f 1) $(stat -c%s ${PATCHFILE}.gz) $(basename ${PATCHFILE}.gz)
+SHA256-Download:
+ d2a1b33187ed2d248eeae3b1223ea71791ea35f2138a713ed371332a6421f467 197 2010-08-18-2013.28.gz
+ $(sha256sum ${PATCHFILE}.gz | cut -d' ' -f 1) $(stat -c%s ${PATCHFILE}.gz) $(basename ${PATCHFILE}.gz)" >> $PATCHINDEX
+	fi
 	# needs to look like a valid command, otherwise the parser will fail before hashes are checked
-	echo '1d' >> $PATCHFILE
+	echo '1d' > $PATCHFILE
 	cat $PATCHFILE | gzip > ${PATCHFILE}.gz
 	generatereleasefiles '+1hour'
 	signreleasefiles
 	testsuccess aptget update "$@"
 	cp -f rootdir/tmp/testsuccess.output rootdir/tmp/aptgetupdate.output
-	testsuccess grep 'have the expected hashsum' rootdir/tmp/aptgetupdate.output
+	testsuccess grep 'Hash Sum mismatch' rootdir/tmp/aptgetupdate.output
 	testnopackage oldstuff
 	testsuccessequal "$(cat ${PKGFILE}-new)
 " aptcache show apt newstuff
@@ -201,6 +232,14 @@ SHA256-History:
 SHA256-Patches:
  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 19722 2010-08-18-2013.28
  $(sha256sum $PATCHFILE | cut -d' ' -f 1) $(stat -c%s $PATCHFILE)000 $(basename $PATCHFILE)" > $PATCHINDEX
+	if $DOWNLOADHASH; then
+		echo "SHA1-Download:
+ 2365ac0ac57cde3d43c63145e8251a3bd5410213 197 2010-08-18-2013.28.gz
+ $(sha1sum ${PATCHFILE}.gz | cut -d' ' -f 1) $(stat -c%s ${PATCHFILE}.gz)000 $(basename ${PATCHFILE}.gz)
+SHA256-Download:
+ d2a1b33187ed2d248eeae3b1223ea71791ea35f2138a713ed371332a6421f467 197 2010-08-18-2013.28.gz
+ $(sha256sum ${PATCHFILE}.gz | cut -d' ' -f 1) $(stat -c%s ${PATCHFILE}.gz)000 $(basename ${PATCHFILE}.gz)" >> $PATCHINDEX
+	fi
 	generatereleasefiles '+1hour'
 	signreleasefiles
 	#find aptarchive -name 'Packages*' -type f -delete
@@ -215,6 +254,9 @@ echo 'Debug::pkgAcquire::Diffs "true";
 Debug::Acquire::Transaction "true";
 Debug::pkgAcquire::rred "true";' > rootdir/etc/apt/apt.conf.d/rreddebug.conf
 
+testrun nohash -o Acquire::PDiffs::Merge=0 -o APT::Get::List-Cleanup=1
+testrun nohash -o Acquire::PDiffs::Merge=1 -o APT::Get::List-Cleanup=1
+
 testrun -o Acquire::PDiffs::Merge=0 -o APT::Get::List-Cleanup=1
 testrun -o Acquire::PDiffs::Merge=1 -o APT::Get::List-Cleanup=1
 testrun -o Acquire::PDiffs::Merge=0 -o APT::Get::List-Cleanup=0
-- 
cgit v1.2.3-70-g09d2


From c69e8370947d765dd94f142d18dc11d5a76af443 Mon Sep 17 00:00:00 2001
From: David Kalnischkies <david@kalnischkies.de>
Date: Tue, 9 Jun 2015 15:15:33 +0200
Subject: replace ULONG_MAX with c++ style std::numeric_limits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For some reason travis seems to be unhappy about it claiming it
is not defined. Well, lets not think to deeply about it…

Git-Dch: Ignore
---
 methods/rred.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'methods')

diff --git a/methods/rred.cc b/methods/rred.cc
index 12cf2b4a5..54123ab9c 100644
--- a/methods/rred.cc
+++ b/methods/rred.cc
@@ -405,12 +405,12 @@ class Patch {
 	    size_t s, e;
 	    errno = 0;
 	    s = strtoul(buffer, &m, 10);
-	    if (unlikely(m == buffer || s == ULONG_MAX || errno != 0))
+	    if (unlikely(m == buffer || s == std::numeric_limits<unsigned long>::max() || errno != 0))
 	       return _error->Error("Parsing patchfile %s failed: Expected an effected line start", f.Name().c_str());
 	    else if (*m == ',') {
 	       ++m;
 	       e = strtol(m, &c, 10);
-	       if (unlikely(m == c || e == ULONG_MAX || errno != 0))
+	       if (unlikely(m == c || e == std::numeric_limits<unsigned long>::max() || errno != 0))
 		  return _error->Error("Parsing patchfile %s failed: Expected an effected line end", f.Name().c_str());
 	       if (unlikely(e < s))
 		  return _error->Error("Parsing patchfile %s failed: Effected lines end %lu is before start %lu", f.Name().c_str(), e, s);
-- 
cgit v1.2.3-70-g09d2


From 9f697f69cf1adaced476598cfe08ab03c76c5d18 Mon Sep 17 00:00:00 2001
From: David Kalnischkies <david@kalnischkies.de>
Date: Mon, 15 Jun 2015 12:51:22 +0200
Subject: ensure valid or remove destination file in file method

'file' isn't using the destination file per-se, but returns another name
via "Filename" header. It still should deal with destination files as
they could exist (pkgAcqFile e.g. creates links in that location) and
are potentially bogus.
---
 methods/file.cc | 44 +++++++++++++++++++++++++++++++++-----------
 1 file changed, 33 insertions(+), 11 deletions(-)

(limited to 'methods')

diff --git a/methods/file.cc b/methods/file.cc
index 353e54bd5..5d5fffa67 100644
--- a/methods/file.cc
+++ b/methods/file.cc
@@ -48,8 +48,24 @@ bool FileMethod::Fetch(FetchItem *Itm)
    if (Get.Host.empty() == false)
       return _error->Error(_("Invalid URI, local URIS must not start with //"));
 
-   // See if the file exists
    struct stat Buf;
+   // deal with destination files which might linger around
+   if (lstat(Itm->DestFile.c_str(), &Buf) == 0)
+   {
+      if ((Buf.st_mode & S_IFREG) != 0)
+      {
+	 if (Itm->LastModified == Buf.st_mtime && Itm->LastModified != 0)
+	 {
+	    HashStringList const hsl = Itm->ExpectedHashes;
+	    if (Itm->ExpectedHashes.VerifyFile(File))
+	       Res.IMSHit = true;
+	 }
+      }
+   }
+   if (Res.IMSHit != true)
+      unlink(Itm->DestFile.c_str());
+
+   // See if the file exists
    if (stat(File.c_str(),&Buf) == 0)
    {
       Res.Size = Buf.st_size;
@@ -65,6 +81,8 @@ bool FileMethod::Fetch(FetchItem *Itm)
    }
 
    // See if the uncompressed file exists and reuse it
+   FetchResult AltRes;
+   AltRes.Filename.clear();
    std::vector<std::string> extensions = APT::Configuration::getCompressorExtensions();
    for (std::vector<std::string>::const_iterator ext = extensions.begin(); ext != extensions.end(); ++ext)
    {
@@ -73,29 +91,33 @@ bool FileMethod::Fetch(FetchItem *Itm)
 	 std::string const unfile = File.substr(0, File.length() - ext->length() - 1);
 	 if (stat(unfile.c_str(),&Buf) == 0)
 	 {
-	    FetchResult AltRes;
 	    AltRes.Size = Buf.st_size;
 	    AltRes.Filename = unfile;
 	    AltRes.LastModified = Buf.st_mtime;
 	    AltRes.IMSHit = false;
 	    if (Itm->LastModified == Buf.st_mtime && Itm->LastModified != 0)
 	       AltRes.IMSHit = true;
-
-	    URIDone(Res,&AltRes);
-	    return true;
+	    break;
 	 }
 	 // no break here as we could have situations similar to '.gz' vs '.tar.gz' here
       }
    }
 
-   if (Res.Filename.empty() == true)
+   if (Res.Filename.empty() == false)
+   {
+      Hashes Hash(Itm->ExpectedHashes);
+      FileFd Fd(Res.Filename, FileFd::ReadOnly);
+      Hash.AddFD(Fd);
+      Res.TakeHashes(Hash);
+   }
+
+   if (AltRes.Filename.empty() == false)
+      URIDone(Res,&AltRes);
+   else if (Res.Filename.empty() == false)
+      URIDone(Res);
+   else
       return _error->Error(_("File not found"));
 
-   Hashes Hash(Itm->ExpectedHashes);
-   FileFd Fd(Res.Filename, FileFd::ReadOnly);
-   Hash.AddFD(Fd);
-   Res.TakeHashes(Hash);
-   URIDone(Res);
    return true;
 }
 									/*}}}*/
-- 
cgit v1.2.3-70-g09d2


From ff86d7df6a53ff6283de4b9a858c1dad98ed887f Mon Sep 17 00:00:00 2001
From: David Kalnischkies <david@kalnischkies.de>
Date: Mon, 15 Jun 2015 13:36:11 +0200
Subject: call URIStart in cdrom and file method
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All other methods call it, so they should follow along even if the work
they do afterwards is hardly breathtaking and usually results in a
URIDone pretty soon, but the acquire system tells the individual item
about this via a virtual method call, so even through none of our
existing items contains any critical code in these, maybe one day they
might. Consistency at least once…

Which is also why this has a good sideeffect: file: and cdrom: requests
appear now in the 'apt-get update' output. Finally - it never made sense
to hide them for me. Okay, I guess it made before the new hit behavior,
but now that you can actually see the difference in an update it makes
sense to see if a file: repository changed or not as well.
---
 apt-pkg/acquire-item.cc                              | 13 ++++---------
 apt-pkg/acquire-worker.cc                            |  1 -
 methods/cdrom.cc                                     |  3 ++-
 methods/file.cc                                      | 18 ++++++++++--------
 test/integration/test-apt-cdrom                      |  6 ++++--
 test/integration/test-apt-get-update-unauth-warning  |  7 +++++++
 test/integration/test-apt-progress-fd                |  6 ++++--
 .../test-bug-595691-empty-and-broken-archive-files   | 20 ++++----------------
 .../test-bug-596498-trusted-unsigned-repo            |  8 +++++++-
 9 files changed, 42 insertions(+), 40 deletions(-)

(limited to 'methods')

diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc
index dc4f61b56..50936b627 100644
--- a/apt-pkg/acquire-item.cc
+++ b/apt-pkg/acquire-item.cc
@@ -519,19 +519,14 @@ void pkgAcquire::Item::Done(string const &Message, HashStringList const &Hashes,
 			    pkgAcquire::MethodConfig const * const /*Cnf*/)
 {
    // We just downloaded something..
-   string FileName = LookupTag(Message,"Filename");
    UsedMirror = LookupTag(Message,"UsedMirror");
-   unsigned long long const downloadedSize = Hashes.FileSize();
-   if (downloadedSize != 0)
+   if (FileSize == 0)
    {
-      if (Complete == false && !Local && FileName == DestFile)
+      unsigned long long const downloadedSize = Hashes.FileSize();
+      if (downloadedSize != 0)
       {
-	 if (Owner->Log != 0)
-	    Owner->Log->Fetched(Hashes.FileSize(),atoi(LookupTag(Message,"Resume-Point","0").c_str()));
+	 FileSize = downloadedSize;
       }
-
-      if (FileSize == 0)
-	 FileSize= downloadedSize;
    }
    Status = StatDone;
    ErrorText = string();
diff --git a/apt-pkg/acquire-worker.cc b/apt-pkg/acquire-worker.cc
index d6318a21b..ef195d44b 100644
--- a/apt-pkg/acquire-worker.cc
+++ b/apt-pkg/acquire-worker.cc
@@ -362,7 +362,6 @@ bool pkgAcquire::Worker::RunMessages()
 
 	    bool const isIMSHit = StringToBool(LookupTag(Message,"IMS-Hit"),false) ||
 	       StringToBool(LookupTag(Message,"Alt-IMS-Hit"),false);
-
 	    for (pkgAcquire::Queue::QItem::owner_iterator O = ItmOwners.begin(); O != ItmOwners.end(); ++O)
 	    {
 	       pkgAcquire::Item * const Owner = *O;
diff --git a/methods/cdrom.cc b/methods/cdrom.cc
index 10cb29f66..67265cfa3 100644
--- a/methods/cdrom.cc
+++ b/methods/cdrom.cc
@@ -260,7 +260,8 @@ bool CDROMMethod::Fetch(FetchItem *Itm)
    struct stat Buf;
    if (stat(Res.Filename.c_str(),&Buf) != 0)
       return _error->Error(_("File not found"));
-   
+
+   URIStart(Res);
    if (NewID.empty() == false)
       CurrentID = NewID;
    Res.LastModified = Buf.st_mtime;
diff --git a/methods/file.cc b/methods/file.cc
index 5d5fffa67..5c76ec122 100644
--- a/methods/file.cc
+++ b/methods/file.cc
@@ -58,7 +58,10 @@ bool FileMethod::Fetch(FetchItem *Itm)
 	 {
 	    HashStringList const hsl = Itm->ExpectedHashes;
 	    if (Itm->ExpectedHashes.VerifyFile(File))
+	    {
+	       Res.Filename = Itm->DestFile;
 	       Res.IMSHit = true;
+	    }
 	 }
       }
    }
@@ -78,7 +81,14 @@ bool FileMethod::Fetch(FetchItem *Itm)
 	 if (filesize != 0 && filesize == Res.Size)
 	    Res.IMSHit = true;
       }
+
+      Hashes Hash(Itm->ExpectedHashes);
+      FileFd Fd(File, FileFd::ReadOnly);
+      Hash.AddFD(Fd);
+      Res.TakeHashes(Hash);
    }
+   if (Res.IMSHit == false)
+      URIStart(Res);
 
    // See if the uncompressed file exists and reuse it
    FetchResult AltRes;
@@ -103,14 +113,6 @@ bool FileMethod::Fetch(FetchItem *Itm)
       }
    }
 
-   if (Res.Filename.empty() == false)
-   {
-      Hashes Hash(Itm->ExpectedHashes);
-      FileFd Fd(Res.Filename, FileFd::ReadOnly);
-      Hash.AddFD(Fd);
-      Res.TakeHashes(Hash);
-   }
-
    if (AltRes.Filename.empty() == false)
       URIDone(Res,&AltRes);
    else if (Res.Filename.empty() == false)
diff --git a/test/integration/test-apt-cdrom b/test/integration/test-apt-cdrom
index 34b35f745..6a218ffb8 100755
--- a/test/integration/test-apt-cdrom
+++ b/test/integration/test-apt-cdrom
@@ -136,13 +136,15 @@ aptcache show testing -o Acquire::Languages=en | grep -q '^Description-en: ' &&
 mv rootdir/media/cdrom-unmounted rootdir/media/cdrom-ejected
 msgmsg "ensure an update doesn't mess with cdrom sources"
 testsuccess aptget update
-testfileequal rootdir/tmp/testsuccess.output 'Reading package lists...'
+testfileequal rootdir/tmp/testsuccess.output 'Hit cdrom://Debian APT Testdisk 0.8.15 stable InRelease
+Reading package lists...'
 mv rootdir/media/cdrom-ejected rootdir/media/cdrom-unmounted
 testcdromusage
 
 msgmsg 'and again to check that it withstands the temptation even if it could mount'
 testsuccess aptget update
-testfileequal rootdir/tmp/testsuccess.output 'Reading package lists...'
+testfileequal rootdir/tmp/testsuccess.output 'Hit cdrom://Debian APT Testdisk 0.8.15 stable InRelease
+Reading package lists...'
 testcdromusage
 
 msgmsg 'Check that nothing touched our' 'CD-ROM'
diff --git a/test/integration/test-apt-get-update-unauth-warning b/test/integration/test-apt-get-update-unauth-warning
index ada7f7a26..1f4a14e23 100755
--- a/test/integration/test-apt-get-update-unauth-warning
+++ b/test/integration/test-apt-get-update-unauth-warning
@@ -9,6 +9,7 @@ TESTDIR=$(readlink -f $(dirname $0))
 
 setupenvironment
 configarchitecture "i386"
+configcompression '.' 'gz'
 
 # a "normal" package with source and binary
 buildsimplenativepackage 'foo' 'all' '2.0'
@@ -31,11 +32,17 @@ testsuccessequal 'Listing...' apt list foo
 testequal 'lock
 partial' ls rootdir/var/lib/apt/lists
 
+filesize() {
+	stat -c%s "$(aptget files --no-release-info --format '$(URI)' "Created-By: $1" | cut -d'/' -f 3- ).gz"
+}
 # allow override
 testwarningequal "Ign file:$APTARCHIVE unstable InRelease
   File not found
 Ign file:$APTARCHIVE unstable Release
   File not found
+Get:1 file:$APTARCHIVE unstable/main Sources [$(filesize 'Sources') B]
+Get:2 file:$APTARCHIVE unstable/main i386 Packages [$(filesize 'Packages') B]
+Get:3 file:$APTARCHIVE unstable/main Translation-en [$(filesize 'Translations') B]
 Reading package lists...
 W: The repository 'file:$APTARCHIVE unstable Release' does not have a Release file. This is deprecated, please contact the owner of the repository." aptget update --allow-insecure-repositories
 # ensure we can not install the package
diff --git a/test/integration/test-apt-progress-fd b/test/integration/test-apt-progress-fd
index 0c11aba7e..99b4ea050 100755
--- a/test/integration/test-apt-progress-fd
+++ b/test/integration/test-apt-progress-fd
@@ -16,6 +16,7 @@ setupaptarchive
 exec 3> apt-progress.log
 testsuccess aptget install testing=0.1 -y -o APT::Status-Fd=3
 testfileequal './apt-progress.log' 'dlstatus:1:0:Retrieving file 1 of 1
+dlstatus:1:0:Retrieving file 1 of 1
 dlstatus:1:20:Retrieving file 1 of 1
 pmstatus:dpkg-exec:0:Running dpkg
 pmstatus:testing:0:Installing testing (amd64)
@@ -32,6 +33,7 @@ pmstatus:dpkg-exec:83.3333:Running dpkg'
 exec 3> apt-progress.log
 testsuccess aptget install testing=0.8.15 -y -o APT::Status-Fd=3
 testfileequal './apt-progress.log' 'dlstatus:1:0:Retrieving file 1 of 1
+dlstatus:1:0:Retrieving file 1 of 1
 dlstatus:1:20:Retrieving file 1 of 1
 pmstatus:dpkg-exec:0:Running dpkg
 pmstatus:testing:0:Installing testing (amd64)
@@ -48,6 +50,7 @@ pmstatus:dpkg-exec:83.3333:Running dpkg'
 exec 3> apt-progress.log
 testsuccess aptget install testing=0.8.15 --reinstall -y -o APT::Status-Fd=3
 testfileequal './apt-progress.log' 'dlstatus:1:0:Retrieving file 1 of 1
+dlstatus:1:0:Retrieving file 1 of 1
 dlstatus:1:20:Retrieving file 1 of 1
 pmstatus:dpkg-exec:0:Running dpkg
 pmstatus:testing:0:Installing testing (amd64)
@@ -73,9 +76,8 @@ pmstatus:dpkg-exec:75:Running dpkg'
 # install non-native and ensure we get proper progress info
 exec 3> apt-progress.log
 testsuccess aptget install testing2:i386 -y -o APT::Status-Fd=3
-
-# and compare
 testfileequal './apt-progress.log' 'dlstatus:1:0:Retrieving file 1 of 1
+dlstatus:1:0:Retrieving file 1 of 1
 dlstatus:1:20:Retrieving file 1 of 1
 pmstatus:dpkg-exec:0:Running dpkg
 pmstatus:testing2:0:Installing testing2 (i386)
diff --git a/test/integration/test-bug-595691-empty-and-broken-archive-files b/test/integration/test-bug-595691-empty-and-broken-archive-files
index b42212f5e..3042d116d 100755
--- a/test/integration/test-bug-595691-empty-and-broken-archive-files
+++ b/test/integration/test-bug-595691-empty-and-broken-archive-files
@@ -27,9 +27,6 @@ testaptgetupdate() {
 
 createemptyarchive() {
 	find aptarchive/ \( -name "Packages*" -o -name "en*" \) -type f -delete
-	if [ "en" = "$1" ]; then
-		echo -n "" | $COMPRESSOR_CMD > aptarchive/Packages.$COMPRESS
-	fi
 	touch aptarchive/Packages
 	echo -n "" | $COMPRESSOR_CMD > aptarchive/${1}.$COMPRESS
 	generatereleasefiles
@@ -39,9 +36,6 @@ createemptyarchive() {
 
 createemptyfile() {
 	find aptarchive/ \( -name "Packages*" -o -name "en*" \) -type f -delete
-	if [ "en" = "$1" ]; then
-		echo -n "" | $COMPRESSOR_CMD > aptarchive/Packages.$COMPRESS
-	fi
 	touch aptarchive/Packages aptarchive/${1}.$COMPRESS
 	generatereleasefiles
 	signreleasefiles
@@ -52,19 +46,13 @@ testoverfile() {
 	local APTARCHIVE="$(readlink -f ./aptarchive)"
 	forcecompressor "$1"
 
-	createemptyfile 'en'
-	testaptgetupdate 'Reading package lists...' "empty file en.$COMPRESS over file"
-
-	createemptyarchive 'en'
-	testaptgetupdate 'Reading package lists...' "empty archive en.$COMPRESS over file"
-
 	createemptyarchive 'Packages'
-	# FIXME: Why omits the file transport the Packages Get line?
-	#Get:3 file:  Packages []
-	testaptgetupdate 'Reading package lists...' "empty archive Packages.$COMPRESS over file"
+	testaptgetupdate "Get: file:$APTARCHIVE  Packages []
+Reading package lists..." "empty archive Packages.$COMPRESS over file"
 
 	createemptyfile 'Packages'
-	testaptgetupdate "Err file:$APTARCHIVE  Packages
+	testaptgetupdate "Get: file:$APTARCHIVE  Packages
+Err file:$APTARCHIVE  Packages
   Empty files can't be valid archives
 W: Failed to fetch ${COMPRESSOR}:${APTARCHIVE}/Packages.$COMPRESS  Empty files can't be valid archives
 
diff --git a/test/integration/test-bug-596498-trusted-unsigned-repo b/test/integration/test-bug-596498-trusted-unsigned-repo
index 4eb77b9a4..1ff0f1d8d 100755
--- a/test/integration/test-bug-596498-trusted-unsigned-repo
+++ b/test/integration/test-bug-596498-trusted-unsigned-repo
@@ -15,13 +15,17 @@ aptgetupdate() {
 	${1:-testwarning} aptget update --allow-insecure-repositories
 }
 
-PKGTEXT="$(aptget install cool --assume-no -d | head -n 7)"
+PKGTEXT="$(aptget install cool --assume-no -d | head -n 8)"
+DOWNLOG="$(echo "$PKGTEXT" | tail -n 1)"
+PKGTEXT="$(echo "$PKGTEXT" | head -n 7)"
 DEBFILE='rootdir/etc/apt/sources.list.d/apt-test-unstable-deb.list'
 
 testsuccessequal "$PKGTEXT
+$DOWNLOG
 Download complete and in download only mode" aptget install cool --assume-no -d
 
 testsuccessequal "$PKGTEXT
+$DOWNLOG
 Download complete and in download only mode" aptget install cool --assume-no -d --allow-unauthenticated
 
 sed -i -e 's#deb#deb [trusted=no]#' $DEBFILE
@@ -47,10 +51,12 @@ testsuccessequal "$PKGTEXT
 WARNING: The following packages cannot be authenticated!
   cool
 Authentication warning overridden.
+$DOWNLOG
 Download complete and in download only mode" aptget install cool --assume-no -d --allow-unauthenticated
 
 sed -i -e 's#deb#deb [trusted=yes]#' $DEBFILE
 aptgetupdate
 
 testsuccessequal "$PKGTEXT
+$DOWNLOG
 Download complete and in download only mode" aptget install cool --assume-no -d
-- 
cgit v1.2.3-70-g09d2


From b0d408547734100bf86781615f546487ecf390d9 Mon Sep 17 00:00:00 2001
From: David Kalnischkies <david@kalnischkies.de>
Date: Wed, 24 Jun 2015 19:31:22 +0200
Subject: implement Signed-By option for sources.list
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Limits which key(s) can be used to sign a repository. Not immensely useful
from a security perspective all by itself, but if the user has
additional measures in place to confine a repository (like pinning) an
attacker who gets the key for such a repository is limited to its
potential and can't use the key to sign its attacks for an other (maybe
less limited) repository… (yes, this is as weak as it sounds, but having
the capability might come in handy for implementing other stuff later).
---
 apt-pkg/acquire-item.cc                        | 15 +++++++-
 apt-pkg/acquire-item.h                         |  1 +
 apt-pkg/contrib/gpgv.cc                        | 17 +++++++++-
 apt-pkg/contrib/gpgv.h                         |  5 ++-
 apt-pkg/deb/debmetaindex.cc                    | 35 +++++++++++++++++++
 apt-pkg/deb/debmetaindex.h                     |  1 +
 apt-pkg/metaindex.cc                           |  4 +--
 apt-pkg/metaindex.h                            |  4 ++-
 apt-pkg/sourcelist.cc                          | 28 ++++++++-------
 cmdline/apt-key.in                             | 22 ++++++++++--
 doc/sources.list.5.xml                         | 24 ++++++-------
 methods/gpgv.cc                                | 18 +++++-----
 test/integration/framework                     | 23 +++++++++----
 test/integration/test-apt-key                  | 37 ++++++++++++++++++--
 test/integration/test-releasefile-verification | 47 +++++++++++++++++++++++---
 15 files changed, 225 insertions(+), 56 deletions(-)

(limited to 'methods')

diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc
index a30a5d154..01a679fe0 100644
--- a/apt-pkg/acquire-item.cc
+++ b/apt-pkg/acquire-item.cc
@@ -808,7 +808,6 @@ string pkgAcqMetaBase::Custom600Headers() const
    Header += MaximumSize;
 
    string const FinalFile = GetFinalFilename();
-
    struct stat Buf;
    if (stat(FinalFile.c_str(),&Buf) == 0)
       Header += "\nLast-Modified: " + TimeRFC1123(Buf.st_mtime);
@@ -1132,6 +1131,10 @@ string pkgAcqMetaClearSig::Custom600Headers() const
 {
    string Header = pkgAcqMetaBase::Custom600Headers();
    Header += "\nFail-Ignore: true";
+   std::string const key = TransactionManager->MetaIndexParser->GetSignedBy();
+   if (key.empty() == false)
+      Header += "\nSigned-By: " + key;
+
    return Header;
 }
 									/*}}}*/
@@ -1372,6 +1375,16 @@ pkgAcqMetaSig::pkgAcqMetaSig(pkgAcquire * const Owner,
 									/*}}}*/
 pkgAcqMetaSig::~pkgAcqMetaSig()						/*{{{*/
 {
+}
+									/*}}}*/
+// pkgAcqMetaSig::Custom600Headers - Insert custom request headers	/*{{{*/
+std::string pkgAcqMetaSig::Custom600Headers() const
+{
+   std::string Header = pkgAcqTransactionItem::Custom600Headers();
+   std::string const key = TransactionManager->MetaIndexParser->GetSignedBy();
+   if (key.empty() == false)
+      Header += "\nSigned-By: " + key;
+   return Header;
 }
 									/*}}}*/
 // AcqMetaSig::Done - The signature was downloaded/verified		/*{{{*/
diff --git a/apt-pkg/acquire-item.h b/apt-pkg/acquire-item.h
index 10ece76c9..1cd2a6d03 100644
--- a/apt-pkg/acquire-item.h
+++ b/apt-pkg/acquire-item.h
@@ -541,6 +541,7 @@ class APT_HIDDEN pkgAcqMetaSig : public pkgAcqTransactionItem
    virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf);
    virtual void Done(std::string const &Message, HashStringList const &Hashes,
 		     pkgAcquire::MethodConfig const * const Cnf);
+   virtual std::string Custom600Headers() const;
 
    /** \brief Create a new pkgAcqMetaSig. */
    pkgAcqMetaSig(pkgAcquire * const Owner, pkgAcqMetaClearSig * const TransactionManager,
diff --git a/apt-pkg/contrib/gpgv.cc b/apt-pkg/contrib/gpgv.cc
index a01e319eb..ef84da0d8 100644
--- a/apt-pkg/contrib/gpgv.cc
+++ b/apt-pkg/contrib/gpgv.cc
@@ -16,6 +16,8 @@
 #include <sys/wait.h>
 #include <unistd.h>
 #include <stddef.h>
+
+#include <algorithm>
 #include <iostream>
 #include <string>
 #include <vector>
@@ -42,7 +44,7 @@ static char * GenerateTemporaryFileTemplate(const char *basename)	/*{{{*/
    of the lifting in regards to merging keyrings. Fun for the whole family.
 */
 void ExecGPGV(std::string const &File, std::string const &FileGPG,
-             int const &statusfd, int fd[2])
+             int const &statusfd, int fd[2], std::string const &key)
 {
    #define EINTERNAL 111
    std::string const aptkey = _config->FindFile("Dir::Bin::apt-key", "/usr/bin/apt-key");
@@ -55,6 +57,19 @@ void ExecGPGV(std::string const &File, std::string const &FileGPG,
    Args.push_back(aptkey.c_str());
    Args.push_back("--quiet");
    Args.push_back("--readonly");
+   if (key.empty() == false)
+   {
+      if (key[0] == '/')
+      {
+	 Args.push_back("--keyring");
+	 Args.push_back(key.c_str());
+      }
+      else
+      {
+	 Args.push_back("--keyid");
+	 Args.push_back(key.c_str());
+      }
+   }
    Args.push_back("verify");
 
    char statusfdstr[10];
diff --git a/apt-pkg/contrib/gpgv.h b/apt-pkg/contrib/gpgv.h
index f018893fd..2a4cdad72 100644
--- a/apt-pkg/contrib/gpgv.h
+++ b/apt-pkg/contrib/gpgv.h
@@ -38,9 +38,12 @@ class FileFd;
  *
  * @param File is the message (unsigned or clear-signed)
  * @param FileSig is the signature (detached or clear-signed)
+ * @param statusfd is the fd given to gpgv as --status-fd
+ * @param fd is used as a pipe for the standard output of gpgv
+ * @param key is the specific one to be used instead of using all
  */
 void ExecGPGV(std::string const &File, std::string const &FileSig,
-      int const &statusfd, int fd[2]) APT_NORETURN;
+      int const &statusfd, int fd[2], std::string const &Key = "") APT_NORETURN;
 inline APT_NORETURN void ExecGPGV(std::string const &File, std::string const &FileSig,
       int const &statusfd = -1) {
    int fd[2];
diff --git a/apt-pkg/deb/debmetaindex.cc b/apt-pkg/deb/debmetaindex.cc
index 5d7e539c7..4bb03a942 100644
--- a/apt-pkg/deb/debmetaindex.cc
+++ b/apt-pkg/deb/debmetaindex.cc
@@ -461,6 +461,29 @@ bool debReleaseIndex::SetValidUntilMax(time_t const Valid)
    else if (d->ValidUntilMax != Valid)
       return _error->Error(_("Conflicting values set for option %s concerning source %s %s"), "Max-ValidTime", URI.c_str(), Dist.c_str());
    return true;
+}
+bool debReleaseIndex::SetSignedBy(std::string const &pSignedBy)
+{
+   if (SignedBy.empty() == true && pSignedBy.empty() == false)
+   {
+      if (pSignedBy[0] == '/') // no check for existence as we could be chrooting later or such things
+	 ; // absolute path to a keyring file
+      else
+      {
+	 // we could go all fancy and allow short/long/string matches as gpgv/apt-key does,
+	 // but fingerprints are harder to fake than the others and this option is set once,
+	 // not interactively all the time so easy to type is not really a concern.
+	 std::string finger = pSignedBy;
+	 finger.erase(std::remove(finger.begin(), finger.end(), ' '), finger.end());
+	 std::transform(finger.begin(), finger.end(), finger.begin(), ::toupper);
+	 if (finger.length() != 40 || finger.find_first_not_of("0123456789ABCDEF") != std::string::npos)
+	    return _error->Error(_("Invalid value set for option %s concerning source %s %s (%s)"), "Signed-By", URI.c_str(), Dist.c_str(), "not a fingerprint");
+      }
+      SignedBy = pSignedBy;
+   }
+   else if (SignedBy != pSignedBy)
+      return _error->Error(_("Conflicting values set for option %s concerning source %s %s"), "Signed-By", URI.c_str(), Dist.c_str());
+   return true;
 }
 									/*}}}*/
 // ReleaseIndex::IsTrusted						/*{{{*/
@@ -706,6 +729,18 @@ class APT_HIDDEN debSLTypeDebian : public pkgSourceList::Type		/*{{{*/
 	 Deb->SetValidUntilMin(GetTimeOption(Options, "valid-until-min")) == false)
 	 return false;
 
+      std::map<std::string, std::string>::const_iterator const signedby = Options.find("signed-by");
+      if (signedby == Options.end())
+      {
+	 if (Deb->SetSignedBy("") == false)
+	    return false;
+      }
+      else
+      {
+	 if (Deb->SetSignedBy(signedby->second) == false)
+	    return false;
+      }
+
       return true;
    }
 
diff --git a/apt-pkg/deb/debmetaindex.h b/apt-pkg/deb/debmetaindex.h
index 879eb3bfc..bf5b7c1ce 100644
--- a/apt-pkg/deb/debmetaindex.h
+++ b/apt-pkg/deb/debmetaindex.h
@@ -56,6 +56,7 @@ class APT_HIDDEN debReleaseIndex : public metaIndex
    bool SetCheckValidUntil(TriState const Trusted);
    bool SetValidUntilMin(time_t const Valid);
    bool SetValidUntilMax(time_t const Valid);
+   bool SetSignedBy(std::string const &SignedBy);
 
    virtual bool IsTrusted() const;
 
diff --git a/apt-pkg/metaindex.cc b/apt-pkg/metaindex.cc
index 8bd13bb18..baf695f16 100644
--- a/apt-pkg/metaindex.cc
+++ b/apt-pkg/metaindex.cc
@@ -27,8 +27,7 @@ bool metaIndex::Merge(pkgCacheGenerator &Gen,OpProgress *) const
 metaIndex::metaIndex(std::string const &URI, std::string const &Dist,
       char const * const Type)
 : d(NULL), Indexes(NULL), Type(Type), URI(URI), Dist(Dist), Trusted(TRI_UNSET),
-   LoadedSuccessfully(TRI_UNSET),
-   Date(0), ValidUntil(0), SupportsAcquireByHash(false)
+   Date(0), ValidUntil(0), SupportsAcquireByHash(false), LoadedSuccessfully(TRI_UNSET)
 {
    /* nothing */
 }
@@ -48,6 +47,7 @@ APT_PURE std::string metaIndex::GetURI() const { return URI; }
 APT_PURE std::string metaIndex::GetDist() const { return Dist; }
 APT_PURE const char* metaIndex::GetType() const { return Type; }
 APT_PURE metaIndex::TriState metaIndex::GetTrusted() const { return Trusted; }
+APT_PURE std::string metaIndex::GetSignedBy() const { return SignedBy; }
 APT_PURE std::string metaIndex::GetCodename() const { return Codename; }
 APT_PURE std::string metaIndex::GetSuite() const { return Suite; }
 APT_PURE bool metaIndex::GetSupportsAcquireByHash() const { return SupportsAcquireByHash; }
diff --git a/apt-pkg/metaindex.h b/apt-pkg/metaindex.h
index 5be7397ae..d284655bf 100644
--- a/apt-pkg/metaindex.h
+++ b/apt-pkg/metaindex.h
@@ -52,7 +52,7 @@ protected:
    std::string URI;
    std::string Dist;
    TriState Trusted;
-   TriState LoadedSuccessfully;
+   std::string SignedBy;
 
    // parsed from a file
    std::string Suite;
@@ -61,6 +61,7 @@ protected:
    time_t ValidUntil;
    bool SupportsAcquireByHash;
    std::map<std::string, checkSum *> Entries;
+   TriState LoadedSuccessfully;
 
 public:
    // Various accessors
@@ -68,6 +69,7 @@ public:
    std::string GetDist() const;
    const char* GetType() const;
    TriState GetTrusted() const;
+   std::string GetSignedBy() const;
 
    std::string GetCodename() const;
    std::string GetSuite() const;
diff --git a/apt-pkg/sourcelist.cc b/apt-pkg/sourcelist.cc
index 0d65558ed..eef0ee709 100644
--- a/apt-pkg/sourcelist.cc
+++ b/apt-pkg/sourcelist.cc
@@ -93,27 +93,29 @@ bool pkgSourceList::Type::ParseStanza(vector<metaIndex *> &List,	/*{{{*/
    if (Enabled.empty() == false && StringToBool(Enabled) == false)
       return true;
 
-   std::map<char const * const, char const * const> mapping;
+   std::map<char const * const, std::pair<char const * const, bool> > mapping;
 #define APT_PLUSMINUS(X, Y) \
-   mapping.insert(std::make_pair(X, Y)); \
-   mapping.insert(std::make_pair(X "Add", Y "+")); \
-   mapping.insert(std::make_pair(X "Remove", Y "-"))
+   mapping.insert(std::make_pair(X, std::make_pair(Y, true))); \
+   mapping.insert(std::make_pair(X "Add", std::make_pair(Y "+", true))); \
+   mapping.insert(std::make_pair(X "Remove", std::make_pair(Y "-", true)))
    APT_PLUSMINUS("Architectures", "arch");
    APT_PLUSMINUS("Languages", "lang");
    APT_PLUSMINUS("Targets", "target");
 #undef APT_PLUSMINUS
-   mapping.insert(std::make_pair("Trusted", "trusted"));
-   mapping.insert(std::make_pair("Check-Valid-Until", "check-valid-until"));
-   mapping.insert(std::make_pair("Valid-Until-Min", "valid-until-min"));
-   mapping.insert(std::make_pair("Valid-Until-Max", "valid-until-max"));
+   mapping.insert(std::make_pair("Trusted", std::make_pair("trusted", false)));
+   mapping.insert(std::make_pair("Check-Valid-Until", std::make_pair("check-valid-until", false)));
+   mapping.insert(std::make_pair("Valid-Until-Min", std::make_pair("valid-until-min", false)));
+   mapping.insert(std::make_pair("Valid-Until-Max", std::make_pair("valid-until-max", false)));
+   mapping.insert(std::make_pair("Signed-By", std::make_pair("signed-by", false)));
 
-   for (std::map<char const * const, char const * const>::const_iterator m = mapping.begin(); m != mapping.end(); ++m)
+   for (std::map<char const * const, std::pair<char const * const, bool> >::const_iterator m = mapping.begin(); m != mapping.end(); ++m)
       if (Tags.Exists(m->first))
       {
-         // for deb822 the " " is the delimiter, but the backend expects ","
-         std::string option = Tags.FindS(m->first);
-         std::replace(option.begin(), option.end(), ' ', ',');
-         Options[m->second] = option;
+	 std::string option = Tags.FindS(m->first);
+	 // for deb822 the " " is the delimiter, but the backend expects ","
+	 if (m->second.second == true)
+	    std::replace(option.begin(), option.end(), ' ', ',');
+	 Options[m->second.first] = option;
       }
 
    // now create one item per suite/section
diff --git a/cmdline/apt-key.in b/cmdline/apt-key.in
index 2a66ad74d..16887bd50 100644
--- a/cmdline/apt-key.in
+++ b/cmdline/apt-key.in
@@ -199,7 +199,7 @@ remove_key_from_keyring() {
 foreach_keyring_do() {
    local ACTION="$1"
    shift
-   # if a --keyring was given, just remove from there
+   # if a --keyring was given, just work on this one
    if [ -n "$FORCED_KEYRING" ]; then
 	$ACTION "$FORCED_KEYRING" "$@"
    else
@@ -279,7 +279,14 @@ merge_back_changes() {
 }
 
 setup_merged_keyring() {
-    if [ -z "$FORCED_KEYRING" ]; then
+    if [ -n "$FORCED_KEYID" ]; then
+	foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/allrings.gpg"
+	FORCED_KEYRING="${GPGHOMEDIR}/forcedkeyid.gpg"
+	TRUSTEDFILE="${FORCED_KEYRING}"
+	GPG="$GPG --keyring $TRUSTEDFILE"
+	# ignore error as this "just" means we haven't found the forced keyid and the keyring will be empty
+	$GPG_CMD --batch --yes --keyring "${GPGHOMEDIR}/allrings.gpg" --export "$FORCED_KEYID" | $GPG --batch --yes --import || true
+    elif [ -z "$FORCED_KEYRING" ]; then
 	foreach_keyring_do 'import_keys_from_keyring' "${GPGHOMEDIR}/pubring.gpg"
 	if [ -r "${GPGHOMEDIR}/pubring.gpg" ]; then
 	    cp -a "${GPGHOMEDIR}/pubring.gpg" "${GPGHOMEDIR}/pubring.orig.gpg"
@@ -328,12 +335,17 @@ while [ -n "$1" ]; do
 	 TRUSTEDFILE="$1"
 	 FORCED_KEYRING="$1"
 	 ;;
+      --keyid)
+	 shift
+	 FORCED_KEYID="$1"
+	 ;;
       --secret-keyring)
 	 shift
 	 FORCED_SECRET_KEYRING="$1"
 	 ;;
       --readonly)
 	 merge_back_changes() { true; }
+	 create_new_keyring() { true; }
 	 ;;
       --fakeroot)
 	 requires_root() { true; }
@@ -460,7 +472,11 @@ case "$command" in
     verify)
 	setup_merged_keyring
 	if which gpgv >/dev/null 2>&1; then
-	    gpgv --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@"
+	    if [ -n "$FORCED_KEYRING" ]; then
+		gpgv --homedir "${GPGHOMEDIR}" --keyring "${FORCED_KEYRING}" --ignore-time-conflict "$@"
+	    else
+		gpgv --homedir "${GPGHOMEDIR}" --keyring "${GPGHOMEDIR}/pubring.gpg" --ignore-time-conflict "$@"
+	    fi
 	else
 	    $GPG --verify "$@"
 	fi
diff --git a/doc/sources.list.5.xml b/doc/sources.list.5.xml
index aded8ecef..12a7773f5 100644
--- a/doc/sources.list.5.xml
+++ b/doc/sources.list.5.xml
@@ -232,18 +232,18 @@ deb-src [ option1=value1 option2=value2 ] uri suite [component1] [component2] [.
        anomalies.
 
        <itemizedlist>
-	  <listitem><para><option>Trusted</option> (<option>trusted</option>)
-		is a tri-state value which defaults to APT deciding if a source
-		is considered trusted or if warnings should be raised before e.g.
-		packages are installed from this source. This option can be used
-		to override this decision either with the value <literal>yes</literal>,
-		which lets APT consider this source always as a trusted source
-		even if it has no or fails authentication checks by disabling parts
-		of &apt-secure; and should therefore only be used in a local and trusted
-		context (if at all) as otherwise security is breached. The opposite
-		can be achieved with the value no, which causes the source to be handled
-		as untrusted even if the authentication checks passed successfully.
-		The default value can't be set explicitly.
+	  <listitem><para><option>Signed-By</option> (<option>signed-by</option>)
+		is either an absolute path to a keyring file (has to be
+		accessible and readable for the <literal>_apt</literal> user,
+		so ensure everyone has read-permissions on the file) or a
+		fingerprint of a key in either the
+		<filename>trusted.gpg</filename> keyring or in one of the
+		keyrings in the <filename>trusted.gpg.d/</filename> directory
+		(see <command>apt-key fingerprint</command>). If the option is
+		set only the key(s) in this keyring or only the key with this
+		fingerprint is used for the &apt-secure; verification of this
+		repository. Otherwise all keys in the trusted keyrings are
+		considered valid signers for this repository.
 	  </para></listitem>
 
 	  <listitem><para><option>Check-Valid-Until</option> (<option>check-valid-until</option>)
diff --git a/methods/gpgv.cc b/methods/gpgv.cc
index 41f138be6..014430041 100644
--- a/methods/gpgv.cc
+++ b/methods/gpgv.cc
@@ -37,13 +37,14 @@ class GPGVMethod : public pkgAcqMethod
 {
    private:
    string VerifyGetSigners(const char *file, const char *outfile,
-				vector<string> &GoodSigners, 
+				std::string const &key,
+				vector<string> &GoodSigners,
                                 vector<string> &BadSigners,
                                 vector<string> &WorthlessSigners,
 				vector<string> &NoPubKeySigners);
    
    protected:
-   virtual bool Fetch(FetchItem *Itm);
+   virtual bool URIAcquire(std::string const &Message, FetchItem *Itm);
    virtual bool Configuration(string Message);
    public:
    
@@ -61,6 +62,7 @@ bool GPGVMethod::Configuration(string Message)
 }
 
 string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
+					 std::string const &key,
 					 vector<string> &GoodSigners,
 					 vector<string> &BadSigners,
 					 vector<string> &WorthlessSigners,
@@ -80,7 +82,7 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
    if (pid < 0)
       return string("Couldn't spawn new process") + strerror(errno);
    else if (pid == 0)
-      ExecGPGV(outfile, file, 3, fd);
+      ExecGPGV(outfile, file, 3, fd, key);
    close(fd[1]);
 
    FILE *pipein = fdopen(fd[0], "r");
@@ -174,11 +176,11 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
       return _("Unknown error executing apt-key");
 }
 
-bool GPGVMethod::Fetch(FetchItem *Itm)
+bool GPGVMethod::URIAcquire(std::string const &Message, FetchItem *Itm)
 {
-   URI Get = Itm->Uri;
-   string Path = Get.Host + Get.Path; // To account for relative paths
-   string keyID;
+   URI const Get = Itm->Uri;
+   string const Path = Get.Host + Get.Path; // To account for relative paths
+   std::string const key = LookupTag(Message, "Signed-By");
    vector<string> GoodSigners;
    vector<string> BadSigners;
    // a worthless signature is a expired or revoked one
@@ -190,7 +192,7 @@ bool GPGVMethod::Fetch(FetchItem *Itm)
    URIStart(Res);
 
    // Run apt-key on file, extract contents and get the key ID of the signer
-   string msg = VerifyGetSigners(Path.c_str(), Itm->DestFile.c_str(),
+   string msg = VerifyGetSigners(Path.c_str(), Itm->DestFile.c_str(), key,
                                  GoodSigners, BadSigners, WorthlessSigners,
                                  NoPubKeySigners);
    if (GoodSigners.empty() || !BadSigners.empty() || !NoPubKeySigners.empty())
diff --git a/test/integration/framework b/test/integration/framework
index 059cba9fb..6ae5003f7 100644
--- a/test/integration/framework
+++ b/test/integration/framework
@@ -1414,14 +1414,23 @@ testfailure() {
 	else
 		local EXITCODE=$?
 		if expr match "$1" '^apt.*' >/dev/null; then
-			if grep -q -E ' runtime error: ' "$OUTPUT"; then
-				msgfailoutput 'compiler detected undefined behavior' "$OUTPUT" "$@"
-			elif grep -q -E '==ERROR' "$OUTPUT"; then
-				msgfailoutput 'compiler sanitizers reported errors' "$OUTPUT" "$@"
-			elif ! grep -q -E '^E: ' "$OUTPUT"; then
-				msgfailoutput "run failed with exitcode ${EXITCODE}, but with no errors" "$OUTPUT" "$@"
+			if [ "$1" = 'aptkey' ]; then
+				if grep -q -E " Can't check signature: " "$OUTPUT" || \
+					grep -q -E " BAD signature from " "$OUTPUT"; then
+					msgpass
+				else
+					msgfailoutput "run failed with exitcode ${EXITCODE}, but no signature error" "$OUTPUT" "$@"
+				fi
 			else
-				msgpass
+				if grep -q -E ' runtime error: ' "$OUTPUT"; then
+					msgfailoutput 'compiler detected undefined behavior' "$OUTPUT" "$@"
+				elif grep -q -E '==ERROR' "$OUTPUT"; then
+					msgfailoutput 'compiler sanitizers reported errors' "$OUTPUT" "$@"
+				elif ! grep -q -E '^E: ' "$OUTPUT"; then
+					msgfailoutput "run failed with exitcode ${EXITCODE}, but with no errors" "$OUTPUT" "$@"
+				else
+					msgpass
+				fi
 			fi
 		else
 			msgpass
diff --git a/test/integration/test-apt-key b/test/integration/test-apt-key
index 486acccc8..e1be08c65 100755
--- a/test/integration/test-apt-key
+++ b/test/integration/test-apt-key
@@ -73,7 +73,7 @@ pub   2048R/DBAC8DAE 2010-08-18'
 	testsuccess aptkey --fakeroot del DBAC8DAE
 	testempty aptkey list
 
-	msgtest 'Test key removal with' 'lowercase key ID' #keylength somewher between 8byte and short
+	msgtest 'Test key removal with' 'lowercase key ID' #keylength somewhere between 8byte and short
 	cleanplate
 	cp -a keys/joesixpack.pub rootdir/etc/apt/trusted.gpg.d/joesixpack.gpg
 	testsuccess --nomsg aptkey --fakeroot del d141dbac8dae
@@ -166,6 +166,40 @@ pub   2048R/528144E2 2011-01-16'
 	msgtest 'Test merge-back of' 'removed duplicate keys'
 	testsuccess --nomsg aptkey adv --batch --yes --delete-keys DBAC8DAE
 	testaptkeys 'pub   2048R/528144E2 2011-01-16'
+
+	cleanplate
+	cp -a keys/joesixpack.pub rootdir/etc/apt/trusted.gpg.d/joesixpack.gpg
+	cp -a keys/testcase-multikey.pub rootdir/etc/apt/trusted.gpg.d/multikey.gpg
+	msgtest 'Test signing a file' 'with a key'
+	echo 'Verify me. This is my signature.' > signature
+	testsuccess --nomsg aptkey --quiet --keyring keys/marvinparanoid.pub --secret-keyring keys/marvinparanoid.sec --readonly \
+		adv --batch --yes --default-key 'Marvin' --armor --detach-sign --sign --output signature.gpg signature
+
+	msgtest 'Test verify a file' 'with all keys'
+	testsuccess --nomsg aptkey --quiet --readonly verify signature.gpg signature
+
+	msgtest 'Test verify a file' 'with good keyring'
+	testsuccess --nomsg aptkey --quiet --readonly --keyring keys/testcase-multikey.pub verify signature.gpg signature
+
+	msgtest 'Test fail verify a file' 'with bad keyring'
+	testfailure --nomsg aptkey --quiet --readonly --keyring keys/joesixpack.pub verify signature.gpg signature
+
+	msgtest 'Test fail verify a file' 'with non-existing keyring'
+	testfailure --nomsg aptkey --quiet --readonly --keyring keys/does-not-exist.pub verify signature.gpg signature
+	testfailure test -e keys/does-not-exist.pub
+
+	msgtest 'Test verify a file' 'with good keyid'
+	testsuccess --nomsg aptkey --quiet --readonly --keyid 'Paranoid' verify signature.gpg signature
+
+	msgtest 'Test fail verify a file' 'with bad keyid'
+	testfailure --nomsg aptkey --quiet --readonly --keyid 'Sixpack' verify signature.gpg signature
+
+	msgtest 'Test fail verify a file' 'with non-existing keyid'
+	testfailure --nomsg aptkey --quiet --readonly --keyid 'Kalnischkies' verify signature.gpg signature
+
+	msgtest 'Test verify fails on' 'bad file'
+	echo 'lalalalala' > signature
+	testfailure --nomsg aptkey --quiet --readonly verify signature.gpg signature
 }
 
 setupgpgcommand() {
@@ -187,4 +221,3 @@ setupgpgcommand 'gpg'
 testrun
 setupgpgcommand 'gpg2'
 testrun
-
diff --git a/test/integration/test-releasefile-verification b/test/integration/test-releasefile-verification
index e8419524c..1c3953c8b 100755
--- a/test/integration/test-releasefile-verification
+++ b/test/integration/test-releasefile-verification
@@ -139,11 +139,6 @@ runtest() {
 	failaptold
 
 	prepare ${PKGFILE}-new
-	# weborf doesn't support If-Range
-	for release in $(find rootdir/var/lib/apt/lists/partial/ -name '*Release'); do
-		rm $release
-		touch $release
-	done
 	signreleasefiles 'Joe Sixpack'
 	find aptarchive/ -name "$DELETEFILE" -delete
 	msgmsg 'Bad warm archive signed by' 'Joe Sixpack'
@@ -191,6 +186,48 @@ runtest() {
 	testsuccessequal "$(cat ${PKGFILE}-new)
 " aptcache show apt
 	installaptnew
+
+	prepare ${PKGFILE}
+	rm -rf rootdir/var/lib/apt/lists
+	signreleasefiles 'Marvin Paranoid'
+	find aptarchive/ -name "$DELETEFILE" -delete
+	msgmsg 'Cold archive signed by good keyring' 'Marvin Paranoid'
+	local MARVIN="$(readlink -f keys/marvinparanoid.pub)"
+	sed -i "s#^\(deb\(-src\)\?\) #\1 [signed-by=$MARVIN] #" rootdir/etc/apt/sources.list.d/*
+	testsuccess aptget update -o Debug::pkgAcquire::Worker=1
+	testsuccessequal "$(cat ${PKGFILE})
+" aptcache show apt
+	installaptold
+
+	rm -rf rootdir/var/lib/apt/lists
+	signreleasefiles 'Joe Sixpack'
+	find aptarchive/ -name "$DELETEFILE" -delete
+	msgmsg 'Cold archive signed by bad keyring' 'Joe Sixpack'
+	updatewithwarnings '^W: .* NO_PUBKEY'
+
+	sed -i "s#^\(deb\(-src\)\?\) \[signed-by=$MARVIN\] #\1 #" rootdir/etc/apt/sources.list.d/*
+	local MARVIN="$(aptkey --keyring $MARVIN finger | grep 'Key fingerprint' | cut -d'=' -f 2 | tr -d ' ')"
+
+	prepare ${PKGFILE}
+	rm -rf rootdir/var/lib/apt/lists
+	signreleasefiles 'Marvin Paranoid'
+	find aptarchive/ -name "$DELETEFILE" -delete
+	msgmsg 'Cold archive signed by good keyid' 'Marvin Paranoid'
+	sed -i "s#^\(deb\(-src\)\?\) #\1 [signed-by=$MARVIN] #" rootdir/etc/apt/sources.list.d/*
+	cp keys/marvinparanoid.pub rootdir/etc/apt/trusted.gpg.d/marvinparanoid.gpg
+	testsuccess aptget update -o Debug::pkgAcquire::Worker=1 -o Debug::Acquire::gpgv=1
+	testsuccessequal "$(cat ${PKGFILE})
+" aptcache show apt
+	installaptold
+	rm -f rootdir/etc/apt/trusted.gpg.d/marvinparanoid.gpg
+
+	rm -rf rootdir/var/lib/apt/lists
+	signreleasefiles 'Joe Sixpack'
+	find aptarchive/ -name "$DELETEFILE" -delete
+	msgmsg 'Cold archive signed by bad keyid' 'Joe Sixpack'
+	updatewithwarnings '^W: .* NO_PUBKEY'
+
+	sed -i "s#^\(deb\(-src\)\?\) \[signed-by=$MARVIN\] #\1 #" rootdir/etc/apt/sources.list.d/*
 }
 
 runtest2() {
-- 
cgit v1.2.3-70-g09d2


From 653ef26c70dc9c0e2cbfdd4e79117876bb63e87d Mon Sep 17 00:00:00 2001
From: David Kalnischkies <david@kalnischkies.de>
Date: Tue, 30 Jun 2015 10:53:51 +0200
Subject: allow individual targets to be kept compressed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There is an option to keep all targets (Packages, Sources, …) compressed
for a while now, but the all-or-nothing approach is a bit limited for
our purposes with additional targets as some of them are very big
(Contents) and rarely used in comparison, so keeping them compressed by
default can make sense, while others are still unpacked.

Most interesting is the copy-change maybe: Copy is used by the acquire
system as an uncompressor and it is hence expected that it returns the
hashes for the "output", not the input. Now, in the case of keeping a
file compressed, the output is never written to disk, but generated in
memory and we should still validated it, so for compressed files copy is
expected to return the hashes of the uncompressed file. We used to use
the config option to enable on-the-fly decompress in the method, but in
reality copy is never used in a way where it shouldn't decompress a
compressed file to get its hashes, so we can save us the trouble of
sending this information to the method and just do it always.
---
 apt-pkg/acquire-item.cc                            | 14 +++++++-------
 apt-pkg/deb/debmetaindex.cc                        |  7 +++++--
 apt-pkg/indexfile.cc                               |  5 +++--
 apt-pkg/indexfile.h                                |  5 ++++-
 methods/copy.cc                                    |  8 ++------
 test/integration/test-apt-acquire-additional-files | 18 +++++++++++++++++-
 test/integration/test-compressed-indexes           |  2 +-
 7 files changed, 39 insertions(+), 20 deletions(-)

(limited to 'methods')

diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc
index 01a679fe0..b6466115e 100644
--- a/apt-pkg/acquire-item.cc
+++ b/apt-pkg/acquire-item.cc
@@ -80,18 +80,18 @@ static std::string GetFinalFileNameFromURI(std::string const &uri)	/*{{{*/
    return _config->FindDir("Dir::State::lists") + URItoFileName(uri);
 }
 									/*}}}*/
-static std::string GetCompressedFileName(std::string const &URI, std::string const &Name, std::string const &Ext) /*{{{*/
+static std::string GetCompressedFileName(IndexTarget const &Target, std::string const &Name, std::string const &Ext) /*{{{*/
 {
    if (Ext.empty() || Ext == "uncompressed")
       return Name;
 
    // do not reverify cdrom sources as apt-cdrom may rewrite the Packages
    // file when its doing the indexcopy
-   if (URI.substr(0,6) == "cdrom:")
+   if (Target.URI.substr(0,6) == "cdrom:")
       return Name;
 
    // adjust DestFile if its compressed on disk
-   if (_config->FindB("Acquire::GzipIndexes",false) == true)
+   if (Target.KeepCompressed == true)
       return Name + '.' + Ext;
    return Name;
 }
@@ -269,7 +269,7 @@ std::string pkgAcqDiffIndex::GetFinalFilename() const
 std::string pkgAcqIndex::GetFinalFilename() const
 {
    std::string const FinalFile = GetFinalFileNameFromURI(Target.URI);
-   return GetCompressedFileName(Target.URI, FinalFile, CurrentCompressionExtension);
+   return GetCompressedFileName(Target, FinalFile, CurrentCompressionExtension);
 }
 std::string pkgAcqMetaSig::GetFinalFilename() const
 {
@@ -2456,7 +2456,7 @@ void pkgAcqIndex::ReverifyAfterIMS()
 {
    // update destfile to *not* include the compression extension when doing
    // a reverify (as its uncompressed on disk already)
-   DestFile = GetCompressedFileName(Target.URI, GetPartialFileNameFromURI(Target.URI), CurrentCompressionExtension);
+   DestFile = GetCompressedFileName(Target, GetPartialFileNameFromURI(Target.URI), CurrentCompressionExtension);
 
    // copy FinalFile into partial/ so that we check the hash again
    string FinalFile = GetFinalFilename();
@@ -2532,8 +2532,8 @@ void pkgAcqIndex::StageDownloadDone(string const &Message, HashStringList const
       return;
    }
 
-   // If we have compressed indexes enabled, queue for hash verification
-   if (_config->FindB("Acquire::GzipIndexes",false))
+   // If we want compressed indexes, just copy in place for hash verification
+   if (Target.KeepCompressed == true)
    {
       DestFile = GetPartialFileNameFromURI(Target.URI + '.' + CurrentCompressionExtension);
       EraseFileName = "";
diff --git a/apt-pkg/deb/debmetaindex.cc b/apt-pkg/deb/debmetaindex.cc
index 4bb03a942..10ab0f844 100644
--- a/apt-pkg/deb/debmetaindex.cc
+++ b/apt-pkg/deb/debmetaindex.cc
@@ -123,6 +123,7 @@ static void GetIndexTargetsFor(char const * const Type, std::string const &URI,
    std::string const Release = (Dist == "/") ? "" : Dist;
    std::string const Site = ::URI::ArchiveOnly(URI);
 
+   bool const GzipIndex = _config->FindB("Acquire::GzipIndexes", false);
    for (std::vector<debReleaseIndexPrivate::debSectionEntry>::const_iterator E = entries.begin(); E != entries.end(); ++E)
    {
       for (std::vector<std::string>::const_iterator T = E->Targets.begin(); T != E->Targets.end(); ++T)
@@ -131,7 +132,8 @@ static void GetIndexTargetsFor(char const * const Type, std::string const &URI,
 	 std::string const tplMetaKey = APT_T_CONFIG(flatArchive ? "flatMetaKey" : "MetaKey");
 	 std::string const tplShortDesc = APT_T_CONFIG("ShortDescription");
 	 std::string const tplLongDesc = APT_T_CONFIG(flatArchive ? "flatDescription" : "Description");
-	 bool const IsOptional = _config->FindB(std::string("APT::Acquire::Targets::deb-src::") + *T + "::Optional", true);
+	 bool const IsOptional = _config->FindB(std::string("APT::Acquire::Targets::") + Type + "::" + *T + "::Optional", true);
+	 bool const KeepCompressed = _config->FindB(std::string("APT::Acquire::Targets::") + Type + "::" + *T + "::KeepCompressed", GzipIndex);
 #undef APT_T_CONFIG
 	 if (tplMetaKey.empty())
 	    continue;
@@ -173,6 +175,7 @@ static void GetIndexTargetsFor(char const * const Type, std::string const &URI,
 		     LongDesc,
 		     Options.find("BASE_URI")->second + MetaKey,
 		     IsOptional,
+		     KeepCompressed,
 		     Options
 		     );
 	       IndexTargets.push_back(Target);
@@ -413,7 +416,7 @@ bool debReleaseIndex::parseSumData(const char *&Start, const char *End,	/*{{{*/
 bool debReleaseIndex::GetIndexes(pkgAcquire *Owner, bool const &GetAll)/*{{{*/
 {
    std::vector<IndexTarget> const targets = GetIndexTargets();
-#define APT_TARGET(X) IndexTarget("", X, MetaIndexInfo(X), MetaIndexURI(X), false, std::map<std::string,std::string>())
+#define APT_TARGET(X) IndexTarget("", X, MetaIndexInfo(X), MetaIndexURI(X), false, false, std::map<std::string,std::string>())
    pkgAcqMetaClearSig * const TransactionManager = new pkgAcqMetaClearSig(Owner,
 	 APT_TARGET("InRelease"), APT_TARGET("Release"), APT_TARGET("Release.gpg"),
 	 targets, this);
diff --git a/apt-pkg/indexfile.cc b/apt-pkg/indexfile.cc
index e9e1b08c3..cce17403d 100644
--- a/apt-pkg/indexfile.cc
+++ b/apt-pkg/indexfile.cc
@@ -115,8 +115,9 @@ APT_DEPRECATED std::string pkgIndexFile::LanguageCode() {
 // IndexTarget - Constructor						/*{{{*/
 IndexTarget::IndexTarget(std::string const &MetaKey, std::string const &ShortDesc,
       std::string const &LongDesc, std::string const &URI, bool const IsOptional,
-      std::map<std::string, std::string> const &Options) :
-   URI(URI), Description(LongDesc), ShortDesc(ShortDesc), MetaKey(MetaKey), IsOptional(IsOptional), Options(Options)
+      bool const KeepCompressed, std::map<std::string, std::string> const &Options) :
+   URI(URI), Description(LongDesc), ShortDesc(ShortDesc), MetaKey(MetaKey),
+   IsOptional(IsOptional), KeepCompressed(KeepCompressed), Options(Options)
 {
 }
 									/*}}}*/
diff --git a/apt-pkg/indexfile.h b/apt-pkg/indexfile.h
index 7eeccdbd3..44d39110d 100644
--- a/apt-pkg/indexfile.h
+++ b/apt-pkg/indexfile.h
@@ -60,6 +60,9 @@ class IndexTarget							/*{{{*/
    /** \brief Is it okay if the file isn't found in the meta index */
    bool IsOptional;
 
+   /** \brief If the file is downloaded compressed, do not unpack it */
+   bool KeepCompressed;
+
    /** \brief options with which this target was created
        Prefer the usage of #Option if at all possible.
        Beware: Not all of these options are intended for public use */
@@ -67,7 +70,7 @@ class IndexTarget							/*{{{*/
 
    IndexTarget(std::string const &MetaKey, std::string const &ShortDesc,
 	 std::string const &LongDesc, std::string const &URI, bool const IsOptional,
-	 std::map<std::string, std::string> const &Options);
+	 bool const KeepCompressed, std::map<std::string, std::string> const &Options);
 
    enum OptionKeys {
       SITE,
diff --git a/methods/copy.cc b/methods/copy.cc
index a8e289df5..4bdc15f75 100644
--- a/methods/copy.cc
+++ b/methods/copy.cc
@@ -38,11 +38,7 @@ class CopyMethod : public pkgAcqMethod
 void CopyMethod::CalculateHashes(FetchItem const * const Itm, FetchResult &Res)
 {
    Hashes Hash(Itm->ExpectedHashes);
-   FileFd::CompressMode CompressMode = FileFd::None;
-   if (_config->FindB("Acquire::GzipIndexes", false) == true)
-      CompressMode = FileFd::Extension;
-
-   FileFd Fd(Res.Filename, FileFd::ReadOnly, CompressMode);
+   FileFd Fd(Res.Filename, FileFd::ReadOnly, FileFd::Extension);
    Hash.AddFD(Fd);
    Res.TakeHashes(Hash);
 }
@@ -53,7 +49,7 @@ void CopyMethod::CalculateHashes(FetchItem const * const Itm, FetchResult &Res)
 bool CopyMethod::Fetch(FetchItem *Itm)
 {
    // this ensures that relative paths work in copy
-   std::string File = Itm->Uri.substr(Itm->Uri.find(':')+1);
+   std::string const File = Itm->Uri.substr(Itm->Uri.find(':')+1);
 
    // Stat the file and send a start message
    struct stat Buf;
diff --git a/test/integration/test-apt-acquire-additional-files b/test/integration/test-apt-acquire-additional-files
index 3465c0a16..fecdf30bf 100755
--- a/test/integration/test-apt-acquire-additional-files
+++ b/test/integration/test-apt-acquire-additional-files
@@ -57,7 +57,23 @@ testequal 'rootdir/var/lib/apt/lists/localhost:8080_dists_unstable_main_Contents
 testequal "$(readlink -f ./rootdir/var/lib/apt/lists/localhost:8080_dists_unstable_main_Contents-amd64)" aptget files --format '$(FILENAME)' 'Created-By: Contents'
 testsuccess cmp 'rootdir/var/lib/apt/lists/localhost:8080_dists_unstable_main_Contents-amd64' 'aptarchive/dists/unstable/main/Contents-amd64'
 
-# no automatic uncompress based on the name please,
+rm ./rootdir/var/lib/apt/lists/localhost:8080_dists_unstable_main_Contents-amd64
+testempty aptget files --format '$(FILENAME)' 'Created-By: Contents'
+
+# if we asked for keeping it compressed, keep it
+echo 'APT::Acquire::Targets::deb::Contents::KeepCompressed "true";' >> rootdir/etc/apt/apt.conf.d/content-target.conf
+testsuccessequal "Hit:1 http://localhost:8080 unstable InRelease
+Get:2 http://localhost:8080 unstable/main amd64 Contents [$(stat -c%s aptarchive/dists/unstable/main/Contents-amd64.gz) B]
+Reading package lists..." aptget update
+
+testequal 'rootdir/var/lib/apt/lists/localhost:8080_dists_unstable_main_Contents-amd64.gz' find rootdir/var/lib/apt/lists -name '*Contents*'
+testequal "$(readlink -f ./rootdir/var/lib/apt/lists/localhost:8080_dists_unstable_main_Contents-amd64.gz)" aptget files --format '$(FILENAME)' 'Created-By: Contents'
+testsuccess cmp 'rootdir/var/lib/apt/lists/localhost:8080_dists_unstable_main_Contents-amd64.gz' 'aptarchive/dists/unstable/main/Contents-amd64.gz'
+
+rm ./rootdir/var/lib/apt/lists/localhost:8080_dists_unstable_main_Contents-amd64.gz
+testempty aptget files --format '$(FILENAME)' 'Created-By: Contents'
+
+# and no automatic uncompress based on the name please,
 # only if we downloaded a compressed file, but target was uncompressed
 cat > rootdir/etc/apt/apt.conf.d/content-target.conf <<EOF
 APT::Acquire::Targets::deb::Contents {
diff --git a/test/integration/test-compressed-indexes b/test/integration/test-compressed-indexes
index c6b292baa..b5d6b8ae4 100755
--- a/test/integration/test-compressed-indexes
+++ b/test/integration/test-compressed-indexes
@@ -60,7 +60,7 @@ testrun() {
 	msgtest 'Check if package is downloadable'
 	cd downloaded
 	testsuccess --nomsg aptget download testpkg
-	msgtest '\tdeb file is present'; testsuccess --nomsg test -f testpkg_1.0_i386.deb
+	msgtest 'deb file is present'; testsuccess --nomsg test -f testpkg_1.0_i386.deb
 	rm -f testpkg_1.0_i386.deb
 	cd - >/dev/null
 	testsuccessequal 'Reading package lists...
-- 
cgit v1.2.3-70-g09d2


From 4e03c47de15164f2656d9655edab6fb3570cb2f2 Mon Sep 17 00:00:00 2001
From: David Kalnischkies <david@kalnischkies.de>
Date: Tue, 7 Jul 2015 22:11:20 +0200
Subject: implement Signed-By without using gpg for verification

The previous commit returns to the possibility of using just gpgv for
verification proposes. There is one problem through: We can't enforce a
specific keyid without using gpg, but our acquire method can as it
parses gpgv output anyway, so it can deal with good signatures from not
expected signatures and treats them as unknown keys instead.

Git-Dch: Ignore
---
 methods/gpgv.cc                                | 69 ++++++++++++++++++++++----
 test/integration/test-apt-key                  |  1 +
 test/integration/test-releasefile-verification |  4 +-
 3 files changed, 63 insertions(+), 11 deletions(-)

(limited to 'methods')

diff --git a/methods/gpgv.cc b/methods/gpgv.cc
index 014430041..d88a06789 100644
--- a/methods/gpgv.cc
+++ b/methods/gpgv.cc
@@ -15,6 +15,8 @@
 #include <string.h>
 #include <sys/wait.h>
 #include <unistd.h>
+
+#include <algorithm>
 #include <iostream>
 #include <string>
 #include <vector>
@@ -74,6 +76,7 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
       std::clog << "inside VerifyGetSigners" << std::endl;
 
    int fd[2];
+   bool const keyIsID = (key.empty() == false && key[0] != '/');
 
    if (pipe(fd) < 0)
       return "Couldn't create pipe";
@@ -82,12 +85,13 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
    if (pid < 0)
       return string("Couldn't spawn new process") + strerror(errno);
    else if (pid == 0)
-      ExecGPGV(outfile, file, 3, fd, key);
+      ExecGPGV(outfile, file, 3, fd, (keyIsID ? "" : key));
    close(fd[1]);
 
    FILE *pipein = fdopen(fd[0], "r");
 
    // Loop over the output of apt-key (which really is gnupg), and check the signatures.
+   std::vector<std::string> ValidSigners;
    size_t buffersize = 0;
    char *buffer = NULL;
    while (1)
@@ -107,32 +111,31 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
             std::clog << "Got BADSIG! " << std::endl;
          BadSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
       }
-
-      if (strncmp(buffer, GNUPGNOPUBKEY, sizeof(GNUPGNOPUBKEY)-1) == 0)
+      else if (strncmp(buffer, GNUPGNOPUBKEY, sizeof(GNUPGNOPUBKEY)-1) == 0)
       {
          if (Debug == true)
             std::clog << "Got NO_PUBKEY " << std::endl;
          NoPubKeySigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
       }
-      if (strncmp(buffer, GNUPGNODATA, sizeof(GNUPGBADSIG)-1) == 0)
+      else if (strncmp(buffer, GNUPGNODATA, sizeof(GNUPGBADSIG)-1) == 0)
       {
          if (Debug == true)
             std::clog << "Got NODATA! " << std::endl;
          BadSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
       }
-      if (strncmp(buffer, GNUPGKEYEXPIRED, sizeof(GNUPGKEYEXPIRED)-1) == 0)
+      else if (strncmp(buffer, GNUPGKEYEXPIRED, sizeof(GNUPGKEYEXPIRED)-1) == 0)
       {
          if (Debug == true)
             std::clog << "Got KEYEXPIRED! " << std::endl;
          WorthlessSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
       }
-      if (strncmp(buffer, GNUPGREVKEYSIG, sizeof(GNUPGREVKEYSIG)-1) == 0)
+      else if (strncmp(buffer, GNUPGREVKEYSIG, sizeof(GNUPGREVKEYSIG)-1) == 0)
       {
          if (Debug == true)
             std::clog << "Got REVKEYSIG! " << std::endl;
          WorthlessSigners.push_back(string(buffer+sizeof(GNUPGPREFIX)));
       }
-      if (strncmp(buffer, GNUPGGOODSIG, sizeof(GNUPGGOODSIG)-1) == 0)
+      else if (strncmp(buffer, GNUPGGOODSIG, sizeof(GNUPGGOODSIG)-1) == 0)
       {
          char *sig = buffer + sizeof(GNUPGPREFIX);
          char *p = sig + sizeof("GOODSIG");
@@ -143,10 +146,48 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
             std::clog << "Got GOODSIG, key ID:" << sig << std::endl;
          GoodSigners.push_back(string(sig));
       }
+      else if (strncmp(buffer, GNUPGVALIDSIG, sizeof(GNUPGVALIDSIG)-1) == 0)
+      {
+         char *sig = buffer + sizeof(GNUPGVALIDSIG);
+         char *p = sig;
+         while (*p && isxdigit(*p))
+            p++;
+         *p = 0;
+         if (Debug == true)
+            std::clog << "Got VALIDSIG, key ID: " << sig << std::endl;
+         ValidSigners.push_back(string(sig));
+      }
    }
    fclose(pipein);
    free(buffer);
 
+   // apt-key has a --keyid parameter, but this requires gpg, so we call it without it
+   // and instead check after the fact which keyids where used for verification
+   if (keyIsID == true)
+   {
+      if (Debug == true)
+	 std::clog << "GoodSigs needs to be limited to keyid " << key << std::endl;
+      std::vector<std::string>::iterator const foundItr = std::find(ValidSigners.begin(), ValidSigners.end(), key);
+      bool const found = (foundItr != ValidSigners.end());
+      std::copy(GoodSigners.begin(), GoodSigners.end(), std::back_insert_iterator<std::vector<std::string> >(NoPubKeySigners));
+      if (found)
+      {
+	 // we look for GOODSIG here as well as an expired sig is a valid sig as well (but not a good one)
+	 std::string const goodlongkeyid = "GOODSIG " + key.substr(24, 16);
+	 bool const foundGood = std::find(GoodSigners.begin(), GoodSigners.end(), goodlongkeyid) != GoodSigners.end();
+	 if (Debug == true)
+	    std::clog << "Key " << key << " is valid sig, is " << goodlongkeyid << " also a good one? " << (foundGood ? "yes" : "no") << std::endl;
+	 GoodSigners.clear();
+	 if (foundGood)
+	 {
+	    GoodSigners.push_back(goodlongkeyid);
+	    NoPubKeySigners.erase(std::remove(NoPubKeySigners.begin(), NoPubKeySigners.end(), goodlongkeyid), NoPubKeySigners.end());
+	 }
+      }
+      else
+	 GoodSigners.clear();
+   }
+
    int status;
    waitpid(pid, &status, 0);
    if (Debug == true)
@@ -156,8 +197,18 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
    
    if (WEXITSTATUS(status) == 0)
    {
-      if (GoodSigners.empty())
-         return _("Internal error: Good signature, but could not determine key fingerprint?!");
+      if (keyIsID)
+      {
+	 // gpgv will report success, but we want to enforce a certain keyring
+	 // so if we haven't found the key the valid we found is in fact invalid
+	 if (GoodSigners.empty())
+	    return _("At least one invalid signature was encountered.");
+      }
+      else
+      {
+	 if (GoodSigners.empty())
+	    return _("Internal error: Good signature, but could not determine key fingerprint?!");
+      }
       return "";
    }
    else if (WEXITSTATUS(status) == 1)
diff --git a/test/integration/test-apt-key b/test/integration/test-apt-key
index 1226e7dc4..a1a0d883d 100755
--- a/test/integration/test-apt-key
+++ b/test/integration/test-apt-key
@@ -204,6 +204,7 @@ gpg:              unchanged: 1' aptkey --fakeroot update
 		testfailure --nomsg aptkey --quiet --readonly --keyring keys/does-not-exist.pub verify signature.gpg signature
 		testfailure test -e keys/does-not-exist.pub
 
+		# note: this isn't how apts gpgv method implements keyid for verify
 		msgtest 'Test verify a file' 'with good keyid'
 		testsuccess --nomsg aptkey --quiet --readonly --keyid 'Paranoid' verify signature.gpg signature
 
diff --git a/test/integration/test-releasefile-verification b/test/integration/test-releasefile-verification
index 1c3953c8b..759242514 100755
--- a/test/integration/test-releasefile-verification
+++ b/test/integration/test-releasefile-verification
@@ -92,7 +92,7 @@ touch aptarchive/apt.deb
 PKGFILE="${TESTDIR}/$(echo "$(basename $0)" | sed 's#^test-#Packages-#')"
 
 updatewithwarnings() {
-	testwarning aptget update
+	testwarning aptget update -o Debug::pkgAcquire::Worker=1 -o Debug::Acquire::gpgv=1
 	testsuccess grep -E "$1" rootdir/tmp/testwarning.output
 }
 
@@ -225,7 +225,7 @@ runtest() {
 	signreleasefiles 'Joe Sixpack'
 	find aptarchive/ -name "$DELETEFILE" -delete
 	msgmsg 'Cold archive signed by bad keyid' 'Joe Sixpack'
-	updatewithwarnings '^W: .* NO_PUBKEY'
+	updatewithwarnings '^W: .* be verified because the public key is not available: .*'
 
 	sed -i "s#^\(deb\(-src\)\?\) \[signed-by=$MARVIN\] #\1 #" rootdir/etc/apt/sources.list.d/*
 }
-- 
cgit v1.2.3-70-g09d2


From 3b3028467ceccca0b73a8f53051c0fa4de313111 Mon Sep 17 00:00:00 2001
From: David Kalnischkies <david@kalnischkies.de>
Date: Thu, 9 Jul 2015 00:35:40 +0200
Subject: add c++11 override marker to overridden methods

C++11 adds the 'override' specifier to mark that a method is overriding
a base class method and error out if not. We hide it in the APT_OVERRIDE
macro to ensure that we keep compiling in pre-c++11 standards.

Reported-By: clang-modernize -add-override -override-macros
Git-Dch: Ignore
---
 apt-inst/deb/debfile.h                    |   6 +-
 apt-inst/extract.h                        |   6 +-
 apt-pkg/acquire-item.cc                   |   4 +-
 apt-pkg/acquire-item.h                    | 140 +++++++++++++++---------------
 apt-pkg/algorithms.h                      |   8 +-
 apt-pkg/cachefilter.h                     |  46 +++++-----
 apt-pkg/contrib/md5.h                     |   2 +-
 apt-pkg/contrib/progress.h                |   5 +-
 apt-pkg/contrib/sha1.h                    |   2 +-
 apt-pkg/contrib/sha2.h                    |   4 +-
 apt-pkg/deb/debindexfile.cc               |  10 +--
 apt-pkg/deb/debindexfile.h                |  56 ++++++------
 apt-pkg/deb/deblistparser.h               |  34 ++++----
 apt-pkg/deb/debmetaindex.cc               |   6 +-
 apt-pkg/deb/debmetaindex.h                |  34 ++++----
 apt-pkg/deb/debrecords.h                  |  32 +++----
 apt-pkg/deb/debsrcrecords.h               |  24 ++---
 apt-pkg/deb/debsystem.h                   |  16 ++--
 apt-pkg/deb/debversion.h                  |   4 +-
 apt-pkg/deb/dpkgpm.h                      |  12 +--
 apt-pkg/depcache.h                        |   2 +-
 apt-pkg/edsp/edspindexfile.cc             |   2 +-
 apt-pkg/edsp/edspindexfile.h              |   2 +-
 apt-pkg/edsp/edsplistparser.h             |   8 +-
 apt-pkg/edsp/edspsystem.h                 |  18 ++--
 apt-pkg/indexcopy.h                       |  16 ++--
 apt-pkg/indexfile.h                       |   8 +-
 apt-pkg/install-progress.h                |  28 +++---
 apt-pkg/policy.h                          |   6 +-
 apt-pkg/tagfile.h                         |   2 +-
 apt-private/acqprogress.h                 |  18 ++--
 apt-private/private-cacheset.h            |  16 ++--
 apt-private/private-moo.h                 |   2 +
 cmdline/apt-cdrom.cc                      |   8 +-
 cmdline/apt-extracttemplates.h            |   4 +-
 cmdline/apt-get.cc                        |   2 +-
 ftparchive/contents.h                     |   2 +-
 ftparchive/writer.h                       |   8 +-
 methods/cdrom.cc                          |   4 +-
 methods/copy.cc                           |   2 +-
 methods/file.cc                           |   2 +-
 methods/ftp.cc                            |   1 -
 methods/ftp.h                             |   6 +-
 methods/gpgv.cc                           |   4 +-
 methods/gzip.cc                           |   4 +-
 methods/http.h                            |  34 ++++----
 methods/https.h                           |  34 ++++----
 methods/mirror.h                          |  10 +--
 methods/rred.cc                           |   4 +-
 methods/rsh.h                             |   4 +-
 methods/server.h                          |   4 +-
 test/interactive-helper/testdeb.cc        |   2 +-
 test/libapt/acqprogress_test.cc           |   4 +-
 test/libapt/indexcopytosourcelist_test.cc |   8 +-
 54 files changed, 368 insertions(+), 362 deletions(-)

(limited to 'methods')

diff --git a/apt-inst/deb/debfile.h b/apt-inst/deb/debfile.h
index 9d286716a..6ad9b7659 100644
--- a/apt-inst/deb/debfile.h
+++ b/apt-inst/deb/debfile.h
@@ -65,7 +65,7 @@ class debDebFile::ControlExtract : public pkgDirStream
 {
    public:
    
-   virtual bool DoItem(Item &Itm,int &Fd);
+   virtual bool DoItem(Item &Itm,int &Fd) APT_OVERRIDE;
 };
 
 class debDebFile::MemControlExtract : public pkgDirStream
@@ -80,10 +80,10 @@ class debDebFile::MemControlExtract : public pkgDirStream
    std::string Member;
    
    // Members from DirStream
-   virtual bool DoItem(Item &Itm,int &Fd);
+   virtual bool DoItem(Item &Itm,int &Fd) APT_OVERRIDE;
    virtual bool Process(Item &Itm,const unsigned char *Data,
 #if APT_PKG_ABI >= 413
-			unsigned long long Size,unsigned long long Pos);
+			unsigned long long Size,unsigned long long Pos) APT_OVERRIDE;
 #else
 			unsigned long Size,unsigned long Pos);
 #endif
diff --git a/apt-inst/extract.h b/apt-inst/extract.h
index 8ad9ac629..a62ff51bd 100644
--- a/apt-inst/extract.h
+++ b/apt-inst/extract.h
@@ -38,9 +38,9 @@ class pkgExtract : public pkgDirStream
    
    public:
    
-   virtual bool DoItem(Item &Itm,int &Fd);
-   virtual bool Fail(Item &Itm,int Fd);
-   virtual bool FinishedFile(Item &Itm,int Fd);
+   virtual bool DoItem(Item &Itm,int &Fd) APT_OVERRIDE;
+   virtual bool Fail(Item &Itm,int Fd) APT_OVERRIDE;
+   virtual bool FinishedFile(Item &Itm,int Fd) APT_OVERRIDE;
 
    bool Finished();
    bool Aborted();
diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc
index b6466115e..864b93188 100644
--- a/apt-pkg/acquire-item.cc
+++ b/apt-pkg/acquire-item.cc
@@ -391,8 +391,8 @@ class APT_HIDDEN NoActionItem : public pkgAcquire::Item			/*{{{*/
 {
    IndexTarget const Target;
    public:
-   virtual std::string DescURI() const {return Target.URI;};
-   virtual HashStringList GetExpectedHashes()  const {return HashStringList();};
+   virtual std::string DescURI() const APT_OVERRIDE {return Target.URI;};
+   virtual HashStringList GetExpectedHashes()  const APT_OVERRIDE {return HashStringList();};
 
    NoActionItem(pkgAcquire * const Owner, IndexTarget const &Target) :
       pkgAcquire::Item(Owner), Target(Target)
diff --git a/apt-pkg/acquire-item.h b/apt-pkg/acquire-item.h
index 93d812248..2349d386c 100644
--- a/apt-pkg/acquire-item.h
+++ b/apt-pkg/acquire-item.h
@@ -349,7 +349,7 @@ class APT_HIDDEN pkgAcqTransactionItem: public pkgAcquire::Item		/*{{{*/
    IndexTarget const Target;
    HashStringList GetExpectedHashesFor(std::string const &MetaKey) const;
 
-   bool QueueURI(pkgAcquire::ItemDesc &Item);
+   bool QueueURI(pkgAcquire::ItemDesc &Item) APT_OVERRIDE;
 
    public:
    /** \brief storge name until a transaction is finished */
@@ -364,10 +364,10 @@ class APT_HIDDEN pkgAcqTransactionItem: public pkgAcquire::Item		/*{{{*/
    };
    virtual bool TransactionState(TransactionStates const state);
 
-   virtual std::string DescURI() const { return Target.URI; }
-   virtual HashStringList GetExpectedHashes() const;
+   virtual std::string DescURI() const APT_OVERRIDE { return Target.URI; }
+   virtual HashStringList GetExpectedHashes() const APT_OVERRIDE;
    virtual std::string GetMetaKey() const;
-   virtual bool HashesRequired() const;
+   virtual bool HashesRequired() const APT_OVERRIDE;
 
 
    pkgAcqTransactionItem(pkgAcquire * const Owner, pkgAcqMetaClearSig * const TransactionManager, IndexTarget const &Target);
@@ -417,7 +417,7 @@ class APT_HIDDEN pkgAcqMetaBase : public pkgAcqTransactionItem		/*{{{*/
    /** \brief Queue the downloaded Signature for verification */
    void QueueForSignatureVerify(pkgAcqTransactionItem * const I, std::string const &File, std::string const &Signature);
 
-   virtual std::string Custom600Headers() const;
+   virtual std::string Custom600Headers() const APT_OVERRIDE;
 
    /** \brief Called when authentication succeeded.
     *
@@ -440,15 +440,15 @@ class APT_HIDDEN pkgAcqMetaBase : public pkgAcqTransactionItem		/*{{{*/
     */
    bool VerifyVendor(std::string const &Message);
 
-   virtual bool TransactionState(TransactionStates const state);
+   virtual bool TransactionState(TransactionStates const state) APT_OVERRIDE;
 
  public:
    // This refers more to the Transaction-Manager than the actual file
    bool IMSHit;
 
-   virtual bool QueueURI(pkgAcquire::ItemDesc &Item);
-   virtual HashStringList GetExpectedHashes() const;
-   virtual bool HashesRequired() const;
+   virtual bool QueueURI(pkgAcquire::ItemDesc &Item) APT_OVERRIDE;
+   virtual HashStringList GetExpectedHashes() const APT_OVERRIDE;
+   virtual bool HashesRequired() const APT_OVERRIDE;
 
    // transaction code
    void Add(pkgAcqTransactionItem * const I);
@@ -466,7 +466,7 @@ class APT_HIDDEN pkgAcqMetaBase : public pkgAcqTransactionItem		/*{{{*/
    void TransactionStageRemoval(pkgAcqTransactionItem * const I, const std::string &FinalFile);
 
    /** \brief Get the full pathname of the final file for the current URI */
-   virtual std::string GetFinalFilename() const;
+   virtual std::string GetFinalFilename() const APT_OVERRIDE;
 
    pkgAcqMetaBase(pkgAcquire * const Owner, pkgAcqMetaClearSig * const TransactionManager,
 		  std::vector<IndexTarget> const &IndexTargets,
@@ -494,13 +494,13 @@ class APT_HIDDEN pkgAcqMetaIndex : public pkgAcqMetaBase
    void Init(std::string const &URIDesc, std::string const &ShortDesc);
 
    public:
-   virtual std::string DescURI() const;
+   virtual std::string DescURI() const APT_OVERRIDE;
 
    // Specialized action members
-   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf);
+   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
    virtual void Done(std::string const &Message, HashStringList const &Hashes,
-		     pkgAcquire::MethodConfig const * const Cnf);
-   virtual void Finished();
+		     pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
+   virtual void Finished() APT_OVERRIDE;
 
    /** \brief Create a new pkgAcqMetaIndex. */
    pkgAcqMetaIndex(pkgAcquire * const Owner, pkgAcqMetaClearSig * const TransactionManager,
@@ -531,16 +531,16 @@ class APT_HIDDEN pkgAcqMetaSig : public pkgAcqTransactionItem
    protected:
 
    /** \brief Get the full pathname of the final file for the current URI */
-   virtual std::string GetFinalFilename() const;
+   virtual std::string GetFinalFilename() const APT_OVERRIDE;
 
    public:
-   virtual bool HashesRequired() const { return false; }
+   virtual bool HashesRequired() const APT_OVERRIDE { return false; }
 
    // Specialized action members
-   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf);
+   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
    virtual void Done(std::string const &Message, HashStringList const &Hashes,
-		     pkgAcquire::MethodConfig const * const Cnf);
-   virtual std::string Custom600Headers() const;
+		     pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
+   virtual std::string Custom600Headers() const APT_OVERRIDE;
 
    /** \brief Create a new pkgAcqMetaSig. */
    pkgAcqMetaSig(pkgAcquire * const Owner, pkgAcqMetaClearSig * const TransactionManager,
@@ -561,10 +561,10 @@ class APT_HIDDEN pkgAcqMetaClearSig : public pkgAcqMetaIndex
    metaIndex *MetaIndexParser;
    metaIndex *LastMetaIndexParser;
 
-   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf);
-   virtual std::string Custom600Headers() const;
+   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
+   virtual std::string Custom600Headers() const APT_OVERRIDE;
    virtual void Done(std::string const &Message, HashStringList const &Hashes,
-		     pkgAcquire::MethodConfig const * const Cnf);
+		     pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
 
    /** \brief Create a new pkgAcqMetaClearSig. */
    pkgAcqMetaClearSig(pkgAcquire * const Owner,
@@ -583,7 +583,7 @@ class APT_HIDDEN pkgAcqBaseIndex : public pkgAcqTransactionItem
 
  public:
    /** \brief Get the full pathname of the final file for the current URI */
-   virtual std::string GetFinalFilename() const;
+   virtual std::string GetFinalFilename() const APT_OVERRIDE;
 
    pkgAcqBaseIndex(pkgAcquire * const Owner, pkgAcqMetaClearSig * const TransactionManager,
                    IndexTarget const &Target);
@@ -614,19 +614,19 @@ class APT_HIDDEN pkgAcqDiffIndex : public pkgAcqBaseIndex
    std::string Description;
 
    /** \brief Get the full pathname of the final file for the current URI */
-   virtual std::string GetFinalFilename() const;
+   virtual std::string GetFinalFilename() const APT_OVERRIDE;
 
-   virtual bool QueueURI(pkgAcquire::ItemDesc &Item);
+   virtual bool QueueURI(pkgAcquire::ItemDesc &Item) APT_OVERRIDE;
 
-   virtual bool TransactionState(TransactionStates const state);
+   virtual bool TransactionState(TransactionStates const state) APT_OVERRIDE;
  public:
    // Specialized action members
-   virtual void Failed(std::string const &Message, pkgAcquire::MethodConfig const * const Cnf);
+   virtual void Failed(std::string const &Message, pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
    virtual void Done(std::string const &Message, HashStringList const &Hashes,
-		     pkgAcquire::MethodConfig const * const Cnf);
-   virtual std::string DescURI() const {return Target.URI + "Index";};
-   virtual std::string Custom600Headers() const;
-   virtual std::string GetMetaKey() const;
+		     pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
+   virtual std::string DescURI() const APT_OVERRIDE {return Target.URI + "Index";};
+   virtual std::string Custom600Headers() const APT_OVERRIDE;
+   virtual std::string GetMetaKey() const APT_OVERRIDE;
 
    /** \brief Parse the Index file for a set of Packages diffs.
     *
@@ -724,13 +724,13 @@ class APT_HIDDEN pkgAcqIndexMergeDiffs : public pkgAcqBaseIndex
     *  This method will fall back to downloading the whole index file
     *  outright; its arguments are ignored.
     */
-   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf);
+   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
    virtual void Done(std::string const &Message, HashStringList const &Hashes,
-	 pkgAcquire::MethodConfig const * const Cnf);
-   virtual std::string Custom600Headers() const;
-   virtual std::string DescURI() const {return Target.URI + "Index";};
-   virtual HashStringList GetExpectedHashes() const;
-   virtual bool HashesRequired() const;
+	 pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
+   virtual std::string Custom600Headers() const APT_OVERRIDE;
+   virtual std::string DescURI() const APT_OVERRIDE {return Target.URI + "Index";};
+   virtual HashStringList GetExpectedHashes() const APT_OVERRIDE;
+   virtual bool HashesRequired() const APT_OVERRIDE;
 
    /** \brief Create an index merge-diff item.
     *
@@ -836,14 +836,14 @@ class APT_HIDDEN pkgAcqIndexDiffs : public pkgAcqBaseIndex
     *  This method will fall back to downloading the whole index file
     *  outright; its arguments are ignored.
     */
-   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf);
+   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
 
    virtual void Done(std::string const &Message, HashStringList const &Hashes,
-		     pkgAcquire::MethodConfig const * const Cnf);
-   virtual std::string Custom600Headers() const;
-   virtual std::string DescURI() const {return Target.URI + "IndexDiffs";};
-   virtual HashStringList GetExpectedHashes() const;
-   virtual bool HashesRequired() const;
+		     pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
+   virtual std::string Custom600Headers() const APT_OVERRIDE;
+   virtual std::string DescURI() const APT_OVERRIDE {return Target.URI + "IndexDiffs";};
+   virtual HashStringList GetExpectedHashes() const APT_OVERRIDE;
+   virtual bool HashesRequired() const APT_OVERRIDE;
 
    /** \brief Create an index diff item.
     *
@@ -928,18 +928,18 @@ class APT_HIDDEN pkgAcqIndex : public pkgAcqBaseIndex
    void ReverifyAfterIMS();
 
    /** \brief Get the full pathname of the final file for the current URI */
-   virtual std::string GetFinalFilename() const;
+   virtual std::string GetFinalFilename() const APT_OVERRIDE;
 
-   virtual bool TransactionState(TransactionStates const state);
+   virtual bool TransactionState(TransactionStates const state) APT_OVERRIDE;
 
    public:
    // Specialized action members
-   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf);
+   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
    virtual void Done(std::string const &Message, HashStringList const &Hashes,
-		     pkgAcquire::MethodConfig const * const Cnf);
-   virtual std::string Custom600Headers() const;
-   virtual std::string DescURI() const {return Desc.URI;};
-   virtual std::string GetMetaKey() const;
+		     pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
+   virtual std::string Custom600Headers() const APT_OVERRIDE;
+   virtual std::string DescURI() const APT_OVERRIDE {return Desc.URI;};
+   virtual std::string GetMetaKey() const APT_OVERRIDE;
 
    pkgAcqIndex(pkgAcquire * const Owner, pkgAcqMetaClearSig * const TransactionManager,
                IndexTarget const &Target);
@@ -1000,19 +1000,19 @@ class pkgAcqArchive : public pkgAcquire::Item
    bool QueueNext();
 
    /** \brief Get the full pathname of the final file for the current URI */
-   virtual std::string GetFinalFilename() const;
+   virtual std::string GetFinalFilename() const APT_OVERRIDE;
 
    public:
 
-   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf);
+   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
    virtual void Done(std::string const &Message, HashStringList const &Hashes,
-		     pkgAcquire::MethodConfig const * const Cnf);
-   virtual std::string DescURI() const;
-   virtual std::string ShortDesc() const;
-   virtual void Finished();
-   virtual bool IsTrusted() const;
-   virtual HashStringList GetExpectedHashes() const;
-   virtual bool HashesRequired() const;
+		     pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
+   virtual std::string DescURI() const APT_OVERRIDE;
+   virtual std::string ShortDesc() const APT_OVERRIDE;
+   virtual void Finished() APT_OVERRIDE;
+   virtual bool IsTrusted() const APT_OVERRIDE;
+   virtual HashStringList GetExpectedHashes() const APT_OVERRIDE;
+   virtual bool HashesRequired() const APT_OVERRIDE;
 
    /** \brief Create a new pkgAcqArchive.
     *
@@ -1053,14 +1053,14 @@ class pkgAcqChangelog : public pkgAcquire::Item
    public:
    // we will never have hashes for changelogs.
    // If you need verified ones, download the deb and extract the changelog.
-   virtual HashStringList GetExpectedHashes() const { return HashStringList(); }
-   virtual bool HashesRequired() const { return false; }
+   virtual HashStringList GetExpectedHashes() const APT_OVERRIDE { return HashStringList(); }
+   virtual bool HashesRequired() const APT_OVERRIDE { return false; }
 
    // Specialized action members
-   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf);
+   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
    virtual void Done(std::string const &Message, HashStringList const &CalcHashes,
-		     pkgAcquire::MethodConfig const * const Cnf);
-   virtual std::string DescURI() const {return Desc.URI;};
+		     pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
+   virtual std::string DescURI() const APT_OVERRIDE {return Desc.URI;};
 
    /** returns the URI to the changelog of this version
     *
@@ -1172,15 +1172,15 @@ class pkgAcqFile : public pkgAcquire::Item
 
    HashStringList const ExpectedHashes;
    public:
-   virtual HashStringList GetExpectedHashes() const;
-   virtual bool HashesRequired() const;
+   virtual HashStringList GetExpectedHashes() const APT_OVERRIDE;
+   virtual bool HashesRequired() const APT_OVERRIDE;
 
    // Specialized action members
-   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf);
+   virtual void Failed(std::string const &Message,pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
    virtual void Done(std::string const &Message, HashStringList const &CalcHashes,
-		     pkgAcquire::MethodConfig const * const Cnf);
-   virtual std::string DescURI() const {return Desc.URI;};
-   virtual std::string Custom600Headers() const;
+		     pkgAcquire::MethodConfig const * const Cnf) APT_OVERRIDE;
+   virtual std::string DescURI() const APT_OVERRIDE {return Desc.URI;};
+   virtual std::string Custom600Headers() const APT_OVERRIDE;
 
    /** \brief Create a new pkgAcqFile object.
     *
diff --git a/apt-pkg/algorithms.h b/apt-pkg/algorithms.h
index d9cce672a..28057fa5c 100644
--- a/apt-pkg/algorithms.h
+++ b/apt-pkg/algorithms.h
@@ -62,7 +62,7 @@ class pkgSimulate : public pkgPackageManager				/*{{{*/
       pkgDepCache *Cache;
       public:
       
-      virtual VerIterator GetCandidateVer(PkgIterator const &Pkg)
+      virtual VerIterator GetCandidateVer(PkgIterator const &Pkg) APT_OVERRIDE
       {
 	 return (*Cache)[Pkg].CandidateVerIter(*Cache);
       }
@@ -77,9 +77,9 @@ class pkgSimulate : public pkgPackageManager				/*{{{*/
    pkgDepCache::ActionGroup group;
    
    // The Actuall installation implementation
-   virtual bool Install(PkgIterator Pkg,std::string File);
-   virtual bool Configure(PkgIterator Pkg);
-   virtual bool Remove(PkgIterator Pkg,bool Purge);
+   virtual bool Install(PkgIterator Pkg,std::string File) APT_OVERRIDE;
+   virtual bool Configure(PkgIterator Pkg) APT_OVERRIDE;
+   virtual bool Remove(PkgIterator Pkg,bool Purge) APT_OVERRIDE;
 
 private:
    APT_HIDDEN void ShortBreaks();
diff --git a/apt-pkg/cachefilter.h b/apt-pkg/cachefilter.h
index df9e9460a..2719154c1 100644
--- a/apt-pkg/cachefilter.h
+++ b/apt-pkg/cachefilter.h
@@ -30,33 +30,33 @@ public:
 class PackageMatcher : public Matcher {
 public:
    virtual bool operator() (pkgCache::PkgIterator const &Pkg) = 0;
-   virtual bool operator() (pkgCache::VerIterator const &Ver) { return (*this)(Ver.ParentPkg()); }
-   virtual bool operator() (pkgCache::GrpIterator const &/*Grp*/) { return false; }
+   virtual bool operator() (pkgCache::VerIterator const &Ver) APT_OVERRIDE { return (*this)(Ver.ParentPkg()); }
+   virtual bool operator() (pkgCache::GrpIterator const &/*Grp*/) APT_OVERRIDE { return false; }
    virtual ~PackageMatcher();
 };
 
 // Generica like True, False, NOT, AND, OR				/*{{{*/
 class TrueMatcher : public Matcher {
 public:
-   virtual bool operator() (pkgCache::PkgIterator const &Pkg);
-   virtual bool operator() (pkgCache::GrpIterator const &Grp);
-   virtual bool operator() (pkgCache::VerIterator const &Ver);
+   virtual bool operator() (pkgCache::PkgIterator const &Pkg) APT_OVERRIDE;
+   virtual bool operator() (pkgCache::GrpIterator const &Grp) APT_OVERRIDE;
+   virtual bool operator() (pkgCache::VerIterator const &Ver) APT_OVERRIDE;
 };
 
 class FalseMatcher : public Matcher {
 public:
-   virtual bool operator() (pkgCache::PkgIterator const &Pkg);
-   virtual bool operator() (pkgCache::GrpIterator const &Grp);
-   virtual bool operator() (pkgCache::VerIterator const &Ver);
+   virtual bool operator() (pkgCache::PkgIterator const &Pkg) APT_OVERRIDE;
+   virtual bool operator() (pkgCache::GrpIterator const &Grp) APT_OVERRIDE;
+   virtual bool operator() (pkgCache::VerIterator const &Ver) APT_OVERRIDE;
 };
 
 class NOTMatcher : public Matcher {
    Matcher * const matcher;
 public:
    explicit NOTMatcher(Matcher * const matcher);
-   virtual bool operator() (pkgCache::PkgIterator const &Pkg);
-   virtual bool operator() (pkgCache::GrpIterator const &Grp);
-   virtual bool operator() (pkgCache::VerIterator const &Ver);
+   virtual bool operator() (pkgCache::PkgIterator const &Pkg) APT_OVERRIDE;
+   virtual bool operator() (pkgCache::GrpIterator const &Grp) APT_OVERRIDE;
+   virtual bool operator() (pkgCache::VerIterator const &Ver) APT_OVERRIDE;
    virtual ~NOTMatcher();
 };
 
@@ -71,9 +71,9 @@ public:
    ANDMatcher(Matcher * const matcher1, Matcher * const matcher2, Matcher * const matcher3, Matcher * const matcher4);
    ANDMatcher(Matcher * const matcher1, Matcher * const matcher2, Matcher * const matcher3, Matcher * const matcher4, Matcher * const matcher5);
    ANDMatcher& AND(Matcher * const matcher);
-   virtual bool operator() (pkgCache::PkgIterator const &Pkg);
-   virtual bool operator() (pkgCache::GrpIterator const &Grp);
-   virtual bool operator() (pkgCache::VerIterator const &Ver);
+   virtual bool operator() (pkgCache::PkgIterator const &Pkg) APT_OVERRIDE;
+   virtual bool operator() (pkgCache::GrpIterator const &Grp) APT_OVERRIDE;
+   virtual bool operator() (pkgCache::VerIterator const &Ver) APT_OVERRIDE;
    virtual ~ANDMatcher();
 };
 class ORMatcher : public Matcher {
@@ -87,9 +87,9 @@ public:
    ORMatcher(Matcher * const matcher1, Matcher * const matcher2, Matcher * const matcher3, Matcher * const matcher4);
    ORMatcher(Matcher * const matcher1, Matcher * const matcher2, Matcher * const matcher3, Matcher * const matcher4, Matcher * const matcher5);
    ORMatcher& OR(Matcher * const matcher);
-   virtual bool operator() (pkgCache::PkgIterator const &Pkg);
-   virtual bool operator() (pkgCache::GrpIterator const &Grp);
-   virtual bool operator() (pkgCache::VerIterator const &Ver);
+   virtual bool operator() (pkgCache::PkgIterator const &Pkg) APT_OVERRIDE;
+   virtual bool operator() (pkgCache::GrpIterator const &Grp) APT_OVERRIDE;
+   virtual bool operator() (pkgCache::VerIterator const &Ver) APT_OVERRIDE;
    virtual ~ORMatcher();
 };
 									/*}}}*/
@@ -97,8 +97,8 @@ class PackageNameMatchesRegEx : public PackageMatcher {			/*{{{*/
 	regex_t* pattern;
 public:
 	explicit PackageNameMatchesRegEx(std::string const &Pattern);
-	virtual bool operator() (pkgCache::PkgIterator const &Pkg);
-	virtual bool operator() (pkgCache::GrpIterator const &Grp);
+	virtual bool operator() (pkgCache::PkgIterator const &Pkg) APT_OVERRIDE;
+	virtual bool operator() (pkgCache::GrpIterator const &Grp) APT_OVERRIDE;
 	virtual ~PackageNameMatchesRegEx();
 };
 									/*}}}*/
@@ -106,8 +106,8 @@ class PackageNameMatchesFnmatch : public PackageMatcher {		/*{{{*/
 	const std::string Pattern;
 public:
 	explicit PackageNameMatchesFnmatch(std::string const &Pattern);
-	virtual bool operator() (pkgCache::PkgIterator const &Pkg);
-	virtual bool operator() (pkgCache::GrpIterator const &Grp);
+	virtual bool operator() (pkgCache::PkgIterator const &Pkg) APT_OVERRIDE;
+	virtual bool operator() (pkgCache::GrpIterator const &Grp) APT_OVERRIDE;
 	virtual ~PackageNameMatchesFnmatch() {};
 };
 									/*}}}*/
@@ -133,7 +133,7 @@ public:
 	 */
 	PackageArchitectureMatchesSpecification(std::string const &pattern, bool const isPattern = true);
 	bool operator() (char const * const &arch);
-	virtual bool operator() (pkgCache::PkgIterator const &Pkg);
+	virtual bool operator() (pkgCache::PkgIterator const &Pkg) APT_OVERRIDE;
 	virtual ~PackageArchitectureMatchesSpecification();
 };
 									/*}}}*/
@@ -141,7 +141,7 @@ class PackageIsNewInstall : public PackageMatcher {			/*{{{*/
 	pkgCacheFile * const Cache;
 public:
 	explicit PackageIsNewInstall(pkgCacheFile * const Cache);
-	virtual bool operator() (pkgCache::PkgIterator const &Pkg);
+	virtual bool operator() (pkgCache::PkgIterator const &Pkg) APT_OVERRIDE;
 	virtual ~PackageIsNewInstall();
 };
 									/*}}}*/
diff --git a/apt-pkg/contrib/md5.h b/apt-pkg/contrib/md5.h
index f4992c223..a16ea4d2d 100644
--- a/apt-pkg/contrib/md5.h
+++ b/apt-pkg/contrib/md5.h
@@ -48,7 +48,7 @@ class MD5Summation : public SummationImplementation
 
    public:
 
-   bool Add(const unsigned char *inbuf, unsigned long long inlen);
+   bool Add(const unsigned char *inbuf, unsigned long long inlen) APT_OVERRIDE;
    using SummationImplementation::Add;
 
    MD5SumValue Result();
diff --git a/apt-pkg/contrib/progress.h b/apt-pkg/contrib/progress.h
index f7fbc9ccf..427b1bd35 100644
--- a/apt-pkg/contrib/progress.h
+++ b/apt-pkg/contrib/progress.h
@@ -24,6 +24,7 @@
 
 #include <string>
 #include <sys/time.h>
+#include <apt-pkg/macros.h>
 
 #ifndef APT_8_CLEANER_HEADERS
 using std::string;
@@ -74,12 +75,12 @@ class OpTextProgress : public OpProgress
    bool NoUpdate;
    bool NoDisplay;
    unsigned long LastLen;
-   virtual void Update();
+   virtual void Update() APT_OVERRIDE;
    void Write(const char *S);
    
    public:
 
-   virtual void Done();
+   virtual void Done() APT_OVERRIDE;
    
    OpTextProgress(bool NoUpdate = false) : NoUpdate(NoUpdate), 
                 NoDisplay(false), LastLen(0) {};
diff --git a/apt-pkg/contrib/sha1.h b/apt-pkg/contrib/sha1.h
index 5770c315a..1c5cb5aa1 100644
--- a/apt-pkg/contrib/sha1.h
+++ b/apt-pkg/contrib/sha1.h
@@ -37,7 +37,7 @@ class SHA1Summation : public SummationImplementation
    bool Done;
    
    public:
-   bool Add(const unsigned char *inbuf, unsigned long long inlen);
+   bool Add(const unsigned char *inbuf, unsigned long long inlen) APT_OVERRIDE;
    using SummationImplementation::Add;
 
    SHA1SumValue Result();
diff --git a/apt-pkg/contrib/sha2.h b/apt-pkg/contrib/sha2.h
index a25ad4d32..70e8384f2 100644
--- a/apt-pkg/contrib/sha2.h
+++ b/apt-pkg/contrib/sha2.h
@@ -45,7 +45,7 @@ class SHA256Summation : public SHA2SummationBase
    unsigned char Sum[32];
 
    public:
-   bool Add(const unsigned char *inbuf, unsigned long long len)
+   bool Add(const unsigned char *inbuf, unsigned long long len) APT_OVERRIDE
    {
       if (Done) 
          return false;
@@ -78,7 +78,7 @@ class SHA512Summation : public SHA2SummationBase
    unsigned char Sum[64];
 
    public:
-   bool Add(const unsigned char *inbuf, unsigned long long len)
+   bool Add(const unsigned char *inbuf, unsigned long long len) APT_OVERRIDE
    {
       if (Done) 
          return false;
diff --git a/apt-pkg/deb/debindexfile.cc b/apt-pkg/deb/debindexfile.cc
index c5086b04b..972feba7f 100644
--- a/apt-pkg/deb/debindexfile.cc
+++ b/apt-pkg/deb/debindexfile.cc
@@ -482,7 +482,7 @@ class APT_HIDDEN debIFTypePkg : public pkgIndexFile::Type
 {
    public:
    
-   virtual pkgRecords::Parser *CreatePkgParser(pkgCache::PkgFileIterator File) const 
+   virtual pkgRecords::Parser *CreatePkgParser(pkgCache::PkgFileIterator File) const APT_OVERRIDE 
    {
       return new debRecordParser(File.FileName(),*File.Cache());
    };
@@ -497,7 +497,7 @@ class APT_HIDDEN debIFTypeStatus : public pkgIndexFile::Type
 {
    public:
    
-   virtual pkgRecords::Parser *CreatePkgParser(pkgCache::PkgFileIterator File) const 
+   virtual pkgRecords::Parser *CreatePkgParser(pkgCache::PkgFileIterator File) const APT_OVERRIDE 
    {
       return new debRecordParser(File.FileName(),*File.Cache());
    };
@@ -506,7 +506,7 @@ class APT_HIDDEN debIFTypeStatus : public pkgIndexFile::Type
 class APT_HIDDEN debIFTypeDebPkgFile : public pkgIndexFile::Type
 {
    public:
-   virtual pkgRecords::Parser *CreatePkgParser(pkgCache::PkgFileIterator File) const 
+   virtual pkgRecords::Parser *CreatePkgParser(pkgCache::PkgFileIterator File) const APT_OVERRIDE 
    {
       return new debDebFileRecordParser(File.FileName());
    };
@@ -515,7 +515,7 @@ class APT_HIDDEN debIFTypeDebPkgFile : public pkgIndexFile::Type
 class APT_HIDDEN debIFTypeDscFile : public pkgIndexFile::Type
 {
    public:
-   virtual pkgSrcRecords::Parser *CreateSrcPkgParser(std::string DscFile) const
+   virtual pkgSrcRecords::Parser *CreateSrcPkgParser(std::string DscFile) const APT_OVERRIDE
    {
       return new debDscRecordParser(DscFile, NULL);
    };
@@ -524,7 +524,7 @@ class APT_HIDDEN debIFTypeDscFile : public pkgIndexFile::Type
 class APT_HIDDEN debIFTypeDebianSourceDir : public pkgIndexFile::Type
 {
    public:
-   virtual pkgSrcRecords::Parser *CreateSrcPkgParser(std::string SourceDir) const
+   virtual pkgSrcRecords::Parser *CreateSrcPkgParser(std::string SourceDir) const APT_OVERRIDE
    {
       return new debDscRecordParser(SourceDir + string("/debian/control"), NULL);
    };
diff --git a/apt-pkg/deb/debindexfile.h b/apt-pkg/deb/debindexfile.h
index 1de609a7b..71ca22e4d 100644
--- a/apt-pkg/deb/debindexfile.h
+++ b/apt-pkg/deb/debindexfile.h
@@ -38,14 +38,14 @@ class APT_HIDDEN debStatusIndex : public pkgIndexFile
    virtual const Type *GetType() const APT_CONST;
 
    // Interface for acquire
-   virtual std::string Describe(bool /*Short*/) const {return File;};
+   virtual std::string Describe(bool /*Short*/) const APT_OVERRIDE {return File;};
 
    // Interface for the Cache Generator
-   virtual bool Exists() const;
-   virtual bool HasPackages() const {return true;};
-   virtual unsigned long Size() const;
-   virtual bool Merge(pkgCacheGenerator &Gen,OpProgress *Prog) const;
-   virtual pkgCache::PkgFileIterator FindInCache(pkgCache &Cache) const;
+   virtual bool Exists() const APT_OVERRIDE;
+   virtual bool HasPackages() const APT_OVERRIDE {return true;};
+   virtual unsigned long Size() const APT_OVERRIDE;
+   virtual bool Merge(pkgCacheGenerator &Gen,OpProgress *Prog) const APT_OVERRIDE;
+   virtual pkgCache::PkgFileIterator FindInCache(pkgCache &Cache) const APT_OVERRIDE;
 
    debStatusIndex(std::string File);
    virtual ~debStatusIndex();
@@ -59,12 +59,12 @@ class APT_HIDDEN debPackagesIndex : public pkgIndexTargetFile
    virtual const Type *GetType() const APT_CONST;
 
    // Stuff for accessing files on remote items
-   virtual std::string ArchiveInfo(pkgCache::VerIterator Ver) const;
+   virtual std::string ArchiveInfo(pkgCache::VerIterator Ver) const APT_OVERRIDE;
 
    // Interface for the Cache Generator
-   virtual bool HasPackages() const {return true;};
-   virtual bool Merge(pkgCacheGenerator &Gen,OpProgress *Prog) const;
-   virtual pkgCache::PkgFileIterator FindInCache(pkgCache &Cache) const;
+   virtual bool HasPackages() const APT_OVERRIDE {return true;};
+   virtual bool Merge(pkgCacheGenerator &Gen,OpProgress *Prog) const APT_OVERRIDE;
+   virtual pkgCache::PkgFileIterator FindInCache(pkgCache &Cache) const APT_OVERRIDE;
 
    debPackagesIndex(IndexTarget const &Target, bool const Trusted);
    virtual ~debPackagesIndex();
@@ -78,9 +78,9 @@ class APT_HIDDEN debTranslationsIndex : public pkgIndexTargetFile
    virtual const Type *GetType() const APT_CONST;
 
    // Interface for the Cache Generator
-   virtual bool HasPackages() const;
-   virtual bool Merge(pkgCacheGenerator &Gen,OpProgress *Prog) const;
-   virtual pkgCache::PkgFileIterator FindInCache(pkgCache &Cache) const;
+   virtual bool HasPackages() const APT_OVERRIDE;
+   virtual bool Merge(pkgCacheGenerator &Gen,OpProgress *Prog) const APT_OVERRIDE;
+   virtual pkgCache::PkgFileIterator FindInCache(pkgCache &Cache) const APT_OVERRIDE;
 
    debTranslationsIndex(IndexTarget const &Target);
    virtual ~debTranslationsIndex();
@@ -95,13 +95,13 @@ class APT_HIDDEN debSourcesIndex : public pkgIndexTargetFile
 
    // Stuff for accessing files on remote items
    virtual std::string SourceInfo(pkgSrcRecords::Parser const &Record,
-			     pkgSrcRecords::File const &File) const;
+			     pkgSrcRecords::File const &File) const APT_OVERRIDE;
 
    // Interface for the record parsers
-   virtual pkgSrcRecords::Parser *CreateSrcParser() const;
+   virtual pkgSrcRecords::Parser *CreateSrcParser() const APT_OVERRIDE;
 
    // Interface for the Cache Generator
-   virtual bool HasPackages() const {return false;};
+   virtual bool HasPackages() const APT_OVERRIDE {return false;};
 
    debSourcesIndex(IndexTarget const &Target, bool const Trusted);
    virtual ~debSourcesIndex();
@@ -117,7 +117,7 @@ class APT_HIDDEN debDebPkgFileIndex : public pkgIndexFile
  public:
    virtual const Type *GetType() const APT_CONST;
 
-   virtual std::string Describe(bool /*Short*/) const {
+   virtual std::string Describe(bool /*Short*/) const APT_OVERRIDE {
       return DebFile;
    }
 
@@ -130,16 +130,16 @@ class APT_HIDDEN debDebPkgFileIndex : public pkgIndexFile
    static bool GetContent(std::ostream &content, std::string const &debfile);
 
    // Interface for the Cache Generator
-   virtual bool Exists() const;
-   virtual bool HasPackages() const {
+   virtual bool Exists() const APT_OVERRIDE;
+   virtual bool HasPackages() const APT_OVERRIDE {
       return true;
    };
-   virtual unsigned long Size() const;
-   virtual bool Merge(pkgCacheGenerator &Gen,OpProgress *Prog) const;
-   virtual pkgCache::PkgFileIterator FindInCache(pkgCache &Cache) const;
+   virtual unsigned long Size() const APT_OVERRIDE;
+   virtual bool Merge(pkgCacheGenerator &Gen,OpProgress *Prog) const APT_OVERRIDE;
+   virtual pkgCache::PkgFileIterator FindInCache(pkgCache &Cache) const APT_OVERRIDE;
 
    // Interface for acquire
-   virtual std::string ArchiveURI(std::string /*File*/) const;
+   virtual std::string ArchiveURI(std::string /*File*/) const APT_OVERRIDE;
 
    debDebPkgFileIndex(std::string DebFile);
    virtual ~debDebPkgFileIndex();
@@ -152,11 +152,11 @@ class APT_HIDDEN debDscFileIndex : public pkgIndexFile
    std::string DscFile;
  public:
    virtual const Type *GetType() const APT_CONST;
-   virtual pkgSrcRecords::Parser *CreateSrcParser() const;
-   virtual bool Exists() const;
-   virtual bool HasPackages() const {return false;};
-   virtual unsigned long Size() const;
-   virtual std::string Describe(bool /*Short*/) const {
+   virtual pkgSrcRecords::Parser *CreateSrcParser() const APT_OVERRIDE;
+   virtual bool Exists() const APT_OVERRIDE;
+   virtual bool HasPackages() const APT_OVERRIDE {return false;};
+   virtual unsigned long Size() const APT_OVERRIDE;
+   virtual std::string Describe(bool /*Short*/) const APT_OVERRIDE {
       return DscFile;
    };
 
diff --git a/apt-pkg/deb/deblistparser.h b/apt-pkg/deb/deblistparser.h
index 3fd040bdd..4bc3c2341 100644
--- a/apt-pkg/deb/deblistparser.h
+++ b/apt-pkg/deb/deblistparser.h
@@ -62,24 +62,24 @@ class APT_HIDDEN debListParser : public pkgCacheGenerator::ListParser
    APT_PUBLIC static unsigned char GetPrio(std::string Str);
       
    // These all operate against the current section
-   virtual std::string Package();
-   virtual std::string Architecture();
-   virtual bool ArchitectureAll();
-   virtual std::string Version();
-   virtual bool NewVersion(pkgCache::VerIterator &Ver);
-   virtual std::string Description(std::string const &lang);
-   virtual std::vector<std::string> AvailableDescriptionLanguages();
-   virtual MD5SumValue Description_md5();
-   virtual unsigned short VersionHash();
+   virtual std::string Package() APT_OVERRIDE;
+   virtual std::string Architecture() APT_OVERRIDE;
+   virtual bool ArchitectureAll() APT_OVERRIDE;
+   virtual std::string Version() APT_OVERRIDE;
+   virtual bool NewVersion(pkgCache::VerIterator &Ver) APT_OVERRIDE;
+   virtual std::string Description(std::string const &lang) APT_OVERRIDE;
+   virtual std::vector<std::string> AvailableDescriptionLanguages() APT_OVERRIDE;
+   virtual MD5SumValue Description_md5() APT_OVERRIDE;
+   virtual unsigned short VersionHash() APT_OVERRIDE;
 #if APT_PKG_ABI >= 413
-   virtual bool SameVersion(unsigned short const Hash, pkgCache::VerIterator const &Ver);
+   virtual bool SameVersion(unsigned short const Hash, pkgCache::VerIterator const &Ver) APT_OVERRIDE;
 #endif
    virtual bool UsePackage(pkgCache::PkgIterator &Pkg,
-			   pkgCache::VerIterator &Ver);
-   virtual map_filesize_t Offset() {return iOffset;};
-   virtual map_filesize_t Size() {return Section.size();};
+			   pkgCache::VerIterator &Ver) APT_OVERRIDE;
+   virtual map_filesize_t Offset() APT_OVERRIDE {return iOffset;};
+   virtual map_filesize_t Size() APT_OVERRIDE {return Section.size();};
 
-   virtual bool Step();
+   virtual bool Step() APT_OVERRIDE;
 
    bool LoadReleaseInfo(pkgCache::RlsFileIterator &FileI,FileFd &File,
 			std::string const &section);
@@ -111,15 +111,15 @@ class APT_HIDDEN debDebFileParser : public debListParser
  public:
    debDebFileParser(FileFd *File, std::string const &DebFile);
    virtual bool UsePackage(pkgCache::PkgIterator &Pkg,
-			   pkgCache::VerIterator &Ver);
+			   pkgCache::VerIterator &Ver) APT_OVERRIDE;
 };
 
 class APT_HIDDEN debTranslationsParser : public debListParser
 {
  public:
    // a translation can never be a real package
-   virtual std::string Architecture() { return ""; }
-   virtual std::string Version() { return ""; }
+   virtual std::string Architecture() APT_OVERRIDE { return ""; }
+   virtual std::string Version() APT_OVERRIDE { return ""; }
 
    debTranslationsParser(FileFd *File, std::string const &Arch = "")
       : debListParser(File, Arch) {};
diff --git a/apt-pkg/deb/debmetaindex.cc b/apt-pkg/deb/debmetaindex.cc
index 10ab0f844..46a7181fc 100644
--- a/apt-pkg/deb/debmetaindex.cc
+++ b/apt-pkg/deb/debmetaindex.cc
@@ -758,7 +758,7 @@ class APT_HIDDEN debSLTypeDeb : public debSLTypeDebian			/*{{{*/
 
    bool CreateItem(std::vector<metaIndex *> &List, std::string const &URI,
 		   std::string const &Dist, std::string const &Section,
-		   std::map<std::string, std::string> const &Options) const
+		   std::map<std::string, std::string> const &Options) const APT_OVERRIDE
    {
       return CreateItemInternal(List, URI, Dist, Section, false, Options);
    }
@@ -774,7 +774,7 @@ class APT_HIDDEN debSLTypeDebSrc : public debSLTypeDebian		/*{{{*/
 
    bool CreateItem(std::vector<metaIndex *> &List, std::string const &URI,
 		   std::string const &Dist, std::string const &Section,
-		   std::map<std::string, std::string> const &Options) const
+		   std::map<std::string, std::string> const &Options) const APT_OVERRIDE
    {
       return CreateItemInternal(List, URI, Dist, Section, true, Options);
    }
@@ -800,7 +800,7 @@ class APT_HIDDEN debSLTypeDebFile : public pkgSourceList::Type		/*{{{*/
 
    bool CreateItem(std::vector<metaIndex *> &List, std::string const &URI,
 		   std::string const &/*Dist*/, std::string const &/*Section*/,
-		   std::map<std::string, std::string> const &/*Options*/) const
+		   std::map<std::string, std::string> const &/*Options*/) const APT_OVERRIDE
    {
       metaIndex *mi = new debDebFileMetaIndex(URI);
       List.push_back(mi);
diff --git a/apt-pkg/deb/debmetaindex.h b/apt-pkg/deb/debmetaindex.h
index bf5b7c1ce..8c13237cb 100644
--- a/apt-pkg/deb/debmetaindex.h
+++ b/apt-pkg/deb/debmetaindex.h
@@ -39,18 +39,18 @@ class APT_HIDDEN debReleaseIndex : public metaIndex
    debReleaseIndex(std::string const &URI, std::string const &Dist, bool const Trusted);
    virtual ~debReleaseIndex();
 
-   virtual std::string ArchiveURI(std::string const &File) const {return URI + File;};
-   virtual bool GetIndexes(pkgAcquire *Owner, bool const &GetAll=false);
-   virtual std::vector<IndexTarget> GetIndexTargets() const;
+   virtual std::string ArchiveURI(std::string const &File) const APT_OVERRIDE {return URI + File;};
+   virtual bool GetIndexes(pkgAcquire *Owner, bool const &GetAll=false) APT_OVERRIDE;
+   virtual std::vector<IndexTarget> GetIndexTargets() const APT_OVERRIDE;
 
-   virtual std::string Describe() const;
-   virtual pkgCache::RlsFileIterator FindInCache(pkgCache &Cache, bool const ModifyCheck) const;
-   virtual bool Merge(pkgCacheGenerator &Gen,OpProgress *Prog) const;
+   virtual std::string Describe() const APT_OVERRIDE;
+   virtual pkgCache::RlsFileIterator FindInCache(pkgCache &Cache, bool const ModifyCheck) const APT_OVERRIDE;
+   virtual bool Merge(pkgCacheGenerator &Gen,OpProgress *Prog) const APT_OVERRIDE;
 
-   virtual bool Load(std::string const &Filename, std::string * const ErrorText);
-   virtual metaIndex * UnloadedClone() const;
+   virtual bool Load(std::string const &Filename, std::string * const ErrorText) APT_OVERRIDE;
+   virtual metaIndex * UnloadedClone() const APT_OVERRIDE;
 
-   virtual std::vector <pkgIndexFile *> *GetIndexFiles();
+   virtual std::vector <pkgIndexFile *> *GetIndexFiles() APT_OVERRIDE;
 
    bool SetTrusted(TriState const Trusted);
    bool SetCheckValidUntil(TriState const Trusted);
@@ -58,7 +58,7 @@ class APT_HIDDEN debReleaseIndex : public metaIndex
    bool SetValidUntilMax(time_t const Valid);
    bool SetSignedBy(std::string const &SignedBy);
 
-   virtual bool IsTrusted() const;
+   virtual bool IsTrusted() const APT_OVERRIDE;
 
    void AddComponent(bool const isSrc, std::string const &Name,
 	 std::vector<std::string> const &Targets,
@@ -73,29 +73,29 @@ private:
    std::string DebFile;
    debDebPkgFileIndex *DebIndex;
 public:
-   virtual std::string ArchiveURI(std::string const& /*File*/) const {
+   virtual std::string ArchiveURI(std::string const& /*File*/) const APT_OVERRIDE {
       return DebFile;
    }
-   virtual bool GetIndexes(pkgAcquire* /*Owner*/, const bool& /*GetAll=false*/) {
+   virtual bool GetIndexes(pkgAcquire* /*Owner*/, const bool& /*GetAll=false*/) APT_OVERRIDE {
       return true;
    }
-   virtual std::vector<IndexTarget> GetIndexTargets() const {
+   virtual std::vector<IndexTarget> GetIndexTargets() const APT_OVERRIDE {
       return std::vector<IndexTarget>();
    }
-   virtual std::vector<pkgIndexFile *> *GetIndexFiles() {
+   virtual std::vector<pkgIndexFile *> *GetIndexFiles() APT_OVERRIDE {
       return Indexes;
    }
-   virtual bool IsTrusted() const {
+   virtual bool IsTrusted() const APT_OVERRIDE {
       return true;
    }
-   virtual bool Load(std::string const &, std::string * const ErrorText)
+   virtual bool Load(std::string const &, std::string * const ErrorText) APT_OVERRIDE
    {
       LoadedSuccessfully = TRI_NO;
       if (ErrorText != NULL)
 	 strprintf(*ErrorText, "Unparseable metaindex as it represents the standalone deb file %s", DebFile.c_str());
       return false;
    }
-   virtual metaIndex * UnloadedClone() const
+   virtual metaIndex * UnloadedClone() const APT_OVERRIDE
    {
       return NULL;
    }
diff --git a/apt-pkg/deb/debrecords.h b/apt-pkg/deb/debrecords.h
index 4d0b713d4..7fc82a88d 100644
--- a/apt-pkg/deb/debrecords.h
+++ b/apt-pkg/deb/debrecords.h
@@ -33,23 +33,23 @@ class APT_HIDDEN debRecordParserBase : public pkgRecords::Parser
 
  public:
    // These refer to the archive file for the Version
-   virtual std::string FileName();
-   virtual std::string SourcePkg();
-   virtual std::string SourceVer();
+   virtual std::string FileName() APT_OVERRIDE;
+   virtual std::string SourcePkg() APT_OVERRIDE;
+   virtual std::string SourceVer() APT_OVERRIDE;
 
-   virtual HashStringList Hashes() const;
+   virtual HashStringList Hashes() const APT_OVERRIDE;
 
    // These are some general stats about the package
-   virtual std::string Maintainer();
-   virtual std::string ShortDesc(std::string const &lang);
-   virtual std::string LongDesc(std::string const &lang);
-   virtual std::string Name();
-   virtual std::string Homepage();
+   virtual std::string Maintainer() APT_OVERRIDE;
+   virtual std::string ShortDesc(std::string const &lang) APT_OVERRIDE;
+   virtual std::string LongDesc(std::string const &lang) APT_OVERRIDE;
+   virtual std::string Name() APT_OVERRIDE;
+   virtual std::string Homepage() APT_OVERRIDE;
 
    // An arbitrary custom field
-   virtual std::string RecordField(const char *fieldName);
+   virtual std::string RecordField(const char *fieldName) APT_OVERRIDE;
 
-   virtual void GetRec(const char *&Start,const char *&Stop);
+   virtual void GetRec(const char *&Start,const char *&Stop) APT_OVERRIDE;
 
    debRecordParserBase();
    virtual ~debRecordParserBase();
@@ -62,8 +62,8 @@ class APT_HIDDEN debRecordParser : public debRecordParserBase
    FileFd File;
    pkgTagFile Tags;
 
-   virtual bool Jump(pkgCache::VerFileIterator const &Ver);
-   virtual bool Jump(pkgCache::DescFileIterator const &Desc);
+   virtual bool Jump(pkgCache::VerFileIterator const &Ver) APT_OVERRIDE;
+   virtual bool Jump(pkgCache::DescFileIterator const &Desc) APT_OVERRIDE;
 
  public:
    debRecordParser(std::string FileName,pkgCache &Cache);
@@ -80,11 +80,11 @@ class APT_HIDDEN debDebFileRecordParser : public debRecordParserBase
    APT_HIDDEN bool LoadContent();
  protected:
    // single file files, so no jumping whatsoever
-   bool Jump(pkgCache::VerFileIterator const &);
-   bool Jump(pkgCache::DescFileIterator const &);
+   bool Jump(pkgCache::VerFileIterator const &) APT_OVERRIDE;
+   bool Jump(pkgCache::DescFileIterator const &) APT_OVERRIDE;
 
  public:
-   virtual std::string FileName();
+   virtual std::string FileName() APT_OVERRIDE;
 
    debDebFileRecordParser(std::string FileName);
    virtual ~debDebFileRecordParser();
diff --git a/apt-pkg/deb/debsrcrecords.h b/apt-pkg/deb/debsrcrecords.h
index 64b07a1ec..89134af5f 100644
--- a/apt-pkg/deb/debsrcrecords.h
+++ b/apt-pkg/deb/debsrcrecords.h
@@ -36,24 +36,24 @@ class APT_HIDDEN debSrcRecordParser : public pkgSrcRecords::Parser
    
    public:
 
-   virtual bool Restart() {return Jump(0);};
-   virtual bool Step() {iOffset = Tags.Offset(); return Tags.Step(Sect);};
-   virtual bool Jump(unsigned long const &Off) {iOffset = Off; return Tags.Jump(Sect,Off);};
+   virtual bool Restart() APT_OVERRIDE {return Jump(0);};
+   virtual bool Step() APT_OVERRIDE {iOffset = Tags.Offset(); return Tags.Step(Sect);};
+   virtual bool Jump(unsigned long const &Off) APT_OVERRIDE {iOffset = Off; return Tags.Jump(Sect,Off);};
 
-   virtual std::string Package() const {return Sect.FindS("Package");};
-   virtual std::string Version() const {return Sect.FindS("Version");};
-   virtual std::string Maintainer() const {return Sect.FindS("Maintainer");};
-   virtual std::string Section() const {return Sect.FindS("Section");};
-   virtual const char **Binaries();
-   virtual bool BuildDepends(std::vector<BuildDepRec> &BuildDeps, bool const &ArchOnly, bool const &StripMultiArch = true);
-   virtual unsigned long Offset() {return iOffset;};
-   virtual std::string AsStr() 
+   virtual std::string Package() const APT_OVERRIDE {return Sect.FindS("Package");};
+   virtual std::string Version() const APT_OVERRIDE {return Sect.FindS("Version");};
+   virtual std::string Maintainer() const APT_OVERRIDE {return Sect.FindS("Maintainer");};
+   virtual std::string Section() const APT_OVERRIDE {return Sect.FindS("Section");};
+   virtual const char **Binaries() APT_OVERRIDE;
+   virtual bool BuildDepends(std::vector<BuildDepRec> &BuildDeps, bool const &ArchOnly, bool const &StripMultiArch = true) APT_OVERRIDE;
+   virtual unsigned long Offset() APT_OVERRIDE {return iOffset;};
+   virtual std::string AsStr() APT_OVERRIDE 
    {
       const char *Start=0,*Stop=0;
       Sect.GetSection(Start,Stop);
       return std::string(Start,Stop);
    };
-   virtual bool Files(std::vector<pkgSrcRecords::File> &F);
+   virtual bool Files(std::vector<pkgSrcRecords::File> &F) APT_OVERRIDE;
    bool Files2(std::vector<pkgSrcRecords::File2> &F);
 
    debSrcRecordParser(std::string const &File,pkgIndexFile const *Index);
diff --git a/apt-pkg/deb/debsystem.h b/apt-pkg/deb/debsystem.h
index e59bbebed..aed77520e 100644
--- a/apt-pkg/deb/debsystem.h
+++ b/apt-pkg/deb/debsystem.h
@@ -33,15 +33,15 @@ class debSystem : public pkgSystem
 
    public:
 
-   virtual bool Lock();
-   virtual bool UnLock(bool NoErrors = false);   
-   virtual pkgPackageManager *CreatePM(pkgDepCache *Cache) const;
-   virtual bool Initialize(Configuration &Cnf);
-   virtual bool ArchiveSupported(const char *Type);
-   virtual signed Score(Configuration const &Cnf);
-   virtual bool AddStatusFiles(std::vector<pkgIndexFile *> &List);
+   virtual bool Lock() APT_OVERRIDE;
+   virtual bool UnLock(bool NoErrors = false) APT_OVERRIDE;   
+   virtual pkgPackageManager *CreatePM(pkgDepCache *Cache) const APT_OVERRIDE;
+   virtual bool Initialize(Configuration &Cnf) APT_OVERRIDE;
+   virtual bool ArchiveSupported(const char *Type) APT_OVERRIDE;
+   virtual signed Score(Configuration const &Cnf) APT_OVERRIDE;
+   virtual bool AddStatusFiles(std::vector<pkgIndexFile *> &List) APT_OVERRIDE;
    virtual bool FindIndex(pkgCache::PkgFileIterator File,
-			  pkgIndexFile *&Found) const;
+			  pkgIndexFile *&Found) const APT_OVERRIDE;
 
    debSystem();
    virtual ~debSystem();
diff --git a/apt-pkg/deb/debversion.h b/apt-pkg/deb/debversion.h
index 7befe6372..6d7eca7c1 100644
--- a/apt-pkg/deb/debversion.h
+++ b/apt-pkg/deb/debversion.h
@@ -27,11 +27,11 @@ class debVersioningSystem : public pkgVersioningSystem
 			  const char *B,const char *Bend) APT_PURE;
    virtual bool CheckDep(const char *PkgVer,int Op,const char *DepVer) APT_PURE;
    virtual APT_PURE int DoCmpReleaseVer(const char *A,const char *Aend,
-			     const char *B,const char *Bend)
+			     const char *B,const char *Bend) APT_OVERRIDE
    {
       return DoCmpVersion(A,Aend,B,Bend);
    }
-   virtual std::string UpstreamVersion(const char *A);
+   virtual std::string UpstreamVersion(const char *A) APT_OVERRIDE;
 
    debVersioningSystem();
 };
diff --git a/apt-pkg/deb/dpkgpm.h b/apt-pkg/deb/dpkgpm.h
index a1b36c6c0..82c1bef5d 100644
--- a/apt-pkg/deb/dpkgpm.h
+++ b/apt-pkg/deb/dpkgpm.h
@@ -120,14 +120,14 @@ class pkgDPkgPM : public pkgPackageManager
    void ProcessDpkgStatusLine(char *line);
 
    // The Actuall installation implementation
-   virtual bool Install(PkgIterator Pkg,std::string File);
-   virtual bool Configure(PkgIterator Pkg);
-   virtual bool Remove(PkgIterator Pkg,bool Purge = false);
+   virtual bool Install(PkgIterator Pkg,std::string File) APT_OVERRIDE;
+   virtual bool Configure(PkgIterator Pkg) APT_OVERRIDE;
+   virtual bool Remove(PkgIterator Pkg,bool Purge = false) APT_OVERRIDE;
 
-   virtual bool Go(APT::Progress::PackageManager *progress);
-   virtual bool Go(int StatusFd=-1);
+   virtual bool Go(APT::Progress::PackageManager *progress) APT_OVERRIDE;
+   virtual bool Go(int StatusFd=-1) APT_OVERRIDE;
 
-   virtual void Reset();
+   virtual void Reset() APT_OVERRIDE;
    
    public:
 
diff --git a/apt-pkg/depcache.h b/apt-pkg/depcache.h
index 40a2fcaab..2c3304ba8 100644
--- a/apt-pkg/depcache.h
+++ b/apt-pkg/depcache.h
@@ -204,7 +204,7 @@ class pkgDepCache : protected pkgCache::Namespace
      DefaultRootSetFunc() : Configuration::MatchAgainstConfig("APT::NeverAutoRemove") {};
      virtual ~DefaultRootSetFunc() {};
 
-     bool InRootSet(const pkgCache::PkgIterator &pkg) { return pkg.end() == false && Match(pkg.Name()); };
+     bool InRootSet(const pkgCache::PkgIterator &pkg) APT_OVERRIDE { return pkg.end() == false && Match(pkg.Name()); };
    };
 
    struct StateCache
diff --git a/apt-pkg/edsp/edspindexfile.cc b/apt-pkg/edsp/edspindexfile.cc
index 3bffc27e9..649d94b5d 100644
--- a/apt-pkg/edsp/edspindexfile.cc
+++ b/apt-pkg/edsp/edspindexfile.cc
@@ -67,7 +67,7 @@ bool edspIndex::Merge(pkgCacheGenerator &Gen,OpProgress *Prog) const
 class APT_HIDDEN edspIFType: public pkgIndexFile::Type
 {
    public:
-   virtual pkgRecords::Parser *CreatePkgParser(pkgCache::PkgFileIterator) const
+   virtual pkgRecords::Parser *CreatePkgParser(pkgCache::PkgFileIterator) const APT_OVERRIDE
    {
       // we don't have a record parser for this type as the file is not presistent
       return NULL;
diff --git a/apt-pkg/edsp/edspindexfile.h b/apt-pkg/edsp/edspindexfile.h
index 265a016c5..b2a510f14 100644
--- a/apt-pkg/edsp/edspindexfile.h
+++ b/apt-pkg/edsp/edspindexfile.h
@@ -27,7 +27,7 @@ class APT_HIDDEN edspIndex : public debStatusIndex
 
    virtual const Type *GetType() const APT_CONST;
 
-   virtual bool Merge(pkgCacheGenerator &Gen,OpProgress *Prog) const;
+   virtual bool Merge(pkgCacheGenerator &Gen,OpProgress *Prog) const APT_OVERRIDE;
 
    edspIndex(std::string File);
    virtual ~edspIndex();
diff --git a/apt-pkg/edsp/edsplistparser.h b/apt-pkg/edsp/edsplistparser.h
index 98dde4bf5..2a09e8c47 100644
--- a/apt-pkg/edsp/edsplistparser.h
+++ b/apt-pkg/edsp/edsplistparser.h
@@ -29,11 +29,11 @@ class APT_HIDDEN edspListParser : public debListParser
 {
    void * const d;
    public:
-   virtual bool NewVersion(pkgCache::VerIterator &Ver);
+   virtual bool NewVersion(pkgCache::VerIterator &Ver) APT_OVERRIDE;
    virtual std::string Description();
    virtual std::string DescriptionLanguage();
-   virtual MD5SumValue Description_md5();
-   virtual unsigned short VersionHash();
+   virtual MD5SumValue Description_md5() APT_OVERRIDE;
+   virtual unsigned short VersionHash() APT_OVERRIDE;
 
    bool LoadReleaseInfo(pkgCache::RlsFileIterator &FileI,FileFd &File,
 			std::string const &section);
@@ -42,7 +42,7 @@ class APT_HIDDEN edspListParser : public debListParser
    virtual ~edspListParser();
 
    protected:
-   virtual bool ParseStatus(pkgCache::PkgIterator &Pkg,pkgCache::VerIterator &Ver);
+   virtual bool ParseStatus(pkgCache::PkgIterator &Pkg,pkgCache::VerIterator &Ver) APT_OVERRIDE;
 
 };
 
diff --git a/apt-pkg/edsp/edspsystem.h b/apt-pkg/edsp/edspsystem.h
index 156b02bb5..ec42bef75 100644
--- a/apt-pkg/edsp/edspsystem.h
+++ b/apt-pkg/edsp/edspsystem.h
@@ -16,6 +16,8 @@
 
 #include <vector>
 
+#include <apt-pkg/macros.h>
+
 class Configuration;
 class pkgDepCache;
 class pkgIndexFile;
@@ -31,15 +33,15 @@ class APT_HIDDEN edspSystem : public pkgSystem
 
    public:
 
-   virtual bool Lock() APT_CONST;
-   virtual bool UnLock(bool NoErrors = false) APT_CONST;
-   virtual pkgPackageManager *CreatePM(pkgDepCache *Cache) const APT_CONST;
-   virtual bool Initialize(Configuration &Cnf);
-   virtual bool ArchiveSupported(const char *Type) APT_CONST;
-   virtual signed Score(Configuration const &Cnf);
-   virtual bool AddStatusFiles(std::vector<pkgIndexFile *> &List);
+   virtual bool Lock() APT_OVERRIDE APT_CONST;
+   virtual bool UnLock(bool NoErrors = false) APT_OVERRIDE APT_CONST;
+   virtual pkgPackageManager *CreatePM(pkgDepCache *Cache) const APT_OVERRIDE APT_CONST;
+   virtual bool Initialize(Configuration &Cnf) APT_OVERRIDE;
+   virtual bool ArchiveSupported(const char *Type) APT_OVERRIDE APT_CONST;
+   virtual signed Score(Configuration const &Cnf) APT_OVERRIDE;
+   virtual bool AddStatusFiles(std::vector<pkgIndexFile *> &List) APT_OVERRIDE;
    virtual bool FindIndex(pkgCache::PkgFileIterator File,
-			  pkgIndexFile *&Found) const;
+			  pkgIndexFile *&Found) const APT_OVERRIDE;
 
    edspSystem();
    virtual ~edspSystem();
diff --git a/apt-pkg/indexcopy.h b/apt-pkg/indexcopy.h
index 6eecad028..316672e1d 100644
--- a/apt-pkg/indexcopy.h
+++ b/apt-pkg/indexcopy.h
@@ -62,10 +62,10 @@ class PackageCopy : public IndexCopy					/*{{{*/
    void * const d;
    protected:
 
-   virtual bool GetFile(std::string &Filename,unsigned long long &Size);
-   virtual bool RewriteEntry(FileFd &Target, std::string const &File);
-   virtual const char *GetFileName() {return "Packages";};
-   virtual const char *Type() {return "Package";};
+   virtual bool GetFile(std::string &Filename,unsigned long long &Size) APT_OVERRIDE;
+   virtual bool RewriteEntry(FileFd &Target, std::string const &File) APT_OVERRIDE;
+   virtual const char *GetFileName() APT_OVERRIDE {return "Packages";};
+   virtual const char *Type() APT_OVERRIDE {return "Package";};
 
    public:
    PackageCopy();
@@ -77,10 +77,10 @@ class SourceCopy : public IndexCopy					/*{{{*/
    void * const d;
    protected:
    
-   virtual bool GetFile(std::string &Filename,unsigned long long &Size);
-   virtual bool RewriteEntry(FileFd &Target, std::string const &File);
-   virtual const char *GetFileName() {return "Sources";};
-   virtual const char *Type() {return "Source";};
+   virtual bool GetFile(std::string &Filename,unsigned long long &Size) APT_OVERRIDE;
+   virtual bool RewriteEntry(FileFd &Target, std::string const &File) APT_OVERRIDE;
+   virtual const char *GetFileName() APT_OVERRIDE {return "Sources";};
+   virtual const char *Type() APT_OVERRIDE {return "Source";};
 
    public:
    SourceCopy();
diff --git a/apt-pkg/indexfile.h b/apt-pkg/indexfile.h
index 44d39110d..5be7794bf 100644
--- a/apt-pkg/indexfile.h
+++ b/apt-pkg/indexfile.h
@@ -160,10 +160,10 @@ protected:
    std::string IndexFileName() const;
 
 public:
-   virtual std::string ArchiveURI(std::string File) const;
-   virtual std::string Describe(bool Short = false) const;
-   virtual bool Exists() const;
-   virtual unsigned long Size() const;
+   virtual std::string ArchiveURI(std::string File) const APT_OVERRIDE;
+   virtual std::string Describe(bool Short = false) const APT_OVERRIDE;
+   virtual bool Exists() const APT_OVERRIDE;
+   virtual unsigned long Size() const APT_OVERRIDE;
 
    pkgIndexTargetFile(IndexTarget const &Target, bool const Trusted);
    virtual ~pkgIndexTargetFile();
diff --git a/apt-pkg/install-progress.h b/apt-pkg/install-progress.h
index 07fc15fd8..ee03ac217 100644
--- a/apt-pkg/install-progress.h
+++ b/apt-pkg/install-progress.h
@@ -72,21 +72,21 @@ namespace Progress {
     explicit PackageManagerProgressFd(int progress_fd);
     virtual ~PackageManagerProgressFd();
 
-    virtual void StartDpkg();
-    virtual void Stop();
+    virtual void StartDpkg() APT_OVERRIDE;
+    virtual void Stop() APT_OVERRIDE;
 
     virtual bool StatusChanged(std::string PackageName,
                                unsigned int StepsDone,
                                unsigned int TotalSteps,
-                               std::string HumanReadableAction);
+                               std::string HumanReadableAction) APT_OVERRIDE;
     virtual void Error(std::string PackageName,
                        unsigned int StepsDone,
                        unsigned int TotalSteps,
-                          std::string ErrorMessage);
+                          std::string ErrorMessage) APT_OVERRIDE;
     virtual void ConffilePrompt(std::string PackageName,
                                 unsigned int StepsDone,
                                 unsigned int TotalSteps,
-                                   std::string ConfMessage);
+                                   std::string ConfMessage) APT_OVERRIDE;
 
  };
 
@@ -103,21 +103,21 @@ namespace Progress {
     explicit PackageManagerProgressDeb822Fd(int progress_fd);
     virtual ~PackageManagerProgressDeb822Fd();
 
-    virtual void StartDpkg();
-    virtual void Stop();
+    virtual void StartDpkg() APT_OVERRIDE;
+    virtual void Stop() APT_OVERRIDE;
 
     virtual bool StatusChanged(std::string PackageName,
                                unsigned int StepsDone,
                                unsigned int TotalSteps,
-                               std::string HumanReadableAction);
+                               std::string HumanReadableAction) APT_OVERRIDE;
     virtual void Error(std::string PackageName,
                        unsigned int StepsDone,
                        unsigned int TotalSteps,
-                          std::string ErrorMessage);
+                          std::string ErrorMessage) APT_OVERRIDE;
     virtual void ConffilePrompt(std::string PackageName,
                                 unsigned int StepsDone,
                                 unsigned int TotalSteps,
-                                   std::string ConfMessage);
+                                   std::string ConfMessage) APT_OVERRIDE;
  };
 
  class PackageManagerFancy : public PackageManager
@@ -144,12 +144,12 @@ namespace Progress {
  public:
     PackageManagerFancy();
     virtual ~PackageManagerFancy();
-    virtual void Start(int child_pty=-1);
-    virtual void Stop();
+    virtual void Start(int child_pty=-1) APT_OVERRIDE;
+    virtual void Stop() APT_OVERRIDE;
     virtual bool StatusChanged(std::string PackageName,
                                unsigned int StepsDone,
                                unsigned int TotalSteps,
-                               std::string HumanReadableAction);
+                               std::string HumanReadableAction) APT_OVERRIDE;
 
     // return a progress bar of the given size for the given progress 
     // percent between 0.0 and 1.0 in the form "[####...]"
@@ -163,7 +163,7 @@ namespace Progress {
     virtual bool StatusChanged(std::string PackageName,
                                unsigned int StepsDone,
                                unsigned int TotalSteps,
-                               std::string HumanReadableAction);
+                               std::string HumanReadableAction) APT_OVERRIDE;
 
     PackageManagerText();
     virtual ~PackageManagerText();
diff --git a/apt-pkg/policy.h b/apt-pkg/policy.h
index 58b062a7b..b3e1ec6b1 100644
--- a/apt-pkg/policy.h
+++ b/apt-pkg/policy.h
@@ -78,10 +78,10 @@ class pkgPolicy : public pkgDepCache::Policy
    pkgCache::VerIterator GetMatch(pkgCache::PkgIterator const &Pkg);
 
    // Things for the cache interface.
-   virtual pkgCache::VerIterator GetCandidateVer(pkgCache::PkgIterator const &Pkg);
-   virtual signed short GetPriority(pkgCache::PkgIterator const &Pkg);
+   virtual pkgCache::VerIterator GetCandidateVer(pkgCache::PkgIterator const &Pkg) APT_OVERRIDE;
+   virtual signed short GetPriority(pkgCache::PkgIterator const &Pkg) APT_OVERRIDE;
    virtual signed short GetPriority(pkgCache::VerIterator const &Pkg);
-   virtual signed short GetPriority(pkgCache::PkgFileIterator const &File);
+   virtual signed short GetPriority(pkgCache::PkgFileIterator const &File) APT_OVERRIDE;
 
    bool InitDefaults();
    
diff --git a/apt-pkg/tagfile.h b/apt-pkg/tagfile.h
index 81fff89f0..77a84c832 100644
--- a/apt-pkg/tagfile.h
+++ b/apt-pkg/tagfile.h
@@ -147,7 +147,7 @@ class pkgTagSection
    for being a bit slower to allow comments and new lines all over the place */
 class pkgUserTagSection : public pkgTagSection
 {
-   virtual void TrimRecord(bool BeforeRecord, const char* &End);
+   virtual void TrimRecord(bool BeforeRecord, const char* &End) APT_OVERRIDE;
 };
 
 class pkgTagFilePrivate;
diff --git a/apt-private/acqprogress.h b/apt-private/acqprogress.h
index cbb06fbec..6b6d555b1 100644
--- a/apt-private/acqprogress.h
+++ b/apt-private/acqprogress.h
@@ -28,15 +28,15 @@ class APT_PUBLIC AcqTextStatus : public pkgAcquireStatus
 
    public:
 
-   virtual bool MediaChange(std::string Media,std::string Drive);
-   virtual void IMSHit(pkgAcquire::ItemDesc &Itm);
-   virtual void Fetch(pkgAcquire::ItemDesc &Itm);
-   virtual void Done(pkgAcquire::ItemDesc &Itm);
-   virtual void Fail(pkgAcquire::ItemDesc &Itm);
-   virtual void Start();
-   virtual void Stop();
-
-   bool Pulse(pkgAcquire *Owner);
+   virtual bool MediaChange(std::string Media,std::string Drive) APT_OVERRIDE;
+   virtual void IMSHit(pkgAcquire::ItemDesc &Itm) APT_OVERRIDE;
+   virtual void Fetch(pkgAcquire::ItemDesc &Itm) APT_OVERRIDE;
+   virtual void Done(pkgAcquire::ItemDesc &Itm) APT_OVERRIDE;
+   virtual void Fail(pkgAcquire::ItemDesc &Itm) APT_OVERRIDE;
+   virtual void Start() APT_OVERRIDE;
+   virtual void Stop() APT_OVERRIDE;
+
+   bool Pulse(pkgAcquire *Owner) APT_OVERRIDE;
 
    AcqTextStatus(std::ostream &out, unsigned int &ScreenWidth,unsigned int const Quiet);
 };
diff --git a/apt-private/private-cacheset.h b/apt-private/private-cacheset.h
index 0eb22b788..518f179f3 100644
--- a/apt-private/private-cacheset.h
+++ b/apt-private/private-cacheset.h
@@ -81,13 +81,13 @@ class CacheSetHelperVirtuals: public APT::CacheSetHelper {
 public:
    APT::PackageSet virtualPkgs;
 
-   virtual pkgCache::VerIterator canNotGetVersion(enum CacheSetHelper::VerSelector const select, pkgCacheFile &Cache, pkgCache::PkgIterator const &Pkg) {
+   virtual pkgCache::VerIterator canNotGetVersion(enum CacheSetHelper::VerSelector const select, pkgCacheFile &Cache, pkgCache::PkgIterator const &Pkg) APT_OVERRIDE {
       if (select == NEWEST || select == CANDIDATE || select == ALL)
 	 virtualPkgs.insert(Pkg);
       return CacheSetHelper::canNotGetVersion(select, Cache, Pkg);
    }
 
-   virtual void canNotFindVersion(enum CacheSetHelper::VerSelector const select, APT::VersionContainerInterface * vci, pkgCacheFile &Cache, pkgCache::PkgIterator const &Pkg) {
+   virtual void canNotFindVersion(enum CacheSetHelper::VerSelector const select, APT::VersionContainerInterface * vci, pkgCacheFile &Cache, pkgCache::PkgIterator const &Pkg) APT_OVERRIDE {
       if (select == NEWEST || select == CANDIDATE || select == ALL)
 	 virtualPkgs.insert(Pkg);
       return CacheSetHelper::canNotFindVersion(select, vci, Cache, Pkg);
@@ -113,23 +113,23 @@ public:
 		explicitlyNamed = true;
 	}
 
-	virtual void showTaskSelection(pkgCache::PkgIterator const &Pkg, std::string const &pattern) {
+	virtual void showTaskSelection(pkgCache::PkgIterator const &Pkg, std::string const &pattern) APT_OVERRIDE {
 		ioprintf(out, _("Note, selecting '%s' for task '%s'\n"),
 				Pkg.FullName(true).c_str(), pattern.c_str());
 		explicitlyNamed = false;
 	}
-        virtual void showFnmatchSelection(pkgCache::PkgIterator const &Pkg, std::string const &pattern) {
+        virtual void showFnmatchSelection(pkgCache::PkgIterator const &Pkg, std::string const &pattern) APT_OVERRIDE {
 		ioprintf(out, _("Note, selecting '%s' for glob '%s'\n"),
 				Pkg.FullName(true).c_str(), pattern.c_str());
 		explicitlyNamed = false;
 	}
-	virtual void showRegExSelection(pkgCache::PkgIterator const &Pkg, std::string const &pattern) {
+	virtual void showRegExSelection(pkgCache::PkgIterator const &Pkg, std::string const &pattern) APT_OVERRIDE {
 		ioprintf(out, _("Note, selecting '%s' for regex '%s'\n"),
 				Pkg.FullName(true).c_str(), pattern.c_str());
 		explicitlyNamed = false;
 	}
 	virtual void showSelectedVersion(pkgCache::PkgIterator const &/*Pkg*/, pkgCache::VerIterator const Ver,
-				 std::string const &ver, bool const /*verIsRel*/) {
+				 std::string const &ver, bool const /*verIsRel*/) APT_OVERRIDE {
 		if (ver == Ver.VerStr())
 			return;
 		selectedByRelease.push_back(make_pair(Ver, ver));
@@ -191,7 +191,7 @@ public:
 		return false;
 	}
 
-	virtual pkgCache::VerIterator canNotFindCandidateVer(pkgCacheFile &Cache, pkgCache::PkgIterator const &Pkg) {
+	virtual pkgCache::VerIterator canNotFindCandidateVer(pkgCacheFile &Cache, pkgCache::PkgIterator const &Pkg) APT_OVERRIDE {
 		APT::VersionSet const verset = tryVirtualPackage(Cache, Pkg, CacheSetHelper::CANDIDATE);
 		if (verset.empty() == false)
 			return *(verset.begin());
@@ -202,7 +202,7 @@ public:
 		return pkgCache::VerIterator(Cache, 0);
 	}
 
-	virtual pkgCache::VerIterator canNotFindNewestVer(pkgCacheFile &Cache, pkgCache::PkgIterator const &Pkg) {
+	virtual pkgCache::VerIterator canNotFindNewestVer(pkgCacheFile &Cache, pkgCache::PkgIterator const &Pkg) APT_OVERRIDE {
 		if (Pkg->ProvidesList != 0)
 		{
 			APT::VersionSet const verset = tryVirtualPackage(Cache, Pkg, CacheSetHelper::NEWEST);
diff --git a/apt-private/private-moo.h b/apt-private/private-moo.h
index b8e1cfed6..bc8b3e7dd 100644
--- a/apt-private/private-moo.h
+++ b/apt-private/private-moo.h
@@ -1,6 +1,8 @@
 #ifndef APT_PRIVATE_MOO_H
 #define APT_PRIVATE_MOO_H
 
+#include <apt-pkg/macros.h>
+
 class CommandLine;
 
 APT_PUBLIC bool DoMoo(CommandLine &CmdL);
diff --git a/cmdline/apt-cdrom.cc b/cmdline/apt-cdrom.cc
index d95c169cd..c0541d196 100644
--- a/cmdline/apt-cdrom.cc
+++ b/cmdline/apt-cdrom.cc
@@ -44,12 +44,12 @@ protected:
    OpTextProgress Progress;
    void Prompt(const char *Text);
    string PromptLine(const char *Text);
-   bool AskCdromName(string &name);
+   bool AskCdromName(string &name) APT_OVERRIDE;
 
 public:
-   virtual void Update(string text, int current);
-   virtual bool ChangeCdrom();
-   virtual OpProgress* GetOpProgress();
+   virtual void Update(string text, int current) APT_OVERRIDE;
+   virtual bool ChangeCdrom() APT_OVERRIDE;
+   virtual OpProgress* GetOpProgress() APT_OVERRIDE;
 };
 
 void pkgCdromTextStatus::Prompt(const char *Text)
diff --git a/cmdline/apt-extracttemplates.h b/cmdline/apt-extracttemplates.h
index b129a2d51..91e385e70 100644
--- a/cmdline/apt-extracttemplates.h
+++ b/cmdline/apt-extracttemplates.h
@@ -26,9 +26,9 @@ class DebFile : public pkgDirStream
 public:
 	explicit DebFile(const char *FileName);
 	~DebFile();
-	bool DoItem(Item &I, int &fd);
+	bool DoItem(Item &I, int &fd) APT_OVERRIDE;
 	bool Process(pkgDirStream::Item &I, const unsigned char *data, 
-		unsigned long long size, unsigned long long pos);
+		unsigned long long size, unsigned long long pos) APT_OVERRIDE;
 
 	bool Go();
 	bool ParseInfo();
diff --git a/cmdline/apt-get.cc b/cmdline/apt-get.cc
index 10d4b3cc5..9232e1505 100644
--- a/cmdline/apt-get.cc
+++ b/cmdline/apt-get.cc
@@ -572,7 +572,7 @@ static bool DoClean(CommandLine &)
 class LogCleaner : public pkgArchiveCleaner
 {
    protected:
-   virtual void Erase(const char *File,string Pkg,string Ver,struct stat &St) 
+   virtual void Erase(const char *File,string Pkg,string Ver,struct stat &St) APT_OVERRIDE 
    {
       c1out << "Del " << Pkg << " " << Ver << " [" << SizeToStr(St.st_size) << "B]" << endl;
       
diff --git a/ftparchive/contents.h b/ftparchive/contents.h
index 953d0d54b..bc691d473 100644
--- a/ftparchive/contents.h
+++ b/ftparchive/contents.h
@@ -81,7 +81,7 @@ class ContentsExtract : public pkgDirStream
    
    bool Read(debDebFile &Deb);
    
-   virtual bool DoItem(Item &Itm,int &Fd);      
+   virtual bool DoItem(Item &Itm,int &Fd) APT_OVERRIDE;      
    void Reset() {CurSize = 0;};
    bool TakeContents(const void *Data,unsigned long long Length);
    void Add(GenContents &Contents,std::string const &Package);
diff --git a/ftparchive/writer.h b/ftparchive/writer.h
index b9c1f672a..98012beee 100644
--- a/ftparchive/writer.h
+++ b/ftparchive/writer.h
@@ -120,7 +120,7 @@ class PackagesWriter : public FTWScanner
    inline bool ReadOverride(string const &File) {return Over.ReadOverride(File);};
    inline bool ReadExtraOverride(string const &File) 
       {return Over.ReadExtraOverride(File);};
-   virtual bool DoPackage(string FileName);
+   virtual bool DoPackage(string FileName) APT_OVERRIDE;
 
    PackagesWriter(FileFd * const Output, TranslationWriter * const TransWriter, string const &DB,
                   string const &Overrides,
@@ -142,7 +142,7 @@ class ContentsWriter : public FTWScanner
    string Prefix;
 
    bool DoPackage(string FileName,string Package);
-   virtual bool DoPackage(string FileName) 
+   virtual bool DoPackage(string FileName) APT_OVERRIDE 
              {return DoPackage(FileName,string());};
    bool ReadFromPkgs(string const &PkgFile,string const &PkgCompress);
 
@@ -171,7 +171,7 @@ class SourcesWriter : public FTWScanner
    string DirStrip;
    struct CacheDB::Stats &Stats;
 
-   virtual bool DoPackage(string FileName);
+   virtual bool DoPackage(string FileName) APT_OVERRIDE;
 
    SourcesWriter(FileFd * const Output, string const &DB,string const &BOverrides,string const &SOverrides,
 		 string const &ExtOverrides=string());
@@ -182,7 +182,7 @@ class ReleaseWriter : public FTWScanner
 {
 public:
    ReleaseWriter(FileFd * const Output, string const &DB);
-   virtual bool DoPackage(string FileName);
+   virtual bool DoPackage(string FileName) APT_OVERRIDE;
    void Finish();
 
    // General options
diff --git a/methods/cdrom.cc b/methods/cdrom.cc
index 67265cfa3..d9ddecb6a 100644
--- a/methods/cdrom.cc
+++ b/methods/cdrom.cc
@@ -42,9 +42,9 @@ class CDROMMethod : public pkgAcqMethod
  
    bool IsCorrectCD(URI want, string MountPath, string& NewID);
    bool AutoDetectAndMount(const URI, string &NewID);
-   virtual bool Fetch(FetchItem *Itm);
+   virtual bool Fetch(FetchItem *Itm) APT_OVERRIDE;
    string GetID(string Name);
-   virtual void Exit();
+   virtual void Exit() APT_OVERRIDE;
       
    public:
    
diff --git a/methods/copy.cc b/methods/copy.cc
index 4bdc15f75..0c9f322e6 100644
--- a/methods/copy.cc
+++ b/methods/copy.cc
@@ -27,7 +27,7 @@
 
 class CopyMethod : public pkgAcqMethod
 {
-   virtual bool Fetch(FetchItem *Itm);
+   virtual bool Fetch(FetchItem *Itm) APT_OVERRIDE;
    void CalculateHashes(FetchItem const * const Itm, FetchResult &Res);
    
    public:
diff --git a/methods/file.cc b/methods/file.cc
index 5c76ec122..40e85bce5 100644
--- a/methods/file.cc
+++ b/methods/file.cc
@@ -30,7 +30,7 @@
 
 class FileMethod : public pkgAcqMethod
 {
-   virtual bool Fetch(FetchItem *Itm);
+   virtual bool Fetch(FetchItem *Itm) APT_OVERRIDE;
    
    public:
    
diff --git a/methods/ftp.cc b/methods/ftp.cc
index 92d8573f1..5fee20f23 100644
--- a/methods/ftp.cc
+++ b/methods/ftp.cc
@@ -39,7 +39,6 @@
 
 // Internet stuff
 #include <netinet/in.h>
-#include <sys/socket.h>
 #include <arpa/inet.h>
 #include <netdb.h>
 
diff --git a/methods/ftp.h b/methods/ftp.h
index 2efd28ec6..2c4e9f57a 100644
--- a/methods/ftp.h
+++ b/methods/ftp.h
@@ -10,8 +10,10 @@
 #ifndef APT_FTP_H
 #define APT_FTP_H
 
+#include <apt-pkg/acquire-method.h>
 #include <apt-pkg/strutl.h>
 
+#include <sys/socket.h>
 #include <sys/types.h>
 #include <time.h>
 #include <string>
@@ -71,8 +73,8 @@ class FTPConn
 
 class FtpMethod : public pkgAcqMethod
 {
-   virtual bool Fetch(FetchItem *Itm);
-   virtual bool Configuration(std::string Message);
+   virtual bool Fetch(FetchItem *Itm) APT_OVERRIDE;
+   virtual bool Configuration(std::string Message) APT_OVERRIDE;
    
    FTPConn *Server;
    
diff --git a/methods/gpgv.cc b/methods/gpgv.cc
index d88a06789..490833d8c 100644
--- a/methods/gpgv.cc
+++ b/methods/gpgv.cc
@@ -46,8 +46,8 @@ class GPGVMethod : public pkgAcqMethod
 				vector<string> &NoPubKeySigners);
    
    protected:
-   virtual bool URIAcquire(std::string const &Message, FetchItem *Itm);
-   virtual bool Configuration(string Message);
+   virtual bool URIAcquire(std::string const &Message, FetchItem *Itm) APT_OVERRIDE;
+   virtual bool Configuration(string Message) APT_OVERRIDE;
    public:
    
    GPGVMethod() : pkgAcqMethod("1.0",SingleInstance | SendConfig) {};
diff --git a/methods/gzip.cc b/methods/gzip.cc
index 65519633c..637aae124 100644
--- a/methods/gzip.cc
+++ b/methods/gzip.cc
@@ -32,8 +32,8 @@ const char *Prog;
 
 class GzipMethod : public pkgAcqMethod
 {
-   virtual bool Fetch(FetchItem *Itm);
-   virtual bool Configuration(std::string Message);
+   virtual bool Fetch(FetchItem *Itm) APT_OVERRIDE;
+   virtual bool Configuration(std::string Message) APT_OVERRIDE;
    
    public:
    
diff --git a/methods/http.h b/methods/http.h
index e73871931..da6139b02 100644
--- a/methods/http.h
+++ b/methods/http.h
@@ -99,23 +99,23 @@ struct HttpServerState: public ServerState
    int ServerFd;
 
    protected:
-   virtual bool ReadHeaderLines(std::string &Data);
-   virtual bool LoadNextResponse(bool const ToFile, FileFd * const File);
-   virtual bool WriteResponse(std::string const &Data);
+   virtual bool ReadHeaderLines(std::string &Data) APT_OVERRIDE;
+   virtual bool LoadNextResponse(bool const ToFile, FileFd * const File) APT_OVERRIDE;
+   virtual bool WriteResponse(std::string const &Data) APT_OVERRIDE;
 
    public:
-   virtual void Reset() { ServerState::Reset(); ServerFd = -1; };
+   virtual void Reset() APT_OVERRIDE { ServerState::Reset(); ServerFd = -1; };
 
-   virtual bool RunData(FileFd * const File);
+   virtual bool RunData(FileFd * const File) APT_OVERRIDE;
 
-   virtual bool Open();
-   virtual bool IsOpen();
-   virtual bool Close();
-   virtual bool InitHashes(HashStringList const &ExpectedHashes);
-   virtual Hashes * GetHashes();
-   virtual bool Die(FileFd &File);
-   virtual bool Flush(FileFd * const File);
-   virtual bool Go(bool ToFile, FileFd * const File);
+   virtual bool Open() APT_OVERRIDE;
+   virtual bool IsOpen() APT_OVERRIDE;
+   virtual bool Close() APT_OVERRIDE;
+   virtual bool InitHashes(HashStringList const &ExpectedHashes) APT_OVERRIDE;
+   virtual Hashes * GetHashes() APT_OVERRIDE;
+   virtual bool Die(FileFd &File) APT_OVERRIDE;
+   virtual bool Flush(FileFd * const File) APT_OVERRIDE;
+   virtual bool Go(bool ToFile, FileFd * const File) APT_OVERRIDE;
 
    HttpServerState(URI Srv, HttpMethod *Owner);
    virtual ~HttpServerState() {Close();};
@@ -124,12 +124,12 @@ struct HttpServerState: public ServerState
 class HttpMethod : public ServerMethod
 {
    public:
-   virtual void SendReq(FetchItem *Itm);
+   virtual void SendReq(FetchItem *Itm) APT_OVERRIDE;
 
-   virtual bool Configuration(std::string Message);
+   virtual bool Configuration(std::string Message) APT_OVERRIDE;
 
-   virtual ServerState * CreateServerState(URI uri);
-   virtual void RotateDNS();
+   virtual ServerState * CreateServerState(URI uri) APT_OVERRIDE;
+   virtual void RotateDNS() APT_OVERRIDE;
 
    protected:
    std::string AutoDetectProxyCmd;
diff --git a/methods/https.h b/methods/https.h
index 57fc292ee..29b20b921 100644
--- a/methods/https.h
+++ b/methods/https.h
@@ -32,23 +32,23 @@ class HttpsServerState : public ServerState
    Hashes * Hash;
 
    protected:
-   virtual bool ReadHeaderLines(std::string &/*Data*/) { return false; }
-   virtual bool LoadNextResponse(bool const /*ToFile*/, FileFd * const /*File*/) { return false; }
+   virtual bool ReadHeaderLines(std::string &/*Data*/) APT_OVERRIDE { return false; }
+   virtual bool LoadNextResponse(bool const /*ToFile*/, FileFd * const /*File*/) APT_OVERRIDE { return false; }
 
    public:
-   virtual bool WriteResponse(std::string const &/*Data*/) { return false; }
+   virtual bool WriteResponse(std::string const &/*Data*/) APT_OVERRIDE { return false; }
 
    /** \brief Transfer the data from the socket */
-   virtual bool RunData(FileFd * const /*File*/) { return false; }
+   virtual bool RunData(FileFd * const /*File*/) APT_OVERRIDE { return false; }
 
-   virtual bool Open() { return false; }
-   virtual bool IsOpen() { return false; }
-   virtual bool Close() { return false; }
-   virtual bool InitHashes(HashStringList const &ExpectedHashes);
-   virtual Hashes * GetHashes();
-   virtual bool Die(FileFd &/*File*/) { return false; }
-   virtual bool Flush(FileFd * const /*File*/) { return false; }
-   virtual bool Go(bool /*ToFile*/, FileFd * const /*File*/) { return false; }
+   virtual bool Open() APT_OVERRIDE { return false; }
+   virtual bool IsOpen() APT_OVERRIDE { return false; }
+   virtual bool Close() APT_OVERRIDE { return false; }
+   virtual bool InitHashes(HashStringList const &ExpectedHashes) APT_OVERRIDE;
+   virtual Hashes * GetHashes() APT_OVERRIDE;
+   virtual bool Die(FileFd &/*File*/) APT_OVERRIDE { return false; }
+   virtual bool Flush(FileFd * const /*File*/) APT_OVERRIDE { return false; }
+   virtual bool Go(bool /*ToFile*/, FileFd * const /*File*/) APT_OVERRIDE { return false; }
 
    HttpsServerState(URI Srv, HttpsMethod *Owner);
    virtual ~HttpsServerState() {Close();};
@@ -59,7 +59,7 @@ class HttpsMethod : public ServerMethod
    // minimum speed in bytes/se that triggers download timeout handling
    static const int DL_MIN_SPEED = 10;
 
-   virtual bool Fetch(FetchItem *);
+   virtual bool Fetch(FetchItem *) APT_OVERRIDE;
 
    static size_t parse_header(void *buffer, size_t size, size_t nmemb, void *userp);
    static size_t write_data(void *buffer, size_t size, size_t nmemb, void *userp);
@@ -70,14 +70,14 @@ class HttpsMethod : public ServerMethod
    ServerState *Server;
 
    // Used by ServerMethods unused by https
-   virtual void SendReq(FetchItem *) { exit(42); }
-   virtual void RotateDNS() { exit(42); }
+   virtual void SendReq(FetchItem *) APT_OVERRIDE { exit(42); }
+   virtual void RotateDNS() APT_OVERRIDE { exit(42); }
 
    public:
    FileFd *File;
 
-   virtual bool Configuration(std::string Message);
-   virtual ServerState * CreateServerState(URI uri);
+   virtual bool Configuration(std::string Message) APT_OVERRIDE;
+   virtual ServerState * CreateServerState(URI uri) APT_OVERRIDE;
    using pkgAcqMethod::FetchResult;
    using pkgAcqMethod::FetchItem;
 
diff --git a/methods/mirror.h b/methods/mirror.h
index 6c0ce370e..425bea673 100644
--- a/methods/mirror.h
+++ b/methods/mirror.h
@@ -46,14 +46,14 @@ class MirrorMethod : public HttpMethod
    bool Clean(std::string dir);
    
    // we need to overwrite those to transform the url back
-   virtual void Fail(std::string Why, bool Transient = false);
-   virtual void URIStart(FetchResult &Res);
-   virtual void URIDone(FetchResult &Res,FetchResult *Alt = 0);
-   virtual bool Configuration(std::string Message);
+   virtual void Fail(std::string Why, bool Transient = false) APT_OVERRIDE;
+   virtual void URIStart(FetchResult &Res) APT_OVERRIDE;
+   virtual void URIDone(FetchResult &Res,FetchResult *Alt = 0) APT_OVERRIDE;
+   virtual bool Configuration(std::string Message) APT_OVERRIDE;
 
  public:
    MirrorMethod();
-   virtual bool Fetch(FetchItem *Itm);
+   virtual bool Fetch(FetchItem *Itm) APT_OVERRIDE;
 };
 
 
diff --git a/methods/rred.cc b/methods/rred.cc
index 54123ab9c..91b6dda22 100644
--- a/methods/rred.cc
+++ b/methods/rred.cc
@@ -558,7 +558,7 @@ class RredMethod : public pkgAcqMethod {
       }
 
    protected:
-      virtual bool URIAcquire(std::string const &Message, FetchItem *Itm) {
+      virtual bool URIAcquire(std::string const &Message, FetchItem *Itm) APT_OVERRIDE {
 	 Debug = _config->FindB("Debug::pkgAcquire::RRed", false);
 	 URI Get = Itm->Uri;
 	 std::string Path = Get.Host + Get.Path; // rred:/path - no host
@@ -671,7 +671,7 @@ class RredMethod : public pkgAcqMethod {
 	 return true;
       }
 
-      bool Configuration(std::string Message)
+      bool Configuration(std::string Message) APT_OVERRIDE
       {
 	 if (pkgAcqMethod::Configuration(Message) == false)
 	    return false;
diff --git a/methods/rsh.h b/methods/rsh.h
index dd259e744..34492971c 100644
--- a/methods/rsh.h
+++ b/methods/rsh.h
@@ -56,8 +56,8 @@ class RSHConn
 
 class RSHMethod : public pkgAcqMethod
 {
-   virtual bool Fetch(FetchItem *Itm);
-   virtual bool Configuration(std::string Message);
+   virtual bool Fetch(FetchItem *Itm) APT_OVERRIDE;
+   virtual bool Configuration(std::string Message) APT_OVERRIDE;
 
    RSHConn *Server;
 
diff --git a/methods/server.h b/methods/server.h
index 8d7d33ee6..f9f6e9071 100644
--- a/methods/server.h
+++ b/methods/server.h
@@ -106,7 +106,7 @@ struct ServerState
 class ServerMethod : public pkgAcqMethod
 {
    protected:
-   virtual bool Fetch(FetchItem *);
+   virtual bool Fetch(FetchItem *) APT_OVERRIDE;
 
    ServerState *Server;
    std::string NextURI;
@@ -146,7 +146,7 @@ class ServerMethod : public pkgAcqMethod
    static time_t FailTime;
    static APT_NORETURN void SigTerm(int);
 
-   virtual bool Configuration(std::string Message);
+   virtual bool Configuration(std::string Message) APT_OVERRIDE;
    virtual bool Flush() { return Server->Flush(File); };
 
    int Loop();
diff --git a/test/interactive-helper/testdeb.cc b/test/interactive-helper/testdeb.cc
index 6aae9f563..69e1ffe0b 100644
--- a/test/interactive-helper/testdeb.cc
+++ b/test/interactive-helper/testdeb.cc
@@ -13,7 +13,7 @@
 class NullStream : public pkgDirStream
 {
    public:
-   virtual bool DoItem(Item &/*Itm*/, int &/*Fd*/) {return true;};
+   virtual bool DoItem(Item &/*Itm*/, int &/*Fd*/) APT_OVERRIDE {return true;};
 };
 
 static bool Test(const char *File)
diff --git a/test/libapt/acqprogress_test.cc b/test/libapt/acqprogress_test.cc
index dc31423fc..50792528d 100644
--- a/test/libapt/acqprogress_test.cc
+++ b/test/libapt/acqprogress_test.cc
@@ -13,8 +13,8 @@ class TestItem: public pkgAcquire::Item
 public:
    TestItem(pkgAcquire * const Acq) : pkgAcquire::Item(Acq) {}
 
-   virtual std::string DescURI() const { return ""; }
-   virtual HashStringList GetExpectedHashes() const { return HashStringList(); }
+   virtual std::string DescURI() const APT_OVERRIDE { return ""; }
+   virtual HashStringList GetExpectedHashes() const APT_OVERRIDE { return HashStringList(); }
 
 };
 
diff --git a/test/libapt/indexcopytosourcelist_test.cc b/test/libapt/indexcopytosourcelist_test.cc
index 1b0427564..2d07dba15 100644
--- a/test/libapt/indexcopytosourcelist_test.cc
+++ b/test/libapt/indexcopytosourcelist_test.cc
@@ -15,10 +15,10 @@ class NoCopy : public IndexCopy {
 	 IndexCopy::ConvertToSourceList(CD, Path);
 	 return Path;
       }
-      bool GetFile(std::string &/*Filename*/, unsigned long long &/*Size*/) { return false; }
-      bool RewriteEntry(FileFd & /*Target*/, std::string const &/*File*/) { return false; }
-      const char *GetFileName() { return NULL; }
-      const char *Type() { return NULL; }
+      bool GetFile(std::string &/*Filename*/, unsigned long long &/*Size*/) APT_OVERRIDE { return false; }
+      bool RewriteEntry(FileFd & /*Target*/, std::string const &/*File*/) APT_OVERRIDE { return false; }
+      const char *GetFileName() APT_OVERRIDE { return NULL; }
+      const char *Type() APT_OVERRIDE { return NULL; }
 
 };
 
-- 
cgit v1.2.3-70-g09d2


From c7872a2c857bc54febb09721f5256786a15c002d Mon Sep 17 00:00:00 2001
From: Daniel Hartwig <mandyke@gmail.com>
Date: Tue, 11 Aug 2015 17:59:13 +0200
Subject: support setting a port for rsh:// in sources.list

[Commiter comment: Untested, but looks and compiles fine, so what could
possibly go wrong]

Closes: 624727
---
 methods/rsh.cc | 22 ++++++++++++++++++++--
 methods/rsh.h  |  1 +
 2 files changed, 21 insertions(+), 2 deletions(-)

(limited to 'methods')

diff --git a/methods/rsh.cc b/methods/rsh.cc
index 52349c61c..7ef2f7c7a 100644
--- a/methods/rsh.cc
+++ b/methods/rsh.cc
@@ -84,7 +84,7 @@ bool RSHConn::Open()
    if (Process != -1)
       return true;
 
-   if (Connect(ServerName.Host,ServerName.User) == false)
+   if (Connect(ServerName.Host,ServerName.Port,ServerName.User) == false)
       return false;
 
    return true;
@@ -93,8 +93,15 @@ bool RSHConn::Open()
 // RSHConn::Connect - Fire up rsh and connect				/*{{{*/
 // ---------------------------------------------------------------------
 /* */
-bool RSHConn::Connect(std::string Host, std::string User)
+bool RSHConn::Connect(std::string Host, unsigned int Port, std::string User)
 {
+   char *PortStr = NULL;
+   if (Port != 0)
+   {
+      if (asprintf (&PortStr, "%d", Port) == -1 || PortStr == NULL)
+         return _error->Errno("asprintf", _("Failed"));
+   }
+
    // Create the pipes
    int Pipes[4] = {-1,-1,-1,-1};
    if (pipe(Pipes) != 0 || pipe(Pipes+2) != 0)
@@ -140,6 +147,10 @@ bool RSHConn::Connect(std::string Host, std::string User)
          Args[i++] = "-l";
 	 Args[i++] = User.c_str();
       }
+      if (PortStr != NULL) {
+         Args[i++] = "-p";
+         Args[i++] = PortStr;
+      }
       if (Host.empty() == false) {
          Args[i++] = Host.c_str();
       }
@@ -149,6 +160,9 @@ bool RSHConn::Connect(std::string Host, std::string User)
       exit(100);
    }
 
+   if (PortStr != NULL)
+      free(PortStr);
+
    ReadFd = Pipes[0];
    WriteFd = Pipes[3];
    SetNonBlock(Pipes[0],true);
@@ -157,6 +171,10 @@ bool RSHConn::Connect(std::string Host, std::string User)
    close(Pipes[2]);
    
    return true;
+}
+bool RSHConn::Connect(std::string Host, std::string User)
+{
+   return Connect(Host, 0, User);
 }
 									/*}}}*/
 // RSHConn::ReadLine - Very simple buffered read with timeout		/*{{{*/
diff --git a/methods/rsh.h b/methods/rsh.h
index 34492971c..e6839711b 100644
--- a/methods/rsh.h
+++ b/methods/rsh.h
@@ -36,6 +36,7 @@ class RSHConn
    // Raw connection IO
    bool WriteMsg(std::string &Text,bool Sync,const char *Fmt,...);
    bool Connect(std::string Host, std::string User);
+   bool Connect(std::string Host, unsigned int Port, std::string User);
    bool Comp(URI Other) const {return Other.Host == ServerName.Host && Other.Port == ServerName.Port;};
 
    // Connection control
-- 
cgit v1.2.3-70-g09d2


From f8043f219f077b1cfc6c5ad2263c4caa4709a00d Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@debian.org>
Date: Fri, 14 Aug 2015 19:44:25 +0200
Subject: Make apt compile with clang++ again

This allows us to run the clang static analyzer and to run the
testsuite with the clang MemorySanitizer.
---
 apt-pkg/aptconfiguration.cc | 2 +-
 apt-pkg/srcrecords.cc       | 2 +-
 methods/ftp.cc              | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

(limited to 'methods')

diff --git a/apt-pkg/aptconfiguration.cc b/apt-pkg/aptconfiguration.cc
index 01b85a74e..7e20a7d61 100644
--- a/apt-pkg/aptconfiguration.cc
+++ b/apt-pkg/aptconfiguration.cc
@@ -222,7 +222,7 @@ std::vector<std::string> const Configuration::getLanguages(bool const &All,
 	// get the environment language codes: LC_MESSAGES (and later LANGUAGE)
 	// we extract both, a long and a short code and then we will
 	// check if we actually need both (rare) or if the short is enough
-	string const envMsg = string(Locale == 0 ? std::setlocale(LC_MESSAGES, NULL) : *Locale);
+	string const envMsg = string(Locale == 0 ? ::setlocale(LC_MESSAGES, NULL) : *Locale);
 	size_t const lenShort = (envMsg.find('_') != string::npos) ? envMsg.find('_') : 2;
 	size_t const lenLong = (envMsg.find_first_of(".@") != string::npos) ? envMsg.find_first_of(".@") : (lenShort + 3);
 
diff --git a/apt-pkg/srcrecords.cc b/apt-pkg/srcrecords.cc
index e3ffa9ab0..942f11569 100644
--- a/apt-pkg/srcrecords.cc
+++ b/apt-pkg/srcrecords.cc
@@ -31,7 +31,7 @@
 // SrcRecords::pkgSrcRecords - Constructor				/*{{{*/
 // ---------------------------------------------------------------------
 /* Open all the source index files */
-pkgSrcRecords::pkgSrcRecords(pkgSourceList &List) : d(NULL), Files(0), Current(0)
+pkgSrcRecords::pkgSrcRecords(pkgSourceList &List) : d(NULL), Files(0)
 {
    for (pkgSourceList::const_iterator I = List.begin(); I != List.end(); ++I)
    {
diff --git a/methods/ftp.cc b/methods/ftp.cc
index 5fee20f23..1a9a1c4eb 100644
--- a/methods/ftp.cc
+++ b/methods/ftp.cc
@@ -745,7 +745,7 @@ bool FTPConn::CreateDataFd()
    }
    
    // Bind and listen
-   if (bind(DataListenFd,BindAddr->ai_addr,BindAddr->ai_addrlen) < 0)
+   if (::bind(DataListenFd,BindAddr->ai_addr,BindAddr->ai_addrlen) < 0)
    {
       freeaddrinfo(BindAddr);
       return _error->Errno("bind",_("Could not bind a socket"));
-- 
cgit v1.2.3-70-g09d2