show a warning for Debian shutting down FTP services

We detect the effected sources by matching Release info – that has
potential by-catch of repositories which have incorrect field values,
but those are better fixed now anyhow. The bigger incorrectness is that
this message will not only be printed for the Debian services itself but
also for all mirrors not under Debian control but serving Debian like more
local/private mirrors which will not (directly) shutdown. It is likely
through that many of them will follow suite with less visible
announcements or break downright if their upstream source disappears, so
having false-positives here seems benefitial for the user in the end.

3 files changed, 62 insertions, 1 deletions

diff --git a/apt-private/private-update.cc b/apt-private/private-update.cc
index 8949dab30..f235a6191 100644
--- a/apt-private/private-update.cc
+++ b/apt-private/private-update.cc
@@ -8,6 +8,7 @@
 #include <apt-pkg/configuration.h>
 #include <apt-pkg/error.h>
 #include <apt-pkg/fileutl.h>
+#include <apt-pkg/metaindex.h>
 #include <apt-pkg/sourcelist.h>
 #include <apt-pkg/update.h>
 
@@ -79,6 +80,31 @@ bool DoUpdate(CommandLine &CmdL)
    if (Cache.BuildCaches(false) == false)
       return false;
 
+   if (_config->FindB("APT::Get::Update::SourceListWarnings", true))
+   {
+      List = Cache.GetSourceList();
+      for (pkgSourceList::const_iterator S = List->begin(); S != List->end(); ++S)
+      {
+	 if (APT::String::Startswith((*S)->GetURI(), "ftp://") == false)
+	    continue;
+	 pkgCache::RlsFileIterator const RlsFile = (*S)->FindInCache(Cache, false);
+	 if (RlsFile.end() || RlsFile->Origin == 0 || RlsFile->Label == 0)
+	    continue;
+	 char const *const affected[][2] = {
+	     {"Debian", "Debian"},
+	     {"Debian", "Debian-Security"},
+	     {"Debian Backports", "Debian Backports"},
+	 };
+	 auto const matchRelease = [&](decltype(affected[0]) a) {
+	    return strcmp(RlsFile.Origin(), a[0]) == 0 && strcmp(RlsFile.Label(), a[1]) == 0;
+	 };
+	 if (std::find_if(std::begin(affected), std::end(affected), matchRelease) != std::end(affected))
+	    _error->Warning("Debian shuts down public FTP services currently still used in your sources.list(5) as '%s'.\n"
+			    "See press release %s for details.",
+			    (*S)->GetURI().c_str(), "https://debian.org/News/2017/20170425");
+      }
+   }
+
    // show basic stats (if the user whishes)
    if (_config->FindB("APT::Cmd::Show-Update-Stats", false) == true)
    {
diff --git a/doc/examples/configure-index b/doc/examples/configure-index
index 244d7c1c3..61a749495 100644
--- a/doc/examples/configure-index
+++ b/doc/examples/configure-index
@@ -107,7 +107,11 @@ APT
      IndexTargets::ReleaseInfo "<BOOL>";
      IndexTargets::format "<STRING>";
 
-     Update::InteractiveReleaseInfoChanges "<BOOL>";
+     Update
+     {
+        InteractiveReleaseInfoChanges "<BOOL>";
+        SourceListWarnings "<BOOL>";
+     };
   };
 
   Cache
diff --git a/test/integration/test-apt-get-update-sourceslist-warning b/test/integration/test-apt-get-update-sourceslist-warning
new file mode 100755
index 000000000..b466e85eb
--- /dev/null
+++ b/test/integration/test-apt-get-update-sourceslist-warning
@@ -0,0 +1,31 @@
+#!/bin/sh
+set -e
+
+TESTDIR="$(readlink -f "$(dirname "$0")")"
+. "$TESTDIR/framework"
+
+setupenvironment
+configarchitecture 'amd64'
+setupaptarchive --no-update
+
+testsuccess apt update
+testsuccess apt update --no-download
+
+echo 'deb ftp://ftp.tlh.debian.org/debian zurg main' > rootdir/etc/apt/sources.list.d/ftpshutdown.list
+cat > rootdir/var/lib/apt/lists/ftp.tlh.debian.org_debian_dists_zurg_Release <<EOF
+Origin: Debian
+Label: Debian
+Suite: unreleased
+Codename: zurg
+Date: Fri, 14 Jul 2017 11:34:35 +0000
+Architectures: amd64
+Components: main
+Description: Debian x.y Zurg - Not Released
+EOF
+chmod 644 rootdir/var/lib/apt/lists/ftp.tlh.debian.org_debian_dists_zurg_Release
+
+testwarningequal "Reading package lists...
+Building dependency tree...
+All packages are up to date.
+W: Debian shuts down public FTP services currently still used in your sources.list(5) as 'ftp://ftp.tlh.debian.org/debian/'.
+   See press release https://debian.org/News/2017/20170425 for details." apt update --no-download