summaryrefslogtreecommitdiff
path: root/cmdline
diff options
context:
space:
mode:
Diffstat (limited to 'cmdline')
-rw-r--r--cmdline/apt-get.cc61
-rwxr-xr-xcmdline/apt-key69
-rwxr-xr-xcmdline/apt-report-mirror-failure24
-rw-r--r--cmdline/makefile6
4 files changed, 130 insertions, 30 deletions
diff --git a/cmdline/apt-get.cc b/cmdline/apt-get.cc
index 258133c19..cabbde5cb 100644
--- a/cmdline/apt-get.cc
+++ b/cmdline/apt-get.cc
@@ -1495,21 +1495,29 @@ bool TryInstallTask(pkgDepCache &Cache, pkgProblemResolver &Fix,
bool found = false;
bool res = true;
- for (Pkg = Cache.PkgBegin(); Pkg.end() == false; Pkg++)
+
+ // two runs, first ignore dependencies, second install any missing
+ for(int IgnoreBroken=1; IgnoreBroken >= 0; IgnoreBroken--)
{
- pkgCache::VerIterator ver = Cache[Pkg].CandidateVerIter(Cache);
- if(ver.end())
- continue;
- pkgRecords::Parser &parser = Recs.Lookup(ver.FileList());
- parser.GetRec(start,end);
- strncpy(buf, start, end-start);
- buf[end-start] = 0x0;
- if (regexec(&Pattern,buf,0,0,0) != 0)
- continue;
- res &= TryToInstall(Pkg,Cache,Fix,Remove,true,ExpectedInst);
- found = true;
+ for (Pkg = Cache.PkgBegin(); Pkg.end() == false; Pkg++)
+ {
+ pkgCache::VerIterator ver = Cache[Pkg].CandidateVerIter(Cache);
+ if(ver.end())
+ continue;
+ pkgRecords::Parser &parser = Recs.Lookup(ver.FileList());
+ parser.GetRec(start,end);
+ strncpy(buf, start, end-start);
+ buf[end-start] = 0x0;
+ if (regexec(&Pattern,buf,0,0,0) != 0)
+ continue;
+ res &= TryToInstall(Pkg,Cache,Fix,Remove,IgnoreBroken,ExpectedInst);
+ found = true;
+ }
}
+ // now let the problem resolver deal with any issues
+ Fix.Resolve(true);
+
if(!found)
_error->Error(_("Couldn't find task %s"),taskname);
@@ -2086,6 +2094,33 @@ bool DoSource(CommandLine &CmdL)
if (Last == 0)
return _error->Error(_("Unable to find a source package for %s"),Src.c_str());
+ string srec = Last->AsStr();
+ string::size_type pos = srec.find("\nVcs-");
+ while (pos != string::npos)
+ {
+ pos += strlen("\nVcs-");
+ string vcs = srec.substr(pos,srec.find(":",pos)-pos);
+ if(vcs == "Browser")
+ {
+ pos = srec.find("\nVcs-", pos);
+ continue;
+ }
+ pos += vcs.length()+2;
+ string::size_type epos = srec.find("\n", pos);
+ string uri = srec.substr(pos,epos-pos).c_str();
+ ioprintf(c1out, _("NOTICE: '%s' packaging is maintained in "
+ "the '%s' version control system at:\n"
+ "%s\n"),
+ Src.c_str(), vcs.c_str(), uri.c_str());
+ if(vcs == "Bzr")
+ ioprintf(c1out,_("Please use:\n"
+ "bzr get %s\n"
+ "to retrieve the latest (possible unreleased) "
+ "updates to the package.\n"),
+ uri.c_str());
+ break;
+ }
+
// Back track
vector<pkgSrcRecords::File> Lst;
if (Last->Files(Lst) == false)
@@ -2635,7 +2670,7 @@ bool ShowHelp(CommandLine &CmdL)
" -d Download only - do NOT install or unpack archives\n"
" -s No-act. Perform ordering simulation\n"
" -y Assume Yes to all queries and do not prompt\n"
- " -f Attempt to continue if the integrity check fails\n"
+ " -f Attempt to correct a system with broken dependencies in place\n"
" -m Attempt to continue if archives are unlocatable\n"
" -u Show a list of upgraded packages as well\n"
" -b Build the source package after fetching it\n"
diff --git a/cmdline/apt-key b/cmdline/apt-key
index 048105320..de04d16da 100755
--- a/cmdline/apt-key
+++ b/cmdline/apt-key
@@ -9,10 +9,10 @@ GPG_CMD="gpg --ignore-time-conflict --no-options --no-default-keyring --secret-k
GPG="$GPG_CMD --keyring /etc/apt/trusted.gpg"
-MASTER_KEYRING=""
-#MASTER_KEYRING=/usr/share/keyrings/debian-master-keyring.gpg
-ARCHIVE_KEYRING=/usr/share/keyrings/debian-archive-keyring.gpg
-REMOVED_KEYS=/usr/share/keyrings/debian-archive-removed-keys.gpg
+MASTER_KEYRING=/usr/share/keyrings/ubuntu-master-keyring.gpg
+ARCHIVE_KEYRING=/usr/share/keyrings/ubuntu-archive-keyring.gpg
+REMOVED_KEYS=/usr/share/keyrings/ubuntu-archive-removed-keys.gpg
+ARCHIVE_KEYRING_URI=http://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg
add_keys_with_verify_against_master_keyring() {
ADD_KEYRING=$1
@@ -29,34 +29,65 @@ add_keys_with_verify_against_master_keyring() {
# when adding new keys, make sure that the archive-master-keyring
# is honored. so:
- # all keys that are exported and have the name
- # "Ubuntu Archive Automatic Signing Key" must have a valid signature
- # from a key in the ubuntu-master-keyring
+ # all keys that are exported must have a valid signature
+ # from a key in the $distro-master-keyring
add_keys=`$GPG_CMD --keyring $ADD_KEYRING --with-colons --list-keys | grep ^pub | cut -d: -f5`
master_keys=`$GPG_CMD --keyring $MASTER --with-colons --list-keys | grep ^pub | cut -d: -f5`
for add_key in $add_keys; do
+ ADDED=0
for master_key in $master_keys; do
- if $GPG --list-sigs --with-colons $add_key | grep ^sig | cut -d: -f5 | grep -q $master_key; then
- $GPG_CMD --quiet --batch --keyring $ARCHIVE_KEYRING --export $add_key | $GPG --import
+ if $GPG_CMD --keyring $ADD_KEYRING --list-sigs --with-colons $add_key | grep ^sig | cut -d: -f5 | grep -q $master_key; then
+ $GPG_CMD --quiet --batch --keyring $ADD_KEYRING --export $add_key | $GPG --import
+ ADDED=1
fi
done
+ if [ $ADDED = 0 ]; then
+ echo >&2 "Key '$add_key' not added. It is not signed with a master key"
+ fi
done
}
+# update the current archive signing keyring from a network URI
+# the archive-keyring keys needs to be signed with the master key
+# (otherwise it does not make sense from a security POV)
+net_update() {
+ if [ -z "$ARCHIVE_KEYRING_URI" ]; then
+ echo "ERROR: no location for the archive-keyring given"
+ fi
+ if [ ! -d /var/lib/apt/keyrings ]; then
+ mkdir -p /var/lib/apt/keyrings
+ fi
+ keyring=/var/lib/apt/keyrings/$(basename $ARCHIVE_KEYRING)
+ old_mtime=0
+ if [ -e $keyring ]; then
+ old_mtime=$(stat -c %Y $keyring)
+ fi
+ (cd /var/lib/apt/keyrings; wget -q -N $ARCHIVE_KEYRING_URI)
+ if [ ! -e $keyring ]; then
+ return
+ fi
+ new_mtime=$(stat -c %Y $keyring)
+ if [ $new_mtime -ne $old_mtime ]; then
+ echo "Checking for new archive signing keys now"
+ add_keys_with_verify_against_master_keyring $keyring $MASTER_KEYRING
+ fi
+}
+
update() {
if [ ! -f $ARCHIVE_KEYRING ]; then
echo >&2 "ERROR: Can't find the archive-keyring"
- echo >&2 "Is the debian-archive-keyring package installed?"
+ echo >&2 "Is the ubuntu-keyring package installed?"
exit 1
fi
- # add new keys, if no MASTER_KEYRING is used, use the traditional
- # way
- if [ -z "$MASTER_KEYRING" ]; then
- $GPG_CMD --quiet --batch --keyring $ARCHIVE_KEYRING --export | $GPG --import
- else
- add_keys_with_verify_against_master_keyring $ARCHIVE_KEYRING $MASTER_KEYRING
- fi
+ # add new keys from the package;
+
+ # we do not use add_keys_with_verify_against_master_keyring here,
+ # because we "update" is run on regular package updates. A
+ # attacker might as well replace the master-archive-keyring file
+ # in the package and add his own keys. so this check wouldn't
+ # add any security. we *need* this check on net-update though
+ $GPG_CMD --quiet --batch --keyring $ARCHIVE_KEYRING --export | $GPG --import
# remove no-longer supported/used keys
keys=`$GPG_CMD --keyring $REMOVED_KEYS --with-colons --list-keys | grep ^pub | cut -d: -f5`
@@ -78,6 +109,7 @@ usage() {
echo " apt-key export <keyid> - output the key <keyid>"
echo " apt-key exportall - output all trusted keys"
echo " apt-key update - update keys using the keyring package"
+ echo " apt-key net-update - update keys using the network"
echo " apt-key list - list keys"
echo
}
@@ -107,6 +139,9 @@ case "$command" in
update)
update
;;
+ net-update)
+ net_update
+ ;;
list)
$GPG --batch --list-keys
;;
diff --git a/cmdline/apt-report-mirror-failure b/cmdline/apt-report-mirror-failure
new file mode 100755
index 000000000..1567e78e3
--- /dev/null
+++ b/cmdline/apt-report-mirror-failure
@@ -0,0 +1,24 @@
+#!/usr/bin/python
+
+import sys
+import urllib
+import apt_pkg
+
+apt_pkg.init()
+url = apt_pkg.Config.Find("Acquire::Mirror::ReportFailures", None)
+ #"http://people.ubuntu.com:9000/mirror-failure")
+ #"http://localhost:9000/mirror-failure")
+if not url:
+ sys.exit(0)
+
+print "Reporting mirror failure to '%s'" % url
+
+data = {}
+data['mirror'] = sys.argv[1]
+data['failurl'] = sys.argv[2]
+data['error'] = sys.argv[3]
+f = urllib.urlopen(url, urllib.urlencode(data))
+f.read()
+f.close()
+
+
diff --git a/cmdline/makefile b/cmdline/makefile
index 5820c2e0f..c795921c1 100644
--- a/cmdline/makefile
+++ b/cmdline/makefile
@@ -58,3 +58,9 @@ SOURCE=apt-mark
TO=$(BIN)
TARGET=program
include $(COPY_H)
+
+# The apt-key program
+SOURCE=apt-report-mirror-failure
+TO=$(BIN)
+TARGET=program
+include $(COPY_H)
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-17 10:48:43 +0000