summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-07-12Switch from /org to /srv in example apt-ftparchive configurationPaul Wise
/org has been obsoleted by /srv for many years on debian.org hosts.
2017-07-12Fix some more crashes when APT::Periodic options are set to alwaysPaul Wise
Gbp-Dch: ignore
2017-07-12Support seconds, minutes, hours and days for APT::Periodic intervalsPaul Wise
2017-07-12Support zero delay for the various APT::Periodic activitiesPaul Wise
[squashed:] apt.systemd.daily: check_stamp: check for 'always' before numerical values Prevents a crash when the configuration actually uses 'always': apt.systemd.daily: 402: [: Illegal number: always
2017-07-12Merge branch 'misc/include-cleanup'Julian Andres Klode
This should make it easier to read includes.
2017-07-12Update gitignore with new filesJulian Andres Klode
2017-07-12cacheiterators: Warn about direct include and don't include pkgcache.hJulian Andres Klode
This adds a warning so existing working code will still work (as it includes pkgcache.h first anyway), but it will know that it's not right to include this file directly.
2017-07-12Reformat and sort all includes with clang-formatJulian Andres Klode
This makes it easier to see which headers includes what. The changes were done by running git grep -l '#\s*include' \ | grep -E '.(cc|h)$' \ | xargs sed -i -E 's/(^\s*)#(\s*)include/\1#\2 include/' To modify all include lines by adding a space, and then running ./git-clang-format.sh.
2017-07-12methods/aptmethod.h: Add missing fileutl.h includeJulian Andres Klode
2017-07-12Drop cacheiterators.h includeJulian Andres Klode
Including cacheiterators.h before pkgcache.h fails because pkgcache.h depends on cacheiterators.h.
2017-07-12Handle supported components with slashes in sources.listApollon Oikonomopoulos
Commit d7c92411dc1f4c6be098d1425f9c1c075e0c2154 parses the Components section of (In)Release and attempts to detect the distribution's supported components. While doing so, it handles component names with slashes in a special manner, assuming that the actual component is only the part after the final slash. This is done to handle security.debian.org, which usually appears in sources.list as follows: deb http://s.d.o/debian-security stretch/updates main contrib non-free while the actual release file has: Codename: stretch Components: updates/main updates/contrib updates/non-free While this special handing on APTs part indeed works for debian-security, it emits spurious warnings on repositories that actually use slashes in the component names *and* appear so in sources.list. We fix this by adding both component versions (whole and final part) to the SupportedComponents array. Closes: #868127
2017-07-08fix various typos reported by codespell & spellintianDavid Kalnischkies
Reported-By: codespell & spellintian Gbp-Dch: Ignore
2017-07-08Italian manpage translation updateBeatrice Torracca
Closes: 858877
2017-07-07don't expect more downloads from failed transactionsDavid Kalnischkies
Progress only shows if we have an idea of how much files we will acquire, but if a transaction fails before we have got an idea we ended up never showing progress even through we know that a failed transaction will not download additional files.
2017-07-04zh_CN.po: update Simplified Chinese programs translationZhou Mo
2017-07-03Release 1.5~beta11.5_beta1Julian Andres Klode
2017-07-03Russian translation updateАлексей Шилин
2017-07-03Stop bragging about old speeds in http.cc commentsJulian Andres Klode
That's just ridiculous these days. Gbp-Dch: ignore
2017-07-03formatter: support running from subdirectoriesDavid Kalnischkies
Gbp-Dch: Ignore
2017-07-03don't set ip addresses as server names for SNIDavid Kalnischkies
It is kinda unlikely that apt will ever encounter a certificate for an IP and a user actually using it, but the API documentation for gnutls_server_name_set explicitly says that "IPv4 or IPv6 addresses are not permitted to be set by this function.", so we should follow it. [jak@d.o: Slightly rebased]
2017-07-03Swap file descriptors before the handshakeJulian Andres Klode
This makes more sense. If the handshake failed midway, we still should run the gnutls bye stuff. The thinking here is to only set the fd after the session setup, as we do not modify it before, so if it fails in session setup, you retain a usable file descriptor. Gbp-Dch: ignore
2017-07-03Do not error out, only warn if ca certificates are not availableJulian Andres Klode
This probably makes more sense if Verify-Peer is set to off.
2017-07-03tls: Add more details to error messages, and detect more errorsJulian Andres Klode
This should make it easier to figure out what was going on.
2017-07-02travis/docker: Various improvementsJulian Andres Klode
- Use a tmpfs for /tmp - not really a benefit here, except for travis as it's writing less now. - Use the fastly CDN - about twice as fast as ftp.de, and seems more stable than cloudfront - Run apt-get clean to keep container smaller - should not be needed really, but let's just do it. Gbp-Dch: ignore
2017-07-01Ignore download order in test-apt-update-failure-propagationJulian Andres Klode
This caused spurious test failures.
2017-07-01http: A response with Content-Length: 0 has no contentJulian Andres Klode
APT considered any response with a Content-Length to have a body, even if the value of the header was 0. A 0 length body however, is equal to no body.
2017-07-01Make Verify-Host and Verify-Peer independent againJulian Andres Klode
We can actually just pass null as a hostname, so let's just do that when Verify-Host is set to false.
2017-06-30Upload 1.5~alpha4 to experimental1.5_alpha4Julian Andres Klode
2017-06-30shippable: Run tests in parallelJulian Andres Klode
Gbp-Dch: ignore
2017-06-30CMake: Do not allow FORCE_CURL=ON with WITH_CURL=OFFJulian Andres Klode
This makes no sense. We need both entries in the cache, as we check FORCE_CURL in the test suite. Gbp-Dch: ignore
2017-06-30TLS support: Error out on unsupported curl optionsJulian Andres Klode
Silently ignoring the options might be a security issue, so produce an error instead.
2017-06-30Improve closing the TLS connectionJulian Andres Klode
If gnutls_session_bye() exited with an error, we never closed the underlying file descriptor, causing the method to think the connection was still open. This caused problems especially in test-partial-file-support where we checked that a "complete" file and an incomplete file work. The first GET returns a 416 with Connection: close, and the next GET request then accidentally reads the body of the 416 as the header for its own request.
2017-06-30Switch to 'http' as the default https methodJulian Andres Klode
The old curl based method is still available as 'curl', 'curl+http', and 'curl+https'.
2017-06-30travis: Switch to DockerJulian Andres Klode
This runs parallel builds on docker, based on debian:testing docker images, with ccache enabled and parallel running of the test suite (ccache supports coverage builds these days, and parallel testing just needs unbuffer to handle the stty stuff) This is a huge step up from building on a mix of trusty, wily, and xenial. Most importantly, coverage now correctly detects partial covered lines instead of just reporting almost all of them as fully covered. We use ftp.de.debian.org as deb.debian.org backed by Amazon 503s too often. Gbp-Dch: ignore
2017-06-30Allow http(s) and socks5h for http and https in proxy auto detectJulian Andres Klode
This makes it possible to write sensible auto detect scripts.
2017-06-30http: Add support for https:// proxiesJulian Andres Klode
HTTPS proxies just require unwrapping the TLS layer at the proxy connection, that's easy, and of course sending proxy-specific headers that are sent on "http" proxies.
2017-06-30http: Add support for CONNECT proxying to HTTPS locationsJulian Andres Klode
Proxying HTTPS traffic requires the proxy providing the CONNECT method. This implements the client side of it, although it is a bit hacky. HTTP connect is a normal HTTP CONNECT request, followed by a normal HTTP response, just that the body of the response is the TCP stream of the target host. We use a special wrapper in case there are data bytes in the header packets - in that case, the bytes are stored in a buffer and the buffer will be drained first, afterwards the connection continues directly with the TCP stream (with one more vcall). Also: Do not send full URI to https destinations when proxying, as we are directly interfacing with the destination data stream.
2017-06-30Allow running the TLS stack on any lower connectionJulian Andres Klode
This is especially needed if we use an HTTPS proxy to CONNECT to an HTTPS URI, as we run TLS-inside-TLS then.
2017-06-30Reset failure reason when connection was successfulJulian Andres Klode
When APT was trying multiple addresses, any later error somewhere else would be reported with ConnectionRefused or ConnectionTimedOut as the FailReason because that was set by early connect attempts. This causes APT to handle the failures differently, leading to some weirdly breaking test cases (like the changed one). Add debugging to the previously failing test case so we can find out when something goes wrong there again.
2017-06-30Upload 1.5~alpha3 to experimental1.5_alpha3Julian Andres Klode
2017-06-30Don't read CaInfo if not specified (missing else)Julian Andres Klode
This fixes a regression from ~alpha2. Closes: #866559 Gbp-Dch: Full
2017-06-29Upload 1.5~alpha2 to experimental1.5_alpha2Julian Andres Klode
2017-06-29Build-Depend on debhelper (>= 10) to shut up lintianJulian Andres Klode
2017-06-29Bump Standards-Version (and wrap-and-sort a bit)Julian Andres Klode
2017-06-29http: Only use system CA store if CaInfo is not setJulian Andres Klode
It turns out that curl only sets the system trust store if the CaInfo option is not set, so let's do the same here.
2017-06-29Demote gnupg to SuggestsJulian Andres Klode
stretch was the migration release for gpg->gpgv basically, so let's demote it now.
2017-06-29Have apt Recommend ca-certificatesJulian Andres Klode
The http method needs ca-certificates for TLS support, so enable it.
2017-06-29Improve error message if system CA store is emptyJulian Andres Klode
Tell the user to install ca-certificates. Closes: #866377
2017-06-29fix a "critical" typo in old changelog entryRobert Luberda
This typo exposes a bug in apt-listchanges that prevents commands like `apt-listchanges --show-all apt_*.deb' from showing the changelog. The bug will be fixed in next upload of apt-listchanges, but I think it would be nice have the typo fixed as well. Closes: 866358
2017-06-29use port from SRV record instead of initial portDavid Kalnischkies
An SRV record includes a portnumber to use with the host given, but apt was ignoring the portnumber and instead used either the port given by the user for the initial host or the default port for the service. In practice the service usually runs on another host on the default port, so it tends to work as intended and even if not and apt can't get a connection there it will gracefully fallback to contacting the initial host with the right port, so its a user invisible bug most of the time.