summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-02-08Fix crashes in apt search, cache fileJulian Andres Klode
When BuildDepCaches() is called before BuildCaches() we end up with dereferencing a null pointer cache in the depcache constructor. Furthermore, in private-search, we check that Cache == NULL, but only after constructing the policy and records, which does not work reliably, because the records construction accesses the cache as well. LP: #1815187 Test-Case: ./build/bin/apt search -o RootDir=/dev/null foo
2019-01-18Release 1.0.1ubuntu2.19Julian Andres Klode
2019-01-18SECURITY UPDATE: content injection in http method (CVE-2019-3462)Julian Andres Klode
This fixes a security issue that can be exploited to inject arbritrary debs or other files into a signed repository as followed: (1) Server sends a redirect to somewhere%0a<headers for the apt method> (where %0a is \n encoded) (2) apt method decodes the redirect (because the method encodes the URLs before sending them out), writting something like somewhere\n <headers> into its output (3) apt then uses the headers injected for validation purposes. Our test webserver does not support the necessary bits in this version that we used in newer versions, so no testing script is provided. Regression-Of: c34ea12ad509cb34c954ed574a301c3cbede55ec LP: #1812353
2019-01-18Import Debian version 1.0.1ubuntu2.18Julian Andres Klode
apt (1.0.1ubuntu2.18) trusty; urgency=medium * ExecFork: Use /proc/self/fd to determine which files to close (Closes: #764204) (LP: #1332440). apt (1.0.1ubuntu2.17) trusty-security; urgency=high * SECURITY UPDATE: gpgv: Check for errors when splitting files (CVE-2016-1252) Thanks to Jann Horn, Google Project Zero for reporting the issue (LP: #1647467) apt (1.0.1ubuntu2.15) trusty; urgency=medium * Fixes failure to download the Package index file when using mirror:// URL in sources.list and the archive fails to profile a file. APT would try the next archive in the list for .deb packages but did not retry when the index file failed to download. (LP: #1625667) apt (1.0.1ubuntu2.14) trusty; urgency=medium * When using the https transport mechanism, $no_proxy is ignored if apt is getting it's proxy information from $https_proxy (as opposed to Acquire::https::Proxy somewhere in apt config). If the source of proxy information is Acquire::https::Proxy set in apt.conf (or apt.conf.d), then $no_proxy is honored. This patch makes the behavior similar for both methods of setting the proxy. (LP: #1575877) apt (1.0.1ubuntu2.13) trusty; urgency=medium * Recheck Pre-Depends satisfaction in SmartConfigure, to avoid unconfigured Pre-Depends (which dpkg later fails on). Fixes upgrade failures of systemd, util-linux, and other packages with Pre-Depends. Many thanks to David Kalnischkies for figuring out the patch and Winfried PLappert for testing! Patch taken from Debian git. (LP: #1560797) apt (1.0.1ubuntu2.12) trusty; urgency=medium [ Colin Watson ] * Fix lzma write support to handle "try again" case (closes: #751688, LP: #1553770). [ David Kalnischkies ] * Handle moved mmap after UniqFindTagWrite call (closes: #753941, LP: #1445436). apt (1.0.1ubuntu2.11) trusty; urgency=medium * apt-pkg/packagemanager.cc: - fix incorrect configure ordering in the SmartConfigure step by skipping packages that do not need immediate action. (LP: #1347721, #1497688) apt (1.0.1ubuntu2.10) trusty; urgency=medium * Fix regression from the previous upload by ensuring we're actually testing for the right member before iterating on it (LP: #1480592) apt (1.0.1ubuntu2.9) trusty; urgency=medium * Fix regression in the Never-MarkAuto-Sections feature caused by the previous auto-removal fix, with inspiration drawn from the patches and conversation from http://bugs.debian.org/793360 (LP: #1479207) apt (1.0.1ubuntu2.8) trusty-proposed; urgency=low * fix crash for packages that have no section in their instVersion (LP: #1449394) apt (1.0.1ubuntu2.7) trusty-proposed; urgency=low * fix auto-removal behavior (thanks to Adam Conrad) LP: #1429041 apt (1.0.1ubuntu2.6) trusty-proposed; urgency=medium * apt-pkg/deb/dpkgpm.cc: - update string matching for dpkg I/O errors. (LP: #1363257) - properly parse the dpkg status line so that package name is properly set and an apport report is created. Thanks to Anders Kaseorg for the patch. (LP: #1353171) apt (1.0.1ubuntu2.5) trusty-security; urgency=low * SECURITY UPDATE: - cmdline/apt-get.cc: fix insecure tempfile handling in apt-get changelog (CVE-2014-7206). Thanks to Guillem Jover apt (1.0.1ubuntu2.4.1) trusty-security; urgency=low * SECURITY UPDATE: - fix potential buffer overflow, thanks to the Google Security Team (CVE-2014-6273) * Fix regression from the previous upload when file:/// sources are used and those are on a different partition than the apt state directory * Fix regression when Dir::state::lists is set to a relative path * Fix regression when cdrom: sources got rewriten by apt-cdrom add apt (1.0.1ubuntu2.3) trusty-security; urgency=low * SECURITY UPDATE: - incorrect invalidating of unauthenticated data (CVE-2014-0488) - incorect verification of 304 reply (CVE-2014-0487) - incorrect verification of Acquire::Gzip indexes (CVE-2014-0489)
2014-06-18releasing package apt version 1.0.1ubuntu2.2Michael Vogt
2014-06-18Fix permission of test/integration/test-apt-get-source-authenticatedMichael Vogt
2014-06-18merge upload 1.0.1ubuntu2.1Michael Vogt
2014-06-12update changelogMichael Vogt
2014-06-12fix tests and add db-util to the test dependenciesMichael Vogt
Conflicts: .travis.yml
2014-06-12(try to) fix travis-ci build failuresDavid Kalnischkies
dpkg on Ubuntu 12.04 does not seem to support parsing arch-specific dependencies, so we try to detect if we face such a dpkg in the test. In the other test the order depends on libdb, which changes per arch, so we just run it through our sorting binary and be happy (hopefully). Git-Dch: Ignore
2014-06-12add an additional test for arch specific conflictsDavid Kalnischkies
In bugreport #747261 I confirmed with this testcase that apt actually supports the requested architecture-specific conflicts already since 2012 with commit cef094c2ec8214b2783a2ac3aa70cf835381eae1. The old test only does simulations which are handy to check apt, this one builds 'real' packages to see if dpkg agrees with us. Git-Dch: Ignore
2014-06-12Add compat mode for old (32bit FileSize) CacheDB (LP: #1274466)Michael Vogt
2014-06-12Merge remote-tracking branch 'mvo/feature/apt-ftparchive-srccache2' into ↵Michael Vogt
ubuntu/trusty
2014-06-12Only do openpty() if both stdin/stdout are terminalsMichael Vogt
Closes: 746434
2014-06-12unset LANGUAGE in the testing framework directlyDavid Kalnischkies
Git-Dch: Ignore Conflicts: test/integration/framework
2014-06-12Merge tag '1.0.1ubuntu2' into ubuntu/trustyMichael Vogt
Conflicts: configure.ac debian/changelog debian/control test/integration/framework
2014-05-08fix regression from commit 215b0fafMichael Vogt
2014-04-10prepare new upload1.0.1ubuntu2Michael Vogt
2014-04-10Merge branch 'debian/sid' into ubuntu/masterMichael Vogt
2014-04-10fix test-failure in adtMichael Vogt
2014-04-10Merge remote-tracking branch 'origin/debian/sid' into ubuntu/master1.0.1ubuntu1Michael Vogt
Conflicts: debian/changelog
2014-04-10prepare 1.0.1 release1.0.1Michael Vogt
2014-04-10Merge branch 'debian/sid' into ubuntu/masterMichael Vogt
2014-04-10apt: Minor typo in 'apt' man page (closes: #743657)Josef Vitu
2014-04-10Merge remote-tracking branch 'mvo/bugfix/lp1304657-perms' into debian/sidMichael Vogt
2014-04-10Merge remote-tracking branch 'mvo/bugfix/apt-search-case' into debian/sidMichael Vogt
2014-04-10improve umask/fchmod code readabilityMichael Vogt
2014-04-10Rename FileFd::Open() Perms to AccessModeMichael Vogt
Bug lp:#1304657 was caused by confusion around the name Perms. The new name AccessMode should make it clear that its not the literal file permissions but instead the AccessMode passed to open() (i.e. the umask needs to be applied)
2014-04-10Fix insecure file permissions when using FileFd with OpenMode::AtomicMichael Vogt
Commit 7335eebea6dd43581d4650a8818b06383ab89901 introduced a bug that caused FileFd to create insecure permissions when FileFd::Atomic is used. This commit fixes the permissions and adds a test. The bug is most likely caused by the confusing "Perm" parameter that is passed to Open() - its not the file permissions but intead the "mode" part of open/creat.
2014-04-09Fix possible race when stunnel/aptwebserver create their PID filesMichael Vogt
This patch should fix spurious test failures in jenkins or travis that are caused by a race condition in the {stunnel,aptwebserver}.pid file creation
2014-04-08Merge branch 'bugfix/apt-search-case' into debian/sidMichael Vogt
2014-04-07make apt search case-insensitive by defaultMichael Vogt
2014-04-07Add versioned openjdk-6-jdk breaksJulian Andres Klode
This helps if people did unclean upgrades from squeeze, namely to jessie directly.
2014-04-07Version the Breaks/Replaces for sun-java{5,6}-jdk (LP: #1302736)Julian Andres Klode
This is a *hack* to work around unofficial packages for Java 7 and 8 that wrongly provide the Java 5 and 6 packages. Closes: #743616
2014-04-07ensure "--db" also works with the new srcpkgdbMichael Vogt
2014-04-04refactor _InitQuery()Michael Vogt
2014-04-04ensure clean worksMichael Vogt
2014-04-04refactor to make OpenFile/OpenDebFile more robustMichael Vogt
2014-04-04add test for binary cachedb and contents generationMichael Vogt
2014-04-04Implement CacheDB for source packages in apt-ftparchiveMichael Vogt
2014-04-04Fix crash in "apt list" when a sources.list file is unreableMichael Vogt
Closes: 743413
2014-04-04releasing package apt version 0.9.15.4ubuntu4Michael Vogt
2014-04-04prepare 0.9.15.4ubuntu3Michael Vogt
2014-04-04Promote xz-utils from apt Suggests to libapt-pkg DependsJulian Andres Klode
libapt-pkg depends on the other compressors, and now that xz is the default in many cases, it should depend on that one as well.
2014-04-04show debug output only if told so in packagemanagerDavid Kalnischkies
Git-Dch: Ignore
2014-04-04do not configure already unpacked packages needlesslyDavid Kalnischkies
The unpack of a M-A:same package will force the unpack of all its siblings directly to prevent that they could be separated by later immediate actions. In commit 634985f8 a call to SmartConfigure was introduced to configure these packages at the time the installation order encounters them. Usually, the unpack order is already okay, so that this 'earlier' unpack was not needed and if it wouldn't have been done, the package would now only be unpacked, but by configuring the package now we impose new requirements which must be satisfied. The code is clever enough to handle this most of the time (it worked for 2 years!), but it isn't needed and in very coupled cases this can fail. Removing this call again removes this extra burden and so simplifies the ordering as can be seen in the modified tests. Famous last words, but I don't see a reason for this extra burden to exist hence the remove. Closes: 740843
2014-04-04cmdline parsing: apt-config is not apt-cdromDavid Kalnischkies
2014-04-04use the pretty fullname of a pkg as download desciptionDavid Kalnischkies
Otherwise the "WARNING: The following packages cannot be authenticated!" messages does not include the architecture of the package, so it would be slightly misinformative.
2014-04-04apt-inst: Do not try to create a substring of an empty string in error reportingJulian Andres Klode
One of our compressors (the empty one) has an empty extension. Calling substr on it fails.
2014-04-04ensure proper teardown in dpkg error casesDavid Kalnischkies
We have to properly close our pseudo terminals even in error cases before we call post-invoke scripts. This is done now by breaking from the dpkg calling loop instead of copying the handling, which did it in the wrong order before. This also ensures that our state file is written in error cases to record autobit and co as this was forgotten before. Closes: 738969
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-08 02:19:26 +0000