| Age | Commit message (Collapse) | Author |
|---|
|
This fixes a security issue that can be exploited to inject arbritrary debs
or other files into a signed repository as followed:
(1) Server sends a redirect to somewhere%0a<headers for the apt method> (where %0a is
\n encoded)
(2) apt method decodes the redirect (because the method encodes the URLs before
sending them out), writting something like
somewhere\n
<headers>
into its output
(3) apt then uses the headers injected for validation purposes.
Regression-Of: c34ea12ad509cb34c954ed574a301c3cbede55ec
LP: #1812353
(cherry picked from commit 5eb01ec13f3ede4bae5e60eb16bd8cffb7c03e1b)
|
|
|
|
Set PATH=/usr/sbin:/usr/bin:/sbin:/bin when running dpkg
See merge request apt-team/apt!38
|
|
This avoids a lot of problems from local installations of
scripting languages and other stuff in /usr/local for which
maintainer scripts are not prepared.
[v3: Inherit PATH during tests, check overrides work]
[v2: Add testing]
|
|
Add support for /etc/apt/auth.conf.d/*.conf (netrcparts)
See merge request apt-team/apt!37
|
|
This allows us to install matching auth files for sources.list.d
files, for example; very useful.
This converts aptmethod's authfd from one FileFd to a vector of
pointers to FileFd, as FileFd cannot be copied, and move operators
are hard.
|
|
FileFd could be copied using the default copy constructor,
which does not work, and then causes code to crash.
|
|
Use quoted tagnames in config dumps
See merge request apt-team/apt!32
|
|
Remove old derivatives
See merge request apt-team/apt!31
|
|
[l10n] Update Italian translation
See merge request apt-team/apt!35
|
|
Set LC_ALL=C.UTF-8 for unattended-upgrades environment when parsing its --help
See merge request apt-team/apt!34
|
|
Signed-off-by: Milo Casagrande <milo@milo.name>
|
|
This adds a new "autopurge" command that will is a shortcut for
"autoremove --purge"
Thanks: Michael Vogt for the initial work
|
|
Try 10 times in a row
|
|
.UTF-8 sets stdio encoding to UTF-8 which may be ASCII on the system making
unattended-upgrades crash.
LP: #1806076
|
|
Tagnames in configuration can include spaces (and other nasties) e.g. in
repository-specific configuration options due to Origin/Label
potentially containing a space. The configuration file format supports
parsing quoted as well as encoded spaces, but the output generated by
apt-config and other places which might be feedback into apt via
parsing (e.g. before calling apt-key in our gpgv method) do not quote
and hence produce invalid configuration files.
Changing the default to be an encoded tagname ensures that the output of
dump can be used as a config file, but other users might not expect
this so that is technically a backward-breaking change.
|
|
No user visible change expect for some years old changelog entries,
so we don't really need to add a new one for this…
Reported-By: codespell
Gbp-Dch: Ignore
|
|
Reviewed-By: Debian L10n Russian <debian-l10n-russian@lists.debian.org>
Closes: #914096
|
|
The filename can be overridden, but sometimes it is useful to do it only
for the directory-part of the filename – e.g. if you want to let a flat
archive directory (like /var/cache/apt/archives) serve a pool-based
request like /pool/a/apt_version.deb.
Gbp-Dch: Ignore
|
|
Not needed for common interactions, but for some download-file
interactions it could be useful to set a specific referer as some
servers do not serve requested files otherwise.
|
|
We sometimes autogenerate HTML pages e.g. for listing files in a
directory or for various error codes. If this would be a serious
webserver this would be a security problem (althrough a bit hard to
exploit), but as it is not shipped and intended to be used by our
testcases only the world hasn't ended & we can ignore it for
changelog and fix it for brownie points.
Gbp-Dch: Ignore
|
|
Browsing pages served via aptwebserver is working better if we tell the
browser the Content-Type which for this simple usecase we can just do by
guessing based on the file extension – and because hardcoding a list
would be boring we just reuse the mime.types data from mime-support if
available and allow it to be overridden by files and config.
Gbp-Dch: Ignore
|
|
Fixes Debian/apt#77
|
|
The << 0.8.11 was stronger than necessary, and breaks Ubuntu,
which is unable to build aptitude 0.8.11 atm (the test suite
fails since 0.8.10 in C++17 mode, only works in C++14, but
0.8.11 uses C++17 constructs).
|
|
|
|
|
|
This reverts commit fb3f36593563d09a8d1727cc7c6deb0b49823ca2. It
caused downloads to hang on long-lived connections on certain
servers.
Gbp-Dch: full
|
|
|
|
If the server closed the connection while we're reading data, and
we end up not having any data left to write; that is, for example,
we received 0 bytes, then we did not exit before, as we only returned
success if there was data to write.
This is wrong: Obviously, if we have reached our limit, we are done
anyway. It's a bit unclear if we actually ever reached this part, but
it does make some sense wrt the bug below.
LP: #1801338
|
|
Closes: #912374
|
|
|
|
Reviewed-By: Helge Kreutzmann <debian@helgefjell.de>
|
|
Closes: #912022
|
|
Closes: #912021
|
|
This is an inactive derivative according to the census, and all the URLs which
are part of tanglu.org are dead.
|
|
This is an inactive derivative according to the census, and all the URLs which
are part of .ultimediaos.com are dead.
|
|
gcc 8 broke the ABI again. After they decided to switch mangling of ABI tags in return values from:
U URI::operator std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >[abi:cxx11]()
to:
U URI::operator std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >()
in gcc 7, they now removed the legacy symbol in gcc 8, causing us to break our ABI in turn
for that one operator. We need more responsible gcc developers.
Closes: #911090
|
|
This gives more protection for people where kernel metapackages
are accidentally removed.
LP: #1787460
|
|
Support subkeys and multiple keyrings in Signed-By options
See merge request apt-team/apt!27
|
|
apt-get.8: mention --only-source in 'source' and 'build-dep' description
See merge request apt-team/apt!24
|
|
Default to https: scheme for fetching Debian changelogs
See merge request apt-team/apt!30
|
|
Closes: #910941
|
|
|
|
Pass -i to git log, so "Release foo" is detected as well, not just
"release foo", and also handle the rename of Git-Dch to Gbp-Dch.
|
|
Some post-invoke scripts install packages, which fails because
the environment variable is not set. This sets the variable for
all three kinds of scripts {pre,post-}invoke and pre-install-pkgs,
but we will only allow post-invoke at a later time.
Gbp-Dch: full
|
|
See merge request apt-team/apt!29
[jak@d.o: Also adjust translations, provide better subject]
|
|
Including a block-element like informalexample in a para is legal, but
the documentation of the para tag hints that some processing systems may
have difficulties handling this – so lets just move it out of the block
and be happy as it is (again?) displayed.
Closes: #909712
|
|
pkgCacheFile's destructor unlocks the system, which is confusing
if you did not open the cachefile with WithLock set. Create a private
data instance that holds the value of WithLock.
This regression was introduced in commit b2e465d6d32d2dc884f58b94acb7e35f671a87fe:
Join with aliencode
Author: jgg
Date: 2001-02-20 07:03:16 GMT
Join with aliencode
by replacing a "Lock" member that was only initialized when the lock
was taken by calls to Lock, UnLock; with the latter also taking place
if the former did not occur.
Regression-Of: b2e465d6d32d2dc884f58b94acb7e35f671a87fe
LP: #1794053
|
|
A recent change to use chronos inadvertently replaced the
difference of new usec - old usec with new sec - old usec,
which is obviously wrong.
|
|
|
