summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-08-31rred: truncate result file before writing to itDavid Kalnischkies
If another file in the transaction fails and hence dooms the transaction we can end in a situation in which a -patched file (= rred writes the result of the patching to it) remains in the partial/ directory. The next apt call will perform the rred patching again and write its result again to the -patched file, but instead of starting with an empty file as intended it will override the content previously in the file which has the same result if the new content happens to be longer than the old content, but if it isn't parts of the old content remain in the file which will pass verification as the new content written to it matches the hashes and if the entire transaction passes the file will be moved the lists/ directory where it might or might not trigger errors depending on if the old content which remained forms a valid file together with the new content. This has no real security implications as no untrusted data is involved: The old content consists of a base file which passed verification and a bunch of patches which all passed multiple verifications as well, so the old content isn't controllable by an attacker and the new one isn't either (as the new content alone passes verification). So the best an attacker can do is letting the user run into the same issue as in the report. Closes: #831762 (cherry picked from commit 0e071dfe205ad21d8b929b4bb8164b008dc7c474)
2016-08-31use proper warning for automatic pipeline disableDavid Kalnischkies
Also fixes message itself to mention the correct option name as noticed in #832113. (cherry picked from commit b9c20219dc17db1d29eaf297263a4b008bd1b90b)
2016-08-31verify hash of input file in rredDavid Kalnischkies
We read the entire input file we want to patch anyhow, so we can also calculate the hash for that file and compare it with what he had expected it to be. Note that this isn't really a security improvement as a) the file we patch is trusted & b) if the input is incorrect, the result will hardly be matching, so this is just for failing slightly earlier with a more relevant error message (althrough, in terms of rred its ignored and complete download attempt instead). (cherry picked from commit 6e71ec6fcdcaa926c98fa58cd4af38e42556df15)
2016-08-31call flush on the wrapped writebuffered FileFdDavid Kalnischkies
The flush call is a no-op in most FileFd implementations so this isn't as critical as it might sound as the only non-trivial implementation is in the buffered writer, which tends not be used to buffer another buffer… (cherry picked from commit 8ca481e8419c19b6ef9074b68cc028177a507161)
2016-08-31Turkish program translation updateMert Dirik
Closes: 832039 (cherry picked from commit a913e64ead6ada2adae6fb5f35212187ad5acd01)
2016-08-31Add kernels with "+" in the package name to APT::NeverAutoRemoveAndrew Patterson
Escape "+" in kernel package names when generating APT::NeverAutoRemove list so it is not treated as a regular expression meta-character. [Changed by David Kalnischkies: let test actually test the change] Closes: #830159 (cherry picked from commit 130176bcb6ce65c98d5692196c55cc18b4c210e0)
2016-08-31keep trying with next if connection to a SRV host failedDavid Kalnischkies
Instead of only trying the first host we get via SRV, we try them all as we are supposed to and if that isn't working we try to connect to the host itself as if we hadn't seen any SRV records. This was already the intend of the old code, but it failed to hide earlier problems for the next call, which would unconditionally fail then resulting in an all around failure to connect. With proper stacking we can also keep the error messages of each call around (and in the order tried) so if the entire connection fails we can report all the things we have tried while we discard the entire stack if something works out in the end. (cherry picked from commit 3af3ac2f5ec007badeded46a94be2bd06b9917a2)
2016-08-31report all instead of first error up the acquire chainDavid Kalnischkies
If we don't give a specific error to report up it is likely that all error currently in the error stack are equally important, so reporting just one could turn out to be confusing e.g. if name resolution failed in a SRV record list. (cherry picked from commit b50dfa6b2dd2d459e0c2746ac9367982b96ffac0)
2016-08-31don't change owner/perms/times through file:// symlinksDavid Kalnischkies
If we have files in partial/ from a previous invocation or similar such those could be symlinks created by file:// sources. The code is expecting only real files through and happily changes owner, modification times and permission on the file the symlink points to which tend to be files we have no business in touching in this way. Permissions of symlinks shouldn't be changed, changing owner is usually pointless to, but just to be sure we pick the easy way out and use lchown, check for symlinks before chmod/utimes. Reported-By: Mattia Rizzolo on IRC (cherry picked from commit 3465138575e1fd0d5892d9b6be1ae232eb873460)
2016-08-31use the right key for compressor configuration dumpDavid Kalnischkies
The generated dump output is incorrect in sofar as it uses the name as the key for this compressor, but they don't need to be equal as is the case if you force some of the inbuilt ones to be disabled as our testing framework does it at times. This is hidden from changelog as nobody will actually notice while describing it in a few words make it sound like an important change… Git-Dch: Ignore (cherry picked from commit 52bafeade99b700eeb4585608c5eee086b94dfa8)
2016-08-31avoid 416 response teardown binding to null pointerDavid Kalnischkies
methods/http.cc:640:13: runtime error: reference binding to null pointer of type 'struct FileFd' This reference is never used in the cases it has a nullptr, so the practical difference is non-existent, but its a bug still. Reported-By: gcc -fsanitize=undefined (cherry picked from commit 4460551841d909d3ee9c1de00156ed3cdf8b1665)
2016-08-31Make the test case executableJulian Andres Klode
Gbp-Dch: ignore (cherry picked from commit 2a90aa7a064047fb1c8783b31720cd345018ca4a)
2016-08-31indextargets: Check that cache could be built before using itJulian Andres Klode
This caused a crash because the cache was a nullptr. Closes: #829651 (cherry picked from commit 8823972649b0d3049c9c0d34b5f1d31160234fb4)
2016-08-31do not treat same-version local debs as downgradeDavid Kalnischkies
As the volatile sources are parsed last they were sorted behind the dpkg/status file and hence are treated as a downgrade, which isn't really what you want to happen as from a user POV its an upgrade. (cherry picked from commit cb9ac09bd6a36e73c2dce1d529acde6e4d15e32d)
2016-08-31reinstalling local deb file is no downgradeDavid Kalnischkies
If we have a (e.g. locally built) deb file installed and do try to install it again apt complained about this being a downgrade, but it wasn't as it is the very same version… it was just confused into not merging the versions together which looks like a downgrade then. The same size assumption is usually good, but given that volatile files are parsed last (even after the status file) the base assumption no longer holds, but is easy to adept without actually changing anything in practice. (cherry picked from commit e7edb2fef8370d54a4b8e5a01266e6eda81ef84e)
2016-08-31protect only the latest same-source providers from autoremoveDavid Kalnischkies
Traditionally all providers are protected providing something as apt can't know which of them is actually really providing the functionality for the user ensuring that we don't propose the removal of used stuff, but that is of course also keeping stuff around which could be removed. That can cause the collection of multiple old providers until the provided package is itself no longer needed (e.g. out-of-tree kernel modules). We combat this by marking providers only from the newest source package version so that old providers built by older versions of the same source package can be garbage collected. (cherry picked from commit a0ed43f7323b9d7976ed0ba8d437a42e24af9eaf)
2016-08-31more explicit MarkRequired algorithm code (part 2)David Kalnischkies
As the previous commit, this shouldn't change behavior at all, but beside being more explicit and perhaps faster its also considerably shorter (granted, mostly by if0-block elimination). Gbp-Dch: Ignore (cherry picked from commit 5a3339db48479114a0e1e11ebc8d640eb3e49933)
2016-08-31more explicit MarkRequired algorithm codeDavid Kalnischkies
Piling everything in a single if statement always made my head wobble, but it hasn't even a benefit as the most common case of a package which isn't installed passes all of the old if and lands in the non-existent else-part of the inner if. So beside a subjective cleanup of what goes on this implementation should also be a bit faster. No change in behavior should be present. Gbp-Dch: Ignore (cherry picked from commit 769e9f3ea1cbe67d3b98e6db6c956abde2384868)
2016-08-31factor out Pkg/DepIterator prettyprinters into own headerDavid Kalnischkies
The old prettyprinters have only access to the struct they pretty print, which isn't enough usually as we want to know for a package also a bit of state information like which version is the candidate. We therefore need to pull the DepCache into context and hence use a temporary struct which is printed instead of the iterator itself. (cherry picked from commit 84573326f41dd09b914b8374548e7ee7c93d0439)
2016-08-31write auto-bits before calling dpkg & again after if neededDavid Kalnischkies
Writing first means that even in the event of a power-failure the autobit is saved for future processing instead of "forgotten" so that the package is treated as manually installed. In some cases we have to re-run the writing after dpkg is done through as dpkg can let packages disappear and in such cases apt will move autobits around (or in that case non-autobits) which we need to store. (cherry picked from commit 309f497b7280a45e3626493318adb6d39ba5c69b)
2016-08-31if reading of autobit state failed, let write failDavid Kalnischkies
If we can't read the old file we can't just move forward as that would discard potentially discard old data (especially other fields). We let it fail only after we are done writing the new file so a user has the chance to look into and merge the new data (which is otherwise discarded). (cherry picked from commit 520931867ee2fac8415a624204414d3b62550996)
2016-08-31don't do atomic overrides with failed filesDavid Kalnischkies
We deploy atomic renames for some files, but these renames also happen if something about the file failed which isn't really the point of the exercise… Closes: 828908 (cherry picked from commit fc5db01bb7d1546944200d197866b0b5c378f100)
2016-08-31cache: Bump minor version to 6Julian Andres Klode
Needed for the previous change (cherry picked from commit 33aa2752e7c7a6f0a01b191111aa35a5fe69cf20)
2016-08-31Fix buffer overflow in debListParser::VersionHash()Julian Andres Klode
If a package file is formatted in a way that that no space follows a deprecated "<", we would reformat it to "<=" and increase the length of the output by 1, which can break. Under normal circumstances with "<=" this should not be an issue. Closes: #828812 (cherry picked from commit b6e9756ca03ec887ef1d0bc8e38f63c29db7a365)
2016-08-31close server if parsing of header field failedDavid Kalnischkies
Seen in #828011 if we fail to parse a header field like Last-Modified we end up interpreting the data as response header for coming requests in case we don't rotate to a new server in DNS rotation. (cherry picked from commit cc0a4c82b3c132abba9b9ec35fd61bc8b45a1b80)
2016-08-31Use the ConditionACPower feature of systemd in the apt-daily serviceNicolas Le Cam
.. instead of hardcoding the functionnality in the apt.systemd.daily script. Also make the compatibility cron job provide the same functionnality for systems that do not use systemd. Closes: #827930 (cherry picked from commit 51d659e7d8cdce59f910eceeee68e2c2afdb70d4)
2016-08-31methods/ftp: Cope with weird PASV responsesJulian Andres Klode
wu-ftpd sends the response without parens, whereas we expect them. I did not test the patch, but it should work. I added another return true if Pos is still npos after the second find to make sure we don't add npos to the string. Thanks: Lukasz Stelmach for the initial patch Closes: #420940 (cherry picked from commit 25a694165ae46c159e0d91bf0b27717f00dbc66e)
2016-06-22Release 1.2.141.2.14Julian Andres Klode
2016-06-22ensure filesize of deb is included in the hashes listDavid Kalnischkies
Filesize is a silly hash all by itself, but in combination with others it can be a strong opponent, so ensuring that it is in the list of hashes and hence checked by the normal course of action the acquire process takes is a good thing. (cherry picked from commit 5da51e0e2da3f055306562d38103b06a23d81719)
2016-06-22source: if download is skipped, don't try to unpackDavid Kalnischkies
If apt decides it can't download a file it is relatively pointless to try to tell dpkg-source to unpack it. (cherry picked from commit 60a0cb424e91acebc2bba0f9add220b474e432e6)
2016-06-20Reinstate caching of file hashes in apt-ftparchiveDominic Benson
Check for cached hash entries to determine which (if any) hash types need to be generated for the current file. In 1.0.9, each hash type was handled by a separate method, each of which checked the cache. It looks like when these code paths were unified (in a311fb96b84757ef8628e6a754232614a53b7891) the cache checks were not incorporated into the new method. (cherry picked from commit 51018e947ab1df3ddba5d7a84ed2284d599d8a12) Pull request Debian/apt#16 Closes: #806924
2016-06-20do not error if auto-detect-proxy cmd has no outputDavid Kalnischkies
Regression introduced in 8f858d560e3b7b475c623c4e242d1edce246025a. Commands are probably better of always having output through as the fall through to the generic proxy settings is likely not intended. As documenting and implementing this more consistently is kind of a regression through, it is split off into the next commit. Closes: 827713 (cherry picked from commit cad1877559f3e1703c3fea4d081978e1b4bb4a0e)
2016-06-13Norwegian Bokmål program translation updatePetter Reinholdtsen
Closes: 827067 (cherry picked from commit 5e5607ef967dbc0dfc0f1aa24a71ed9f5dcf7200)
2016-06-11Release 1.2.131.2.13Julian Andres Klode
2016-06-10don't leak FD in AutoProxyDetect command return parsingDavid Kalnischkies
Just closing the fd would be enough, but while we are at it we can also use the Popen interface to have an easier time with this. (cherry picked from commit 8f858d560e3b7b475c623c4e242d1edce246025a)
2016-06-10don't leak an FD in lz4 (de)compressionDavid Kalnischkies
Seen first in #826783, but as this buglog also shows leaked uncompressed files as well we don't close it just yet. (cherry picked from commit 6f35be91c9e86e463bca7df6eadf05412c7b732c)
2016-06-10do not hang on piped input in PipedFileFdPrivateDavid Kalnischkies
This effects only compressors configured on the fly (rather then the inbuilt ones as they use a library). (cherry picked from commit bdc42211700ef0f6f40e4ef3f362e52d684d70fb)
2016-06-07Japanese program translation updateTakuma Yamada
Closes: 826291 (cherry picked from commit 8f7cee4410c7fdbc66af6a232c6900b3ceb48b48)
2016-06-07apt-key: change to / before find to satisfy its CWD needsDavid Kalnischkies
First seen on hurd, but easily reproducible on all systems by removing the 'execution' bit from the current working directory and watching some tests (mostly the no-output expecting tests) fail due to find printing: "find: Failed to restore initial working directory: …" Samuel Thibault says in the bugreport: | To do its work, find first records the $PWD, then goes to | /etc/apt/trusted.gpg.d/ to find the files, and then goes back to $PWD. | | On Linux, getting $PWD from the 700 directory happens to work by luck | (POSIX says that getcwd can return [EACCES]: Search permission was denied | for the current directory, or read or search permission was denied for a | directory above the current directory in the file hierarchy). And going | back to $PWD fails, and thus find returns 1, but at least it emitted its | output. | | On Hurd, getting $PWD from the 700 directory fails, and find thus aborts | immediately, without emitting any output, and thus no keyring is found. | | So, to summarize, the issue is that since apt-get update runs find as a | non-root user, running it from a 700 directory breaks find. Solved as suggested by changing to '/' before running find, with some paranoia extra care taking to ensure the paths we give to find are really absolute paths first (they really should, but TMPDIR=. or a similar Dir::Etc::trustedparts setting could exist somewhere in the wild). The commit takes also the opportunity to make these lines slightly less error ignoring and the two find calls using (mostly) the same parameters. Thanks: Samuel Thibault for 'finding' the culprit! Closes: 826043 (cherry picked from commit 0cfec3ab589c6309bf284438d2148c7742cdaf10)
2016-06-01prevent C++ locale number formatting in text APIsDavid Kalnischkies
Setting the C++ locale via std::locale::global(std::locale("")); which would otherwise default to the default C locale (aka: unaffected by setlocale) effects the formatting of numeric types in IO streams, which for output for humans is perfectly sensible, but breaks our many text interfaces used and parsed by us and others without expecting the numbers to be formatted. Closes: #825396 (cherry picked from commit b58e2c7c56b1416a343e81f9f80cb1f02c128e25)
2016-06-01Russian program translation updateYuri Kozlov
Closes: 824702 (cherry picked from commit 91be4122fb4dba065c19ea3f292b1945a94b5d99)
2016-06-01zh_TW.po: remove several fuzzy tags after reviewZhou Mo
(cherry picked from commit 0264502c2ed8da69358959d6dc7beb67f422b5cf)
2016-05-20Provide complete apt bash completionJulian Andres Klode
This fixes Debian/apt#13 and the launchpad bug listed below, but is far more advanced. I went through private-cmndline.cc and looked at the supported options. LP: #1573547 Thanks: Elias Fröhner and Svyatoslav Gryaznov for the initial work (cherry picked from commit 5aba18968d87500232244760101ab2954c106581)
2016-05-20fail instead of segfault on unreadable config filesDavid Kalnischkies
The report mentions "apt list --upgradable", but there are others which have inconsistent behavior ranging from segfaulting to doing something with the partial (and hence incomplete) data. We had a recent report about sources.list (#818628), this one mentions prefences, the obvious next step is conf files… so the testcase is adapted to check for all three in file and directory versions and run a bunch of commands each time which should all have more or less the same behavior in such a case (aka error out). Closes: 824503 (cherry picked from commit fdf9eef4d96a18d0167708499c993e1174251e88)
2016-05-11Release 1.2.121.2.12Julian Andres Klode
2016-05-11debian/gbp.conf: Set debian-branch to 1.2.yJulian Andres Klode
2016-05-11respect user pinning in M-A:same version (un)screwingDavid Kalnischkies
Using Pkg.CandVersion() here is wrong as its implementation will return a candidate based just on the default policy settings ignoring user preferences and otherwise set candidates (aka: it sidesteps the pkgDepCache). This causes M-A:same libraries to be detected as screwed even through they aren't, so that they end up being kept back. Reported-By: Felipe Sateler on IRC
2016-05-11Dutch program translation updateFrans Spiesschaert
Closes: 823976 (cherry picked from commit 6fb0b9ed8c6e3b5af5aac14e8f57c4d0ec2cc638)
2016-05-10test: fix permission issue if run as rootDavid Kalnischkies
Always those silly mistakes. Do what I mean, not what I said… Reported-By: Travis Git-Dch: Ignore (cherry picked from commit 737ce3135d332e3b6165ac1fac5c68e21ba1bdba)
2016-05-10update: Run Post-Invoke-Success if not all sources failedJulian Andres Klode
Failures can happen and APT regardless will do a partial cache update anyway. Because APT ensures that the list directory is in a sane state, it makes sense to also call success hooks if success was only partial - otherwise it loses sync with APT. Most importantly, this causes the appstream cache to be empty, see launchpad bug #1562733. This is somewhat overly optimistic though: As soon as any repository has nonexisting optional files, the missing optional files are also treated as success, which means a single broken repository without an InRelease file still runs Success hooks, even though it really should not. (cherry picked from commit 35664152e47a1d4d712fd52e0f0a2dc8ed359d32)