summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-10-07Add new Acquire::MaxReleaseFileSize=10*1000*1000 optionMichael Vogt
This option controls the maximum size of Release/Release.gpg/InRelease files. The rational is that we do not know the size of these files in advance and we want to protect against a denial of service attack where someone sends us endless amounts of data until the disk is full (we do know the size all other files (Packages/Sources/debs)).
2014-10-07Merge branch 'feature/acq-trans' into feature/expected-sizeMichael Vogt
2014-10-07make expected-size a maximum-size check as this is what we want at this pointMichael Vogt
2014-10-07Merge remote-tracking branch 'upstream/debian/experimental' into ↵Michael Vogt
feature/acq-trans Conflicts: apt-pkg/acquire-item.cc
2014-10-07UpperCase some functions for consistencyMichael Vogt
changeOwnerAndPermissionOfFile->ChangeOwnerAndPermissionOfFile preparePartialFile->GetPartialFileName preparePartialFileFromURI->GetPartialFileNameFromURI Git-Dch: ignore
2014-10-07fix test-cve-2013-1051-InRelease-parsing (fails now in the method)Michael Vogt
2014-10-07add ftp expected size checkMichael Vogt
2014-10-07methods/https.cc: use File->Tell() here tooMichael Vogt
2014-10-07display errortext for all Err as well as Ign logsDavid Kalnischkies
consistently using Item::Failed in all specializec classes helps setting up some information bits otherwise unset, so some errors had an empty reason as an error. Ign is upgraded to display the error message we ignored to further help in understanding what happens.
2014-10-07use _apt:root only for partial directoriesDavid Kalnischkies
Using a different user for calling methods is intended to protect us from methods running amok (via remotely exploited bugs) by limiting what can be done by them. By using root:root for the final directories and just have the files in partial writeable by the methods we enhance this in sofar as a method can't modify already verified data in its parent directory anymore. As a side effect, this also clears most of the problems you could have if the final directories are shared without user-sharing or if these directories disappear as they are now again root owned and only the partial directories contain _apt owned files (usually none if apt isn't running) and the directory itself is autocreated with the right permissions.
2014-10-07ensure partial dirs are 0700 and owned by _apt:rootDavid Kalnischkies
Reworks the API involved in creating and setting up the fetcher to be a bit more pleasent to look at and work with as e.g. an empty string for no lock isn't very nice. With the lock we can also stop creating all our partial directories "just in case". This way we can also be a bit more aggressive with the partial directory itself as with a lock, we know we will gone need it.
2014-10-07fixup foldmarkers in acquire-item.ccDavid Kalnischkies
Git-Dch: Ignore
2014-10-06make http size check workMichael Vogt
2014-10-06[l10n] Updated Czech translation of aptMiroslav Kure
Closes: #764055
2014-10-06fix warningsMichael Vogt
2014-10-06rename StopAuthentication -> CheckStopAuthentication and make it protectedMichael Vogt
2014-10-06fix testMichael Vogt
2014-10-06rename AuthDone() -> CheckAuthDone()Michael Vogt
2014-10-06cleanup pkgAcq*::Failed()Michael Vogt
2014-10-06add missing TransactionStageCopy() in pkgAcqDiffIndex::Done()Michael Vogt
2014-10-06Rework pkgAcqMeta{Index,Sig,ClearSig}::Done() for readabilityMichael Vogt
Move common code out but do not use subclassing for ::Done to make it easier to understand what each class is doing when its done
2014-10-06fix incorrect docstrings for ↵Michael Vogt
AcqMetaBase::TransactionStageRemoval/AcqMetaBase::TransactionStageCopy
2014-10-06add new "SetActiveSubprocess()Michael Vogt
2014-10-06update testMichael Vogt
2014-10-03apt-get: Create the temporary downloaded changelog inside tmpdirGuillem Jover
The code is creating a secure temporary directory, but then creates the changelog alongside the tmpdir in the same base directory. This defeats the secure tmpdir creation, making the filename predictable. Inject a '/' between the tmpdir and the changelog filename.
2014-10-03Bump library version to libapt-pkg4.14Michael Vogt
2014-10-03really do not download Release if InRelease does not verifyMichael Vogt
2014-10-03implement MarkAndSweep in cc instead of headerDavid Kalnischkies
Having it in the header exposes some implementation details, namely private methods and will cause problems for us if we ever want to change the actions. Git-Dch: Ignore
2014-10-03rename StringType VERSION to VERSIONNUMBERDavid Kalnischkies
aptitude has a define for VERSION, so to not generate a FTBFS we just rename our enum element to a slightly less generic name. Git-Dch: Ignore
2014-10-02cleanup around pkgAcqMetaSig and improved testsMichael Vogt
2014-10-02add a bunch of docstrings etcMichael Vogt
2014-10-02ensure world-readability for trusted.gpg in postinstDavid Kalnischkies
apt-key creates trusted.gpg if it needs it with 644 nowadays, but before it ensured this, it was gpg creating it, which gives it by default 600. Not a problem as long as our gpgv is run as root, but now that we drop privileges we have to ensure that we can also read trusted.gpg files created by earlier apt-key versions. Closes: 647001
2014-10-02fix crashMichael Vogt
2014-10-02donkults fixesMichael Vogt
2014-10-02Cleanup pkgAcqIndexMichael Vogt
2014-10-01refactor and add pkgAcqIndex::ValidateFile()Michael Vogt
2014-10-01fix leftover files from Acquire::GzipIndexMichael Vogt
2014-10-01hack around test-apt-update-unauth failureMichael Vogt
2014-10-01fix test-apt-update-nofallback testMichael Vogt
2014-10-01debian/rules: add hardening=+allMichael Vogt
Because of dpkg-buildflags we already get most of the hardening features, +all adds -fPIE and ld -z now Thanks: Simon Ruderich, Markus Waldeck
2014-10-01update test/integration/test-releasefile-verificationMichael Vogt
2014-10-01Use Acquire::Allow{InsecureRepositories,DowngradeToInsecureRepositories}Michael Vogt
The configuration key Acquire::AllowInsecureRepositories controls if apt allows loading of unsigned repositories at all. The configuration Acquire::AllowDowngradeToInsecureRepositories controls if a signed repository can ever become unsigned. This should really never be needed but we provide it to avoid having to mess around in /var/lib/apt/lists if there is a use-case for this (which I can't think of right now).
2014-10-01add verify for the .diff/Index download and add FIXME for ↵Michael Vogt
pkgAcqIndexDiffs/pkgAcqMergeDiffs
2014-10-01Turkish program translation updateMert Dirik
Closes: 763379
2014-09-30Merge remote-tracking branch 'donkult/debian/experimental' into ↵Michael Vogt
debian/experimental
2014-09-30adjust version numbers for the planed uploadMichael Vogt
2014-09-30fix another instance of warning: extra ‘;’ [-Wpedantic]David Kalnischkies
Git-Dch: Ignore
2014-09-30support parsing of all hashes for pdiffDavid Kalnischkies
The fileformat of a pdiff index stores currently only SHA1 hashes. With this change, we look for all other hashes we support as well and take what we get, so that we can work after the release of jessie to get right of SHA1 if we want to. Note that the completely patched file is and was checked against the hashes collected from the Release file, so this transition isn't mission critical.
2014-09-30mark private methods as hiddenDavid Kalnischkies
We are the only possible users of private methods, so we are also the only users who can potentially export them via using them in inline methods. The point is: We don't need these symbols exported if we don't do this, so marking them as hidden removes some methods from the API without breaking anything as nobody could have used them. Git-Dch: Ignore
2014-09-29cleanupMichael Vogt