summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-09-26Do not allow going from authenticated to unauthenticated repoMichael Vogt
Also rework the way we load the Release file, so it only after Release.gpg verified the Release file. The rational is that we never want to load untrusted data into our parsers. Only stuff verified with gpg or by its hashes get loaded. To load untrusted data you now need to use apt-get update --allow-unauthenticated.
2014-09-26Print warning for unauthenticated repositoriesMichael Vogt
2014-09-26Do not download Packages/Sources files on I-M-S hit of the Release fileMichael Vogt
With this branch we know that the data in the lists directory is always what the release file says, so if the Release file is unchanged, then there is no need to queue the download of the other indexfiles as they will be unchanged too (or broken :)
2014-09-25Merge remote-tracking branch 'upstream/debian/experimental' into ↵Michael Vogt
feature/acq-trans
2014-09-24releasing package apt version 1.1~exp3Michael Vogt
2014-09-24DropPrivs: Document what it doesJulian Andres Klode
Git-Dch: ignore
2014-09-24DropPrivs: Use APT::Sandbox::User instead of Apt::User::NobodyJulian Andres Klode
Git-Dch: ignore
2014-09-24DropPrivs: Hard-fail if the user does not existJulian Andres Klode
Git-Dch: ignore
2014-09-24DropPrivs: Add some comments for the more obscure setuid/setgid functionsJulian Andres Klode
Git-Dch: ignore
2014-09-24DropPrivs: Move the re-set uid/gid thing to the end of the functionJulian Andres Klode
Git-Dch: ignore
2014-09-24methods: Fail if we cannot drop privilegesJulian Andres Klode
2014-09-24DropPrivs: Improve commentsJulian Andres Klode
Git-Dch: ignore
2014-09-24DropPrivs: Also check for saved set-user-ID and set-group-IDJulian Andres Klode
2014-09-24DropPrivs: Do not use an invalid return check for setgroups()Julian Andres Klode
setgroups() returns 0 on success Git-Dch: ignore
2014-09-24Use _apt as our unprivileged user nameJulian Andres Klode
Some people want to standardize on it, and BSDs do it too, so let's do the same. Reported-by: Paul Wise <pabs@debian.org>
2014-09-24DropPriv: Really call seteuid and not setuid, and add more checksJulian Andres Klode
The only thing we are missing is non-portable saved ids support.
2014-09-24Drop Privileges to "Debian-apt" in most acquire methodsMichael Vogt
Add a new "Debian-apt" user that owns the /var/lib/apt/lists and /var/cache/apt/archive directories. The methods http, https, ftp, gpgv, gzip switch to this user when they start. Thanks to Julian and "ioerror" and tors "switch_id()" code.
2014-09-23make pdiff transactional (but at the cost of a CopyFile()Michael Vogt
2014-09-23cleanup, fix test-apt-update-unauth as the behavior of apt changedMichael Vogt
2014-09-23cleanupMichael Vogt
2014-09-23fix one broken testMichael Vogt
2014-09-23Merge remote-tracking branch 'debian/debian/experimental' into feature/acq-transMichael Vogt
2014-09-23Merge remote-tracking branch 'upstream/debian/experimental' into ↵Michael Vogt
feature/acq-trans Conflicts: apt-pkg/acquire-item.cc apt-pkg/acquire-item.h methods/copy.cc test/integration/test-hashsum-verification
2014-09-23fix testsMichael Vogt
2014-09-23Merge branch 'debian/sid' into debian/experimentalMichael Vogt
Conflicts: apt-pkg/acquire-item.cc apt-pkg/acquire-item.h apt-pkg/cachefilter.h configure.ac debian/changelog
2014-09-21Ensure that iTFRewritePackageOrder is "MD5sum" to match apt-ftparchiveMichael Vogt
The iTFRewritePackageOrder is used in indexcopy to copy and normalize cdrom Packages files. This change will ensure that there is no "normalization" that changes MD5sum -> MD5Sum which alters the hash of the Packages file on disk (oh the irony).
2014-09-21Fix regression for cdrom: sources from latest security updateMichael Vogt
Skip a reverify for cdrom: sources. The reverify step is actually harmful here because the apt-cdrom add code uses the indexcopy.cc which will "normalize" the Packages file from the cdrom when it writes it to the local disk. This leads to changing the "MD5sum" field (notice the lower case "s") on the cdrom Packages file to a "MD5Sum" field on the local file in /var/lib/apt/lists. Which of course alters the hash and makes apt fail to reverify the file.
2014-09-20relax grep to support newer curl output formatDavid Kalnischkies
Git-Dch: Ignore
2014-09-19disable timestamps in the footer of docs by doxygenJérémy Bobbio
The default being 'yes', but this spoils the effort of reproducible builds for no real gain. (https://wiki.debian.org/ReproducibleBuilds)
2014-09-19German program translation updateHolger Wansing
Closes: 762223
2014-09-19Fix regression when copy: is used for a relative pathMichael Vogt
When we do a ReverifyAfterIMS() we use the copy: method to verify the hashes again. If the user uses -o Dir=./something/relative this fails because we use the URI class in copy.cc that strips away the leading relative part. By not using URI this is fixed. Closes: #762160
2014-09-19test/integration/test-apt-update-file: improve testMichael Vogt
2014-09-18./pre-release pre-exportMichael Vogt
2014-09-17releasing package apt version 1.0.9.11.0.9.1Michael Vogt
2014-09-17Merge remote-tracking branch 'vnwildman/debian/sid' into debian/sidMichael Vogt
2014-09-17improve test for commit daff4aMichael Vogt
2014-09-17Fix regression for file:/// uris from CVE-2014-0487Michael Vogt
Do not run ReverifyAfterIMS() for local file URIs as this will causes apt to mess around in the file:/// uri space. This is wrong in itself, but it will also cause a incorrect verification failure when the archive and the lists directory are on different partitions as rename().
2014-09-17fix gcc warningsMichael Vogt
2014-09-17use pkgAcqMetaBase as the transactionManagerMichael Vogt
2014-09-16prepare 1.0.9.1Michael Vogt
2014-09-16merge previous uploadMichael Vogt
2014-09-16SECURITY UPDATE for CVE-2014-{0488,0487,0489}Michael Vogt
incorrect invalidating of unauthenticated data (CVE-2014-0488) incorect verification of 304 reply (CVE-2014-0487) incorrect verification of Acquire::Gzip indexes (CVE-2014-0489)
2014-09-16add a bunch of dpointersMichael Vogt
2014-09-16remove pkgAcqSubIndexMichael Vogt
2014-09-14add a 'coverage' command to generate reportsDavid Kalnischkies
Builds, runs and generates everything needed to have a coverage report at the end for apt. The report isn't perfect as most childs apt forks do not have a regular exit and so data is never written for them, which results in e.g. most methods to have zero coverage reported. Git-Dch: Ignore
2014-09-14Turkish program translation updateMert Dirik
Closes: 761394
2014-09-14Updated German documentation translationChris Leick
2014-09-13l10n: vi.po (636t): Update program translationTrần Ngọc Quân
Signed-off-by: Trần Ngọc Quân <vnwildman@gmail.com>
2014-09-12Allow override of Proxy-Auto-Detect by the users configurationMichael Vogt
Only run the Proxy-Auto-Detect code if there is not already a host specific configuration. Closes: 759264
2014-09-09prepare 1.0.81.0.8Michael Vogt
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-28 00:48:23 +0000