| Age | Commit message (Collapse) | Author |
|---|
|
of the integer fields as well to avoid crashes in scanf as cppchecks warns:
"(warning) scanf without field width limits can crash with huge input data"
|
|
|
|
initialized in the constructor." messages (no functional change)
|
|
dpkg transaction instead of ignoring it completely
|
|
- remove 'old' InRelease file if we can't get a new one before
proceeding with Release.gpg to avoid the false impression of a still
trusted repository by a (still present) old InRelease file.
Thanks to Simon Ruderich for reporting this issue! (CVE-2012-0214)
Effected are all versions >= 0.8.11
Possible attack summary:
- Attacker needs to find a user which has run at least one successful
'apt-get update' against an archive providing InRelease files.
- Create a Packages file with his preferred content.
- Attacker then prevents the download of InRelease, Release and
Release.gpg (alternatively he creates a valid Release file and sends
this, the other two files need to be missing either way).
- User updates against this, getting the modified Packages file without
any indication of being unsigned (beside the "Ign InRelease" and
"Ign Release.gpg" in the output of 'apt-get update').
=> deb files from this source are considered 'trusted' (and therefore the
user isn't asked for an additional confirmation before install)
|
|
- do not try to a void a breaks if the broken package pre-depends
on the breaker, but let dpkg auto-deconfigure it
|
|
|
|
|
|
Beware: pdiffs for Translation-* are only acquired if their
availability is advertised in the Release file.
|
|
- drop support for i18n/Index file (introduced in 0.8.11) and use
the Release file instead to get the Translations (Closes: #649314)
* ftparchive/writer.cc:
- add 'Translation-*' to the default patterns
i18n/Index was never used outside debian - and even here it isn't used
consistently as only 'main' has such a file. As the Release file now
includes the Translation-* files we therefore drop support for i18n/Index.
A version supporting it was never part of a debian release and still
supporting it would mean that we get 99% of the time a 404 as response
to the request anyway and confuse archive maintainers who want to
provide all files APT tries to acquire.
|
|
trying to get a list of included files from them
|
|
- do not create empty Entries as a sideeffect of Lookup()
|
|
- clean up lost atomic cachefiles with 'clean' (Closes: #650513)
|
|
with this name is not installed (Closes: #619646)
|
|
|
|
|
|
|
|
|
|
- fix compat with FileFd::OpenDescriptor() in ReadOnlyGzip mode
|
|
- fix compat with FileFd::OpenDescriptor() in ReadOnlyGzip mode
|
|
handle compressed files again (LP: #924182, closes: #658096)
|
|
- fix crash when a package is in removed but residual config state
(LP: #923807)
|
|
- chroot if needed before calling dpkg --print-foreign-architectures
|
|
- do not stop parent transversal in FindDir if the value is empty
See http://lists.debian.org/deity/2012/01/msg00053.html , too.
|
|
- if a M-A:same package is marked for reinstall, mark all it's installed
silbings for reinstallation as well (LP: #859188)
|
|
- use a signed int instead of short for score calculation as upgrades
become so big now that it can overflow (Closes: #657732, LP: #917173)
|
|
- don't break out of the main-resolver loop for Breaks to deal with all
of them in a single iteration (Closes: #657695, LP: #922485)
|
|
|
|
- chroot if needed before dpkg --assert-multi-arch
|
|
|
|
|
|
- ignore breaks on not-installed versions while searching for
breakage loops as we don't have to avoid them
|
|
- return the correct version arch for all+foreign, too
The flag is interpreted at a few other places in different styles so
this commit ensures that the flag check is consistent everywhere
(checking for Same in flag style is a bit too much as it isn't used
in combination with others anyway, but who knows and just for
consistency)
|
|
- fix segfault on pkg removal
|
|
Versions with arch:all are added to the package with the native arch,
so we can't rely on Pkg.Arch() for the architecture
|
|
- redirect out/input of dpkg --assert-multi-arch to /dev/null
|
|
- store the offset in the internal fd before calculate size of
the zlib-handled file to jump back to this place again
* apt-pkg/contrib/fileutl.h:
|
|
- parse dpkg --print-foreign-architectures correctly in
case archs are separated by newline instead of space, too.
(Closes: #655590)
* Slovak (Ivan Masar). Closes: #652985
* Russian (Yuri Kozlov). Closes: #654844
* Hungarian (Gabor Kelemen). Closes: #655238
|
|
- store the offset in the internal fd before calculate size of
the zlib-handled file to jump back to this place again
It jumped back to the position of the content - which is wrong as
the internal fd is compressed and even reseting to the beginning of
the file doesn't work as zlib uses an internal buffer, so while we
might haven't read anything yet zlib might have done so already…
|
|
|
|
- fix segfault from python-apt testsuite
|
|
- check if dpkg supports multiarch with --assert-multi-arch
and if it does be always explicit about the architecture
|
|
|
|
- ignore implicit conflicts on providers in AllTarget, too
|
|
- implicit conflicts (for multiarch) are supposed to conflict
only with real packages, not with virtual providers
|
|
|
|
|
|
Also, read only one char in each step of ReadLine instead of back-"seeking"
|
|
on the FileFd instead
|
|
information if we are working on a pipe which can't seek
|
