summaryrefslogtreecommitdiff
path: root/apt-pkg
AgeCommit message (Collapse)Author
2012-03-05as we parse datestrings from external sources a lot specify the lengthDavid Kalnischkies
of the integer fields as well to avoid crashes in scanf as cppchecks warns: "(warning) scanf without field width limits can crash with huge input data"
2012-03-05set char-limits for the scanf parsing previous crash-reportsDavid Kalnischkies
2012-03-04fix a bunch of cppcheck "(warning) Member variable '<#>' is notDavid Kalnischkies
initialized in the constructor." messages (no functional change)
2012-03-04handle a SIGINT in all modes as a break after the currently runningDavid Kalnischkies
dpkg transaction instead of ignoring it completely
2012-03-04* apt-pkg/acquire-item.cc:David Kalnischkies
- remove 'old' InRelease file if we can't get a new one before proceeding with Release.gpg to avoid the false impression of a still trusted repository by a (still present) old InRelease file. Thanks to Simon Ruderich for reporting this issue! (CVE-2012-0214) Effected are all versions >= 0.8.11 Possible attack summary: - Attacker needs to find a user which has run at least one successful 'apt-get update' against an archive providing InRelease files. - Create a Packages file with his preferred content. - Attacker then prevents the download of InRelease, Release and Release.gpg (alternatively he creates a valid Release file and sends this, the other two files need to be missing either way). - User updates against this, getting the modified Packages file without any indication of being unsigned (beside the "Ign InRelease" and "Ign Release.gpg" in the output of 'apt-get update'). => deb files from this source are considered 'trusted' (and therefore the user isn't asked for an additional confirmation before install)
2012-03-03* apt-pkg/packagemanager.cc:David Kalnischkies
- do not try to a void a breaks if the broken package pre-depends on the breaker, but let dpkg auto-deconfigure it
2012-03-03show in the debug output if we are looping in the avoid breaksDavid Kalnischkies
2012-03-03eanup the ordering-code avoiding a break (no function change)David Kalnischkies
2012-02-18use pdiff for Translation-* files if available (Closes: #657902)David Kalnischkies
Beware: pdiffs for Translation-* are only acquired if their availability is advertised in the Release file.
2012-02-18* apt-pkg/acquire-item.cc:David Kalnischkies
- drop support for i18n/Index file (introduced in 0.8.11) and use the Release file instead to get the Translations (Closes: #649314) * ftparchive/writer.cc: - add 'Translation-*' to the default patterns i18n/Index was never used outside debian - and even here it isn't used consistently as only 'main' has such a file. As the Release file now includes the Translation-* files we therefore drop support for i18n/Index. A version supporting it was never part of a debian release and still supporting it would mean that we get 99% of the time a 404 as response to the request anyway and confuse archive maintainers who want to provide all files APT tries to acquire.
2012-02-18ensure that the cache-directories are really directories beforeDavid Kalnischkies
trying to get a list of included files from them
2012-02-18* apt-pkg/indexrecords.cc:David Kalnischkies
- do not create empty Entries as a sideeffect of Lookup()
2012-02-11* apt-pkg/cachefile.cc:David Kalnischkies
- clean up lost atomic cachefiles with 'clean' (Closes: #650513)
2012-02-11save the universe by not printing messages about apport if a packageDavid Kalnischkies
with this name is not installed (Closes: #619646)
2012-02-11correctly ignore already (un)hold packagesDavid Kalnischkies
2012-02-10ensure that architectures are not added multiple timesDavid Kalnischkies
2012-02-09call dpkg --assert-multi-arch with execvp instead of execvDavid Kalnischkies
2012-02-03rework previous patch to avoid changing the inline codeMichael Vogt
2012-02-03* apt-pkg/contrib/fileutl.h:Michael Vogt
- fix compat with FileFd::OpenDescriptor() in ReadOnlyGzip mode
2012-02-03* apt-pkg/contrib/fileutl.h:Michael Vogt
- fix compat with FileFd::OpenDescriptor() in ReadOnlyGzip mode
2012-01-31Fix IndexCopy::CopyPackages and TranslationsCopy::CopyTranslations toMichael Vogt
handle compressed files again (LP: #924182, closes: #658096)
2012-01-30* apt-pkg/deb/dpkgpm.cc:Michael Vogt
- fix crash when a package is in removed but residual config state (LP: #923807)
2012-01-30* apt-pkg/aptconfiguration.cc:David Kalnischkies
- chroot if needed before calling dpkg --print-foreign-architectures
2012-01-30* apt-pkg/contrib/configuration.cc:David Kalnischkies
- do not stop parent transversal in FindDir if the value is empty See http://lists.debian.org/deity/2012/01/msg00053.html , too.
2012-01-29* apt-pkg/depcache.cc:David Kalnischkies
- if a M-A:same package is marked for reinstall, mark all it's installed silbings for reinstallation as well (LP: #859188)
2012-01-29* apt-pkg/algorithms.cc:Colin Watson
- use a signed int instead of short for score calculation as upgrades become so big now that it can overflow (Closes: #657732, LP: #917173)
2012-01-29* apt-pkg/algorithms.cc:Colin Watson
- don't break out of the main-resolver loop for Breaks to deal with all of them in a single iteration (Closes: #657695, LP: #922485)
2012-01-29ensure that dpkg binary doesn't have the chroot-directory prefixedDavid Kalnischkies
2012-01-29* apt-pkg/deb/dpkgpm.cc:David Kalnischkies
- chroot if needed before dpkg --assert-multi-arch
2012-01-20fix a few esoteric cppcheck errors/warnings/infosDavid Kalnischkies
2012-01-20fix typos in comments reported by the lintian in very-picky-modesDavid Kalnischkies
2012-01-19* apt-pkg/packagemanager.cc:David Kalnischkies
- ignore breaks on not-installed versions while searching for breakage loops as we don't have to avoid them
2012-01-19* apt-pkg/cacheiterators.h:David Kalnischkies
- return the correct version arch for all+foreign, too The flag is interpreted at a few other places in different styles so this commit ensures that the flag check is consistent everywhere (checking for Same in flag style is a bit too much as it isn't used in combination with others anyway, but who knows and just for consistency)
2012-01-19* apt-pkg/deb/dpkgpm.cc:Michael Vogt
- fix segfault on pkg removal
2012-01-19if multi-arch is detected ensure that pkg:all is reported as pkg:allDavid Kalnischkies
Versions with arch:all are added to the package with the native arch, so we can't rely on Pkg.Arch() for the architecture
2012-01-19* apt-pkg/deb/dpkgpm.cc:David Kalnischkies
- redirect out/input of dpkg --assert-multi-arch to /dev/null
2012-01-18* apt-pkg/contrib/fileutl.h:Michael Vogt
- store the offset in the internal fd before calculate size of the zlib-handled file to jump back to this place again * apt-pkg/contrib/fileutl.h:
2012-01-18* apt-pkg/aptconfiguration.cc:Michael Vogt
- parse dpkg --print-foreign-architectures correctly in case archs are separated by newline instead of space, too. (Closes: #655590) * Slovak (Ivan Masar). Closes: #652985 * Russian (Yuri Kozlov). Closes: #654844 * Hungarian (Gabor Kelemen). Closes: #655238
2012-01-18* apt-pkg/contrib/fileutl.h:David Kalnischkies
- store the offset in the internal fd before calculate size of the zlib-handled file to jump back to this place again It jumped back to the position of the content - which is wrong as the internal fd is compressed and even reseting to the beginning of the file doesn't work as zlib uses an internal buffer, so while we might haven't read anything yet zlib might have done so already…
2012-01-18improve error reporting in case of errors in combination with zlibDavid Kalnischkies
2012-01-16* apt-pkg/contrib/fileutils.h:Michael Vogt
- fix segfault from python-apt testsuite
2012-01-13* apt-pkg/deb/dpkgpm.cc:David Kalnischkies
- check if dpkg supports multiarch with --assert-multi-arch and if it does be always explicit about the architecture
2012-01-13factor out the detection of self-conflicts into Dep::IsIgnorableDavid Kalnischkies
2012-01-13* apt-pkg/pkgcache.cc:David Kalnischkies
- ignore implicit conflicts on providers in AllTarget, too
2012-01-11* apt-pkg/depcache.cc:David Kalnischkies
- implicit conflicts (for multiarch) are supposed to conflict only with real packages, not with virtual providers
2012-01-02g++ 4.7 fixesMichael Vogt
2012-01-02g++ 4.7 fixesMichael Vogt
2011-12-18usage of Skipping in pipes can't work, so we ignore-read insteadDavid Kalnischkies
Also, read only one char in each step of ReadLine instead of back-"seeking"
2011-12-17try to avoid direct usage of .Fd() if possible and do read()s and coDavid Kalnischkies
on the FileFd instead
2011-12-17keep track of where we are in a filedescriptor so we can use it as Tell()David Kalnischkies
information if we are working on a pipe which can't seek