summaryrefslogtreecommitdiff
path: root/doc/examples/configure-index
AgeCommit message (Collapse)Author
2019-01-14Add support for /etc/apt/auth.conf.d/*.conf (netrcparts)Julian Andres Klode
This allows us to install matching auth files for sources.list.d files, for example; very useful. This converts aptmethod's authfd from one FileFd to a vector of pointers to FileFd, as FileFd cannot be copied, and move operators are hard. (cherry picked from commit bbfcc05c1978decd28df9681fd73e2a7d9a8c2a5) LP: #1811120
2018-05-24Lower default timeout from 120s to 30sJulian Andres Klode
120s is an insanely high default time out, lower it to 30s to make things a bit nicer.
2018-03-12apt-pkg: Add support for zstdJulian Andres Klode
zstd is a compression algorithm developed by facebook. At level 19, it is about 6% worse in size than xz -6, but decompression is multiple times faster, saving about 40% install time, especially with eatmydata on cloud instances.
2018-02-19Merge branch 'pu/not-valid-before' into 'master'Julian Andres Klode
Check that Date of Release file is not in the future See merge request apt-team/apt!3
2018-02-19Check that Date of Release file is not in the futureJulian Andres Klode
By restricting the Date field to be in the past, an attacker cannot just create a repository from the future that would be accepted as a valid update for a repository. This check can be disabled by Acquire::Check-Date set to false. This will also disable Check-Valid-Until and any future date related checking, if any - the option means: "my computers date cannot be trusted." Modify the tests to allow repositories to be up to 10 hours in the future, so we can keep using hours there to simulate time changes.
2018-02-19ensure correct file permissions for auxfilesDavid Kalnischkies
The interesting takeaway here is perhaps that 'chmod +w' is effected by the umask – obvious in hindsight of course. The usual setup helps with hiding that applying that recursively on all directories (and files) isn't correct. Ensuring files will not be stored with the wrong permissions even if in strange umask contexts is trivial in comparison. Fixing the test also highlighted that it wasn't bulletproof as apt will automatically fix the permissions of the directories it works with, so for this test we actually need to introduce a shortcut in the code. Reported-By: Ubuntu autopkgtest CI
2018-02-19add apt-helper drop-privs command…David Kalnischkies
2018-01-03document https options in new apt-transport-https manpageDavid Kalnischkies
Same reasoning as with the previous commit for http with the added benefit of moving the hard to discover and untranslated example config into a manpage which could be translated.
2018-01-03Add rapid "happy eyeballs" connection fallback (RFC 8305)Julian Andres Klode
Try establishing connections in alternating address families in rapid intervals of 250 ms, adding more connections to the wait list until one succeeds (RFC 8305, happy eyeballs 2). It is important that WaitAndCheckErrors() waits until it has a successful connection, a time out, or all connections failed - otherwise the timing between tries might be wrong, and the final long wait might exit early because one connection failed without trying the others. Timing wise, this only works correctly on Linux, as select() counts down there. But we rely on that in some other places too, so this is not the time to fix that. Timeouts are only reported in the final long wait - the short inner waits are expected to time out more often, and multiple times, we do not want to report them. Closes: #668948 LP: #1308200 Gbp-Dch: paragraph
2017-10-26Print syscall number and arch to stderr when trapped by seccompJulian Andres Klode
This should help debugging crashes. The signal handler is a C++11 lambda, yay! Special care has been taken to only use signal handler -safe functions inside there.
2017-10-22Sandbox methods with seccomp-BPF; except cdrom, gpgv, rshJulian Andres Klode
This reduces the number of syscalls to about 140 from about 350 or so, significantly reducing security risks. Also change prepare-release to ignore the architecture lists in the build dependencies when generating the build-depends package for travis. We might want to clean up things a bit more and/or move it somewhere else.
2017-07-26show a warning for Debian shutting down FTP servicesDavid Kalnischkies
We detect the effected sources by matching Release info – that has potential by-catch of repositories which have incorrect field values, but those are better fixed now anyhow. The bigger incorrectness is that this message will not only be printed for the Debian services itself but also for all mirrors not under Debian control but serving Debian like more local/private mirrors which will not (directly) shutdown. It is likely through that many of them will follow suite with less visible announcements or break downright if their upstream source disappears, so having false-positives here seems benefitial for the user in the end.
2017-07-08fix various typos reported by codespell & spellintianDavid Kalnischkies
Reported-By: codespell & spellintian Gbp-Dch: Ignore
2017-06-28ask for releaseinfo change interactively in aptDavid Kalnischkies
If we have a user sitting around we can let 'apt' ask the user for a confirmation rather than print errors at the end and require the user to figure out which commandline flags are needed to confirm the changes non-interactively.
2017-06-28error in update on Release information changesDavid Kalnischkies
The value of Origin, Label, Codename and co can be used in user configuration from apts own pinning to unattended upgrades. A repository changing this values can therefore have serious effects on the behaviour of apt and other tools using these values. In a first step we will generate error messages for these changes now explaining the need for explicit confirmation and provide config options and commandline flags to accept them.
2017-06-28Introduce Acquire::AllowTLS to turn off TLS supportJulian Andres Klode
As requested by Henrique de Moraes Holschuh, here comes an option to disable TLS support. If the option is set to false, the internal TLS layer is disabled.
2017-06-26avoid explicit types for pkg counts by autoDavid Kalnischkies
Changes nothing on the program front and as the datatypes are sufficently comparable fixes no bug either, but problems later on if we ever change the types of those and prevent us using types which are too large for the values we want to store waste (a tiny bit of) resources. Gbp-Dch: Ignore
2017-01-19fix various typos reported by spellintianDavid Kalnischkies
Most of them in (old) code comments. The two instances of user visible string changes the po files of the manpages are fixed up as well. Gbp-Dch: Ignore Reported-By: spellintian
2017-01-17Read dpkg tables to handle architecture wildcardsJulian Andres Klode
Our implementation of wildcards was rudimentary. It worked for some common ones, but it was also broken: For example, armel matched any-armel, but should match any-arm. With this commit, we load the correct tables from dpkg. Supported are both triplets and quadruplet tables (the latter introduced in dpkg 1.18.11). There are some odd things we have to deal with in the cache filter for historical and API reasons: * The character "*" must be accepted as an alternative to any - in fact it may appear anywhere in the wildcard as we also allow fnmatch() style wildcard matching on the commandline. * The code might get passed an arch with a minus at the end, for example the cmdline "install apt:any-arm-" will first try to check if any-arm- is a valid architecture. We deal with this by rejecting any wildcard ending in a minus. * Triplets are actually implemented by extending them to faux quadruplets - by prepending a "base" component for the architecture tuple, and "any" if there is a wildcard component. Once we have constructed a wildcard, it is transformed into an fnmatch() expression for historical reasons. In the future, we should really get a tuple class and implement matching in a better, more explicit way. This does for now though - it passes all the test cases and accepts all things it should accept. Closes: #748936 Thanks: James Clarke <jrtc27@jrtc27.com> for the initial patch
2016-12-31allow warning generation for non-whitelisted optionsDavid Kalnischkies
The idea is simple: Each¹ Find*( call starts with a call check if the given option (with the requested type) exists in the whitelist. The whitelist is specified via our configure-index file so that we have a better chance at keeping it current. the whitelist is loaded via a special (undocumented for now) configuration stanza and if none is loaded the empty whitelist will make it so that no warnings are shown. Much needs to be done still, but that is as good a time as any to take a snapshot of the current state and release it into the wild given that it found some bugs already and has no practical effect on users. ¹ not all in this iteration, but many
2016-11-11add hidden config to set packages as Essential/ImportantDavid Kalnischkies
You can pretty much achieve the same with a local dummy package if you want to, but libapt has an inbuilt setting for essential: "apt" which can be overridden with this option as well – it could be helpful in quick tests and what not so adding this alternative shouldn't really hurt much. We aren't going to document them much through as care must be taken in regards to the binary caches as they aren't invalidated by config options alone, so the effects of old settings could still be in them, similar to the other already existing pkgCacheGen option(s). Closes: 767891 Thanks: Anthony Towns for initial patch
2016-05-27fix and document on the fly compressor configDavid Kalnischkies
libapt allows to configure compressors to be used by its system via configuration implemented in 03bef78461c6f443187b60799402624326843396, but that was never really documented and also only partly working, which also explains why the tests weren't using it…
2015-12-14mention APT::AutoRemove::{Recommends,Suggests}Important optionAndreas Metzler
Closes: 807413
2015-12-02use @CHANGEPATH@ as placeholder in changelog URI templatesDavid Kalnischkies
This should make it more obvious that CHANGEPATH is a placeholder which apt will replace with a package specific path rather than a string constant. Mail-Reference: <87d1upgvaf.fsf@deep-thought.43-1.org> Mail-Archive: https://lists.debian.org/debian-dak/2015/12/msg00005.html
2015-06-15provide a public interface for acquiring changelogsDavid Kalnischkies
Provided is a specialized acquire item which given a version can figure out the correct URI to try by itself and if not provides an error message alongside with static methods to get just the URI it would try to download if it should just be displayed or similar such. The URI is constructed as follows: Release files can provide an URI template in the "Changelogs" field, otherwise we lookup a configuration item based on the "Label" or "Origin" of the Release file to get a (hopefully known) default value for now. This template should contain the string CHANGEPATH which is replaced with the information about the version we want the changelog for (e.g. main/a/apt/apt_1.1). This middleway was choosen as this path part was consistent over the three known implementations (+1 defunct), while the rest of the URI varies widely between them. The benefit of this construct is that it is now easy to get changelogs for Debian packages on Ubuntu and vice versa – even at the moment where the Changelogs field is present nowhere. Strictly better than what apt-get had before as it would even fail to get changelogs from security… Now it will notice that security identifies as Origin: Debian and pick this setting (assuming again that no Changelogs field exists). If on the other hand security would ship its changelogs in a different location we could set it via the Label option overruling Origin. Closes: 687147, 739854, 784027, 787190
2014-11-05Merge branch 'debian/sid' into debian/experimentalMichael Vogt
Conflicts: debian/changelog
2014-10-22doc/examples/configure-index: make "Dpkg::Max{Arg,ArgBytes} match realityMichael Vogt
Git-Dch: ignore
2014-10-01Use Acquire::Allow{InsecureRepositories,DowngradeToInsecureRepositories}Michael Vogt
The configuration key Acquire::AllowInsecureRepositories controls if apt allows loading of unsigned repositories at all. The configuration Acquire::AllowDowngradeToInsecureRepositories controls if a signed repository can ever become unsigned. This should really never be needed but we provide it to avoid having to mess around in /var/lib/apt/lists if there is a use-case for this (which I can't think of right now).
2014-04-01Merge remote-tracking branch 'mvo/debian/sid' into debian/sidMichael Vogt
2014-04-01Add new Debug::RunScripts optionMichael Vogt
This debug option will display all scripts that are run by apts RunScripts and RunScriptsWithPkgs helpers.
2014-03-27fix documentation for APT::Periodic::MaxSize "0" (closes: #740551)Michael Vogt
2014-02-22Fix typos in documentation (codespell)Michael Vogt
2013-06-20fix syntax error in the configure-indexDavid Kalnischkies
The file isn't supposed to be a valid config file, but it should show valid syntax non-the-less. Git-Dch: Ignore
2012-05-25* doc/apt-cdrom.8.xml:Justin B Rye
- replace CDROM with the proper CD-ROM in text
2011-07-25implement MultiarchCross for build-dep and source (Closes: #632221)David Kalnischkies
2011-07-05* doc/apt.conf.5.xml:David Kalnischkies
- document APT::Architectures list (Closes: #612102)
2011-03-10* apt-pkg/contrib/cdromutl.{cc,h}, apt-pkg/cdrom.{cc,h}:Michael Vogt
- deal with missing FSTAB_DIR when using libudev to discover cdrom - add experimental APT::cdrom::CdromOnly option (on by default). When this is set to false apt-cdrom will handle any removable deivce (like a usb-stick) as a "cdrom/dvd" source
2011-02-21doc/examples/configure-index: remove no longer used option NoConfigureMichael Vogt
2011-02-03merge 'after squeeze release'-stuffDavid Kalnischkies
[ David Kalnischkies ] * apt-pkg/depcache.cc: - add SetCandidateRelease() to set a candidate version and the candidates of dependencies if needed to a specified release (Closes: #572709) * cmdline/apt-get.cc: - if --print-uris is used don't setup downloader as we don't need progress, lock nor the directories it would create otherwise - show dependencies of essential packages which are going to remove only if they cause the remove of this essential (Closes: #601961) - keep not installed garbage packages uninstalled instead of showing in the autoremove section and installing those (Closes: #604222) - change pkg/release behavior to use the new SetCandidateRelease so installing packages from experimental or backports is easier - really do not show packages in the extra section if they were requested on the commandline, e.g. with a modifier (Closes: #184730) * debian/control: - add Vcs-Browser now that loggerhead works again (Closes: #511168) - depend on debhelper 7 to raise compat level - depend on dpkg-dev (>= 1.15.8) to have c++ symbol mangling * apt-pkg/contrib/fileutl.cc: - add a RealFileExists method and check that your configuration files are real files to avoid endless loops if not (Closes: #604401) - ignore non-regular files in GetListOfFilesInDir (Closes: #594694) * apt-pkg/contrib/weakptr.h: - include stddefs.h to fix compile error (undefined NULL) with gcc-4.6 * methods/https.cc: - fix CURLOPT_SSL_VERIFYHOST by really passing 2 to it if enabled * deb/dpkgpm.cc: - fix popen/fclose mismatch reported by cppcheck. Thanks to Petter Reinholdtsen for report and patch! (Closes: #607803) * doc/apt.conf.5.xml: - fix multipl{y,e} spelling error reported by Jakub Wilk (Closes: #607636) * apt-inst/contrib/extracttar.cc: - let apt-utils work with encoded tar headers if uid/gid are large. Thanks to Nobuhiro Hayashi for the patch! (Closes: #330162) * apt-pkg/cacheiterator.h: - do not segfault if cache is not build (Closes: #254770) * doc/apt-get.8.xml: - remove duplicated mentioning of --install-recommends * doc/sources.list.5.xml: - remove obsolete references to non-us (Closes: #594495) * debian/rules: - use -- instead of deprecated -u for dh_gencontrol - remove shlibs.local creation and usage - show differences in the symbol files, but never fail * pre-build.sh: - remove as it is not needed for a working 'bzr bd' * debian/{apt,apt-utils}.symbols: - ship experimental unmangled c++ symbol files * methods/rred.cc: - operate optional on gzip compressed pdiffs * apt-pkg/acquire-item.cc: - don't uncompress downloaded pdiff files before feeding it to rred - try downloading clearsigned InRelease before trying Release.gpg - change the internal handling of Extensions in pkgAcqIndex - add a special uncompressed compression type to prefer those files - download and use i18n/Index to choose which Translations to download * cmdline/apt-key: - don't set trustdb-name as non-root so 'list' and 'finger' can be used without being root (Closes: #393005, #592107) * apt-pkg/deb/deblistparser.cc: - rewrite LoadReleaseInfo to cope with clearsigned Releasefiles * ftparchive/writer.cc: - add config option to search for more patterns in release command - include Index files by default in the Release file * methods/{gzip,bzip}.cc: - print a good error message if FileSize() is zero * apt-pkg/aptconfiguration.cc: - remove the inbuilt Translation files whitelist
2011-01-26 - change the internal handling of Extensions in pkgAcqIndexDavid Kalnischkies
- add a special uncompressed compression type to prefer those files * methods/{gzip,bzip}.cc: - print a good error message if FileSize() is zero
2010-11-30add the possibility to disable only the progress reporting stuff as theDavid Kalnischkies
quiet level 1 does this, but also disables other stuff we might want to test against in a testcase
2010-11-18refactor/simplify changelog fetching codeMichael Vogt
2010-11-15doc/examples/configure-index: updated to include apt::changelogs::serverMichael Vogt
2010-09-21doc/examples/configure-index:Michael Vogt
- add info on debug::acquire::cdrom
2010-07-09* doc/apt.conf.5.xml:David Kalnischkies
- add and document APT::Cache-{Start,Grow,Limit} options for mmap control
2010-06-09 - backport forgotten Valid-Until patch from the obsolete experimentalDavid Kalnischkies
branch to prevent replay attacks better, thanks to Thomas Viehmann for the initial patch! (Closes: #499897) * doc/apt.conf.5.xml: - document the new Valid-Until related options * apt-pkg/contrib/strutl.cc: - split StrToTime() into HTTP1.1 and FTP date parser methods and use strptime() instead of some self-made scanf mangling - use the portable timegm shown in his manpage instead of a strange looking code copycat from wget * ftparchive/writer.cc: - add ValidTime option to generate a Valid-Until header in Release file
2010-06-09rename the options, document them and reorder the changelog a bitDavid Kalnischkies
2010-05-28* apt-pkg/deb/debsystem.cc:David Kalnischkies
- add better config item for extended_states file
2010-04-09* apt-pkg/acquire-item.cc:David Kalnischkies
- Acquire::ForceHash to force method for expected hash - display MD5Sum in --print-uris if not forced to use another method instead of displaying the strongest available (Closes: #576420)
2010-04-01merged from lp:~donkult/apt/sidMichael Vogt