From 8bb2a91a070170d7d8e71206d1c66a26809bdbc3 Mon Sep 17 00:00:00 2001 From: Julian Andres Klode Date: Tue, 18 Dec 2018 14:50:25 +0100 Subject: Introduce experimental 'never' pinning for sources This allows disabling a repository by pinning it to 'never', which is internally translated to a value of -32768 (or whatever the minimum of short is). This overrides any other pin for that repository. It can be used to make sure certain sources are never used; for example, in unattended-upgrades. To prevent semantic changes to existing files, we substitute min + 1 for every pin-priority: . This is a temporary solution, as we are waiting for an ABI break. To add pins with that value, the special Pin-Priority "never" may be used for now. It's unclear if that will persist, or if the interface will change eventually. --- apt-pkg/policy.cc | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) (limited to 'apt-pkg') diff --git a/apt-pkg/policy.cc b/apt-pkg/policy.cc index d7eb43c0f..6de439d32 100644 --- a/apt-pkg/policy.cc +++ b/apt-pkg/policy.cc @@ -38,6 +38,8 @@ using namespace std; +constexpr short NEVER_PIN = std::numeric_limits::min(); + // Policy::Init - Startup and bind to a cache /*{{{*/ // --------------------------------------------------------------------- /* Set the defaults for operation. The default mode with no loaded policy @@ -107,7 +109,7 @@ bool pkgPolicy::InitDefaults() pkgVersionMatch Match(I->Data,I->Type); for (pkgCache::PkgFileIterator F = Cache->FileBegin(); F != Cache->FileEnd(); ++F) { - if (Fixed[F->ID] == false && Match.FileMatch(F) == true) + if ((Fixed[F->ID] == false || I->Priority == NEVER_PIN) && PFPriority[F->ID] != NEVER_PIN && Match.FileMatch(F) == true) { PFPriority[F->ID] = I->Priority; @@ -271,7 +273,14 @@ APT_PURE signed short pkgPolicy::GetPriority(pkgCache::PkgIterator const &Pkg) APT_PURE signed short pkgPolicy::GetPriority(pkgCache::VerIterator const &Ver, bool ConsiderFiles) { if (VerPins[Ver->ID].Type != pkgVersionMatch::None) - return VerPins[Ver->ID].Priority; + { + // If all sources are never pins, the never pin wins. + if (VerPins[Ver->ID].Priority == NEVER_PIN) + return NEVER_PIN; + for (pkgCache::VerFileIterator file = Ver.FileList(); file.end() == false; file++) + if (GetPriority(file.File()) != NEVER_PIN) + return VerPins[Ver->ID].Priority; + } if (!ConsiderFiles) return 0; @@ -388,9 +397,17 @@ bool ReadPinFile(pkgPolicy &Plcy,string File) for (; Word != End && isspace(*Word) != 0; Word++); _error->PushToStack(); - int const priority = Tags.FindI("Pin-Priority", 0); + std::string sPriority = Tags.FindS("Pin-Priority"); + int priority = sPriority == "never" ? NEVER_PIN : Tags.FindI("Pin-Priority", 0); bool const newError = _error->PendingError(); _error->MergeWithStack(); + + if (sPriority == "never" && not Name.empty()) + return _error->Error(_("%s: The special 'Pin-Priority: %s' can only be used for 'Package: *' records"), File.c_str(), "never"); + + // Silently clamp the never pin to never pin + 1 + if (priority == NEVER_PIN && sPriority != "never") + priority = NEVER_PIN + 1; if (priority < std::numeric_limits::min() || priority > std::numeric_limits::max() || newError) { -- cgit v1.2.3 From c2b9b0489538fed4770515bd8853a960b13a2618 Mon Sep 17 00:00:00 2001 From: Julian Andres Klode Date: Fri, 1 Feb 2019 14:43:52 +0100 Subject: Add a Packages-Require-Authorization Release file field This new field allows a repository to declare that access to packages requires authorization. The current implementation will set the pin to -32768 if no authorization has been provided in the auth.conf(.d) files. This implementation is suboptimal in two aspects: (1) A repository should behave more like NotSource repositories (2) We only have the host name for the repository, we cannot use paths yet. - We can fix those after an ABI break. The code also adds a check to acquire-item.cc to not use the specified repository as a download source, mimicking NotSource. --- apt-pkg/acquire-item.cc | 4 ++++ apt-pkg/contrib/netrc.cc | 44 ++++++++++++++++++++++++++++++++++++++++++++ apt-pkg/contrib/netrc.h | 4 ++++ apt-pkg/deb/debmetaindex.cc | 1 + apt-pkg/pkgcache.h | 8 +++++--- apt-pkg/policy.cc | 6 +++++- 6 files changed, 63 insertions(+), 4 deletions(-) (limited to 'apt-pkg') diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc index 755e1fb59..bb3bc1b56 100644 --- a/apt-pkg/acquire-item.cc +++ b/apt-pkg/acquire-item.cc @@ -25,6 +25,7 @@ #include #include #include +#include #include #include #include @@ -3394,6 +3395,7 @@ pkgAcqArchive::pkgAcqArchive(pkgAcquire *const Owner, pkgSourceList *const Sourc StoreFilename.clear(); std::set targetComponents, targetCodenames, targetSuites; + std::vector> authconfs; for (auto Vf = Version.FileList(); Vf.end() == false; ++Vf) { auto const PkgF = Vf.File(); @@ -3401,6 +3403,8 @@ pkgAcqArchive::pkgAcqArchive(pkgAcquire *const Owner, pkgSourceList *const Sourc continue; if (PkgF.Flagged(pkgCache::Flag::NotSource)) continue; + if (PkgF.Flagged(pkgCache::Flag::PackagesRequireAuthorization) && !IsAuthorized(PkgF, authconfs)) + continue; pkgIndexFile *Index; if (Sources->FindIndex(PkgF, Index) == false) continue; diff --git a/apt-pkg/contrib/netrc.cc b/apt-pkg/contrib/netrc.cc index 84b4c0ed8..48114ba3c 100644 --- a/apt-pkg/contrib/netrc.cc +++ b/apt-pkg/contrib/netrc.cc @@ -13,6 +13,7 @@ #include #include +#include #include #include @@ -149,3 +150,46 @@ void maybe_add_auth(URI &Uri, std::string NetRCFile) if (fd.Open(NetRCFile, FileFd::ReadOnly)) MaybeAddAuth(fd, Uri); } + +/* Check if we are authorized. */ +bool IsAuthorized(pkgCache::PkgFileIterator const I, std::vector> &authconfs) +{ + if (authconfs.empty()) + { + _error->PushToStack(); + auto const netrc = _config->FindFile("Dir::Etc::netrc"); + if (not netrc.empty()) + { + authconfs.emplace_back(new FileFd()); + authconfs.back()->Open(netrc, FileFd::ReadOnly); + } + + auto const netrcparts = _config->FindDir("Dir::Etc::netrcparts"); + if (not netrcparts.empty()) + { + for (auto const &netrc : GetListOfFilesInDir(netrcparts, "conf", true, true)) + { + authconfs.emplace_back(new FileFd()); + authconfs.back()->Open(netrc, FileFd::ReadOnly); + } + } + _error->RevertToStack(); + } + + // FIXME: Use the full base url + URI uri(std::string("http://") + I.Site() + "/"); + for (auto &authconf : authconfs) + { + if (not authconf->IsOpen()) + continue; + if (not authconf->Seek(0)) + continue; + + MaybeAddAuth(*authconf, uri); + + if (not uri.User.empty() || not uri.Password.empty()) + return true; + } + + return false; +} diff --git a/apt-pkg/contrib/netrc.h b/apt-pkg/contrib/netrc.h index 981494064..80d95acc1 100644 --- a/apt-pkg/contrib/netrc.h +++ b/apt-pkg/contrib/netrc.h @@ -13,9 +13,12 @@ #ifndef NETRC_H #define NETRC_H +#include #include +#include #include +#include #ifndef APT_8_CLEANER_HEADERS #include @@ -32,4 +35,5 @@ class FileFd; APT_DEPRECATED_MSG("Use FileFd-based MaybeAddAuth instead") void maybe_add_auth(URI &Uri, std::string NetRCFile); bool MaybeAddAuth(FileFd &NetRCFile, URI &Uri); +bool IsAuthorized(pkgCache::PkgFileIterator const I, std::vector> &authconfs) APT_HIDDEN; #endif diff --git a/apt-pkg/deb/debmetaindex.cc b/apt-pkg/deb/debmetaindex.cc index 1afcdf2c0..f88076abf 100644 --- a/apt-pkg/deb/debmetaindex.cc +++ b/apt-pkg/deb/debmetaindex.cc @@ -918,6 +918,7 @@ bool debReleaseIndex::Merge(pkgCacheGenerator &Gen,OpProgress * /*Prog*/) const/ #undef APT_INRELEASE Section.FindFlag("NotAutomatic", File->Flags, pkgCache::Flag::NotAutomatic); Section.FindFlag("ButAutomaticUpgrades", File->Flags, pkgCache::Flag::ButAutomaticUpgrades); + Section.FindFlag("Packages-Require-Authorization", File->Flags, pkgCache::Flag::PackagesRequireAuthorization); return true; } diff --git a/apt-pkg/pkgcache.h b/apt-pkg/pkgcache.h index 5c33c7073..787e3995f 100644 --- a/apt-pkg/pkgcache.h +++ b/apt-pkg/pkgcache.h @@ -182,9 +182,11 @@ class pkgCache /*{{{*/ LocalSource=(1<<1), /*!< local sources can't and will not be verified by hashes */ NoPackages=(1<<2), /*!< the file includes no package records itself, but additions like Translations */ }; - enum ReleaseFileFlags { - NotAutomatic=(1<<0), /*!< archive has a default pin of 1 */ - ButAutomaticUpgrades=(1<<1), /*!< (together with the previous) archive has a default pin of 100 */ + enum ReleaseFileFlags + { + NotAutomatic = (1 << 0), /*!< archive has a default pin of 1 */ + ButAutomaticUpgrades = (1 << 1), /*!< (together with the previous) archive has a default pin of 100 */ + PackagesRequireAuthorization = (1 << 2), /*!< (together with the previous) archive has a default pin of 100 */ }; enum ProvidesFlags { MultiArchImplicit=pkgCache::Dep::MultiArchImplicit, /*!< generated internally, not spelled out in the index */ diff --git a/apt-pkg/policy.cc b/apt-pkg/policy.cc index 6de439d32..7986aa506 100644 --- a/apt-pkg/policy.cc +++ b/apt-pkg/policy.cc @@ -18,6 +18,7 @@ #include #include #include +#include #include #include #include @@ -87,7 +88,8 @@ pkgPolicy::pkgPolicy(pkgCache *Owner) : Pins(nullptr), VerPins(nullptr), // --------------------------------------------------------------------- /* */ bool pkgPolicy::InitDefaults() -{ +{ + std::vector> authconfs; // Initialize the priorities based on the status of the package file for (pkgCache::PkgFileIterator I = Cache->FileBegin(); I != Cache->FileEnd(); ++I) { @@ -98,6 +100,8 @@ bool pkgPolicy::InitDefaults() PFPriority[I->ID] = 100; else if (I.Flagged(pkgCache::Flag::NotAutomatic)) PFPriority[I->ID] = 1; + if (I.Flagged(pkgCache::Flag::PackagesRequireAuthorization) && !IsAuthorized(I, authconfs)) + PFPriority[I->ID] = NEVER_PIN; } // Apply the defaults.. -- cgit v1.2.3