-
apt (1.8.2.3) buster; urgency=medium
* Default Acquire::AllowReleaseInfoChange::Suite to "true" (Closes: #931566)
-- Julian Andres Klode <email address hidden> Mon, 19 Apr 2021 18:41:13 +0200
-
apt (1.8.2.2) buster-security; urgency=high
* SECURITY UPDATE: Integer overflow in parsing (LP: #1899193)
- apt-pkg/contrib/arfile.cc: add extra checks.
- apt-pkg/contrib/tarfile.cc: limit tar item sizes to 128 GiB
- apt-pkg/deb/debfile.cc: limit control file sizes to 64 MiB
- test/*: add tests.
- CVE-2020-27350
* Additional hardening:
- apt-pkg/contrib/tarfile.cc: Limit size of long names and links to 1 MiB
* Fix autopkgtest regression in 1.8.2.1 security update
-- Julian Andres Klode <email address hidden> Mon, 07 Dec 2020 12:31:04 +0100
-
apt (1.8.2.1) buster-security; urgency=high
* SECURITY UPDATE: Out of bounds read in ar, tar implementations (LP: #1878177)
- apt-pkg/contrib/arfile.cc: Fix out-of-bounds read in member name
- apt-pkg/contrib/arfile.cc: Fix out-of-bounds read on unterminated
member names in error path
- apt-pkg/contrib/extracttar.cc: Fix out-of-bounds read on unterminated
member names in error path
- CVE-2020-3810
* .gitlab.ci.yml: Point to debian:buster
-- Julian Andres Klode <email address hidden> Tue, 12 May 2020 11:57:30 +0200
-
apt (1.8.2) unstable; urgency=medium
[ Alwin Henseler ]
* Flip /: in documented default value of DPkg::Path (Closes: #917986)
[ TilmanK ]
* Fix typo in German manpage translation
[ Américo Monteiro ]
* Portuguese manpages translation update (Closes: #926614)
[ Jean-Pierre Giraud ]
* French manpages translation update (Closes: #929290)
[ Michael Zhivich ]
* methods: https: handle requests for TLS re-handshake (LP: #1829861)
[ Julian Andres Klode ]
* Unlock dpkg locks in reverse locking order (LP: #1829860)
-- Julian Andres Klode <email address hidden> Tue, 28 May 2019 16:40:29 +0200
-
apt (1.8.1) unstable; urgency=medium
* Add test case for local-only packages pinned to never
* Prevent shutdown while running dpkg (LP: #1820886)
* Add linux-{buildinfo,image-unsigned,source} versioned kernel pkgs
(LP: #1821640)
-- Julian Andres Klode <email address hidden> Mon, 06 May 2019 10:41:52 +0200
-
apt (1.8.0) unstable; urgency=medium
[ David Kalnischkies ]
* Add explicit message for unsupported binary signature (Closes: #921685)
[ Milo Casagrande ]
* [l10n] Update Italian translation
[ Julian Andres Klode ]
* Fix name of APT::Update::Post-Invoke-Stats (was ...Update-Post...)
* CMake: Install auth.conf.d directory (LP: #1818996)
[ Frans Spiesschaert ]
* Dutch program translation update (Closes: #923728)
* Dutch manpages translation update (Closes: #923834)
-- Julian Andres Klode <email address hidden> Fri, 08 Mar 2019 09:41:20 +0100
-
apt (1.8.0~rc4) unstable; urgency=medium
* update: Provide APT::Update-Post-Invoke-Stats script hook point
(LP: #1815760)
* Introduce APT::Install::Pre-Invoke / Post-Invoke-Success (LP: #1815761)
-- Julian Andres Klode <email address hidden> Tue, 26 Feb 2019 08:32:01 +0100
-
apt (1.8.0~rc3) unstable; urgency=medium
[ Julian Andres Klode ]
* aptmethod.h: Do not have gcc warning about ignoring write() result
* Fix issues in previous two debian/changelog entries
* json-hooks-protocol: The "pin" field is optional
* debian/gbp.conf: Set debian-branch to 1.8.y
* Install translated apt_auth and apt-transport-* manpages
[ Алексей Шилин ]
* Russian program translation update.
Thanks to Vladimir Zhbanov <email address hidden> (Closes: #921830)
[ Jakub Wilk ]
* Fix various typos in the documentation
[ Frans Spiesschaert ]
* Dutch program translation update (Closes: #921934)
* Dutch manpages translation update (Closes: #921941)
-- Julian Andres Klode <email address hidden> Mon, 11 Feb 2019 09:33:46 +0100
-
apt (1.8.0~rc2) unstable; urgency=medium
* Bump SONAMEs in preparation for ABI breaks
* Correctly handle feature detection for sse4.2 and crc32
-- Julian Andres Klode <email address hidden> Mon, 04 Feb 2019 18:15:07 +0100
-
apt (1.8.0~beta1) unstable; urgency=medium
[ anatoly techtonik ]
* README.md: Document that apt is also included
* apt.cc: Add "apt info" alias for muscle memory
[ Jean-Pierre Giraud ]
* French manpages translation update (Closes: #915952)
[ Frans Spiesschaert ]
* Dutch manpages translation update (Closes: #916358)
[ Julian Andres Klode ]
* cache hash: Use sse4.2 CRC32c on x86-64 where available
* configuration: Compare size first during lookup
* debListParser: Avoid native arch lookup in ParseDepends
* hash32: Tighten to multiversion to x86-64 ELF and use uint32_t
* apt-mark: Introduce minimize-manual
* doc/apt-verbatim.ent: Point ubuntu-codename to disco (LP: #1812696)
* CI: Use debian:buster as test base image
* doc/apt-verbatim.ent: Debian buster is stable
* SECURITY UPDATE: content injection in http method (CVE-2019-3462)
(LP: #1812353)
* debian/control: Drop libcurl4-gnutls-dev build dependency
[ Mo Zhou ]
* zh_CN.po: Update Simplified Chinese programs translation.
[ Khem Raj ]
* Remove `register` keyword
[ Vasya Novikov ]
* bash completion: add keys
[ David Kalnischkies ]
* Communicate back which key(s) were used for signing
-- Julian Andres Klode <email address hidden> Wed, 23 Jan 2019 16:49:34 +0100
-
apt (1.8.0~alpha3.1) unstable; urgency=emergency
* SECURITY UPDATE: content injection in http method (CVE-2019-3462)
(LP: #1812353)
-- Julian Andres Klode <email address hidden> Tue, 22 Jan 2019 19:52:38 +0100
-
apt (1.8.0~alpha3) unstable; urgency=medium
[ Manuel A. Fernandez Montecelo ]
* Remove "Ultimedia" config for Acquire::Changelogs
* Remove "Tanglu" config for Acquire::Changelogs and as vendor
[ Julian Andres Klode ]
* Adjust libapt-pkg Breaks aptitude to << 0.8.9
* Print useful error on "apt changelog" without arguments
* test-pdiff-usage: make transaction failure test case more robust
* Provide a "autopurge" shortcut.
Thanks to Michael Vogt for the initial work
* Override FileFd copy constructor to prevent copying
* Add support for /etc/apt/auth.conf.d/*.conf (netrcparts)
* Set PATH=/usr/sbin:/usr/bin:/sbin:/bin when running dpkg
[ David Kalnischkies ]
* Allow setting Referer header for http method
* Use quoted tagnames in config dumps
[ Алексей Шилин ]
* Russian program translation update (Closes: #914096)
[ Balint Reczey ]
* Set LC_ALL=C.UTF-8 for unattended-upgrades environment when parsing its --help
(LP: #1806076)
[ Milo Casagrande ]
* [l10n] Update Italian translation
-- Julian Andres Klode <email address hidden> Tue, 18 Dec 2018 15:02:11 +0100
-
apt (1.8.0~alpha2) unstable; urgency=medium
* Revert "http: Fix handling of server connection closure"
This reverts commit fb3f36593563d09a8d1727cc7c6deb0b49823ca2. It
caused downloads to hang on long-lived connections on certain
servers.
* Drop debian/source/options, not needed anymore
-- Julian Andres Klode <email address hidden> Tue, 13 Nov 2018 10:31:49 +0100
-
apt (1.7.0) unstable; urgency=medium
[ Julian Andres Klode ]
* Fix calculation of elapsed usec in downloads
* pkgCacheFile: Only unlock in destructor if locked before (LP: #1794053)
* Set DPKG_FRONTEND_LOCKED when running {pre,post}-invoke scripts.
Some post-invoke scripts install packages, which fails because
the environment variable is not set. This sets the variable for
all three kinds of scripts {pre,post-}invoke and pre-install-pkgs,
but we will only allow post-invoke at a later time.
* prepare-release: Fix last-modification detection for manpages
[ David Kalnischkies ]
* Show APT::Compressor example in apt.conf(5) (Closes: #909712)
[ Muhamed Huseinbašić ]
* apt-mark: showhold: typo-fix (package -> packages)
-- Julian Andres Klode <email address hidden> Sun, 07 Oct 2018 07:56:02 +0200
-
apt (1.7.0~rc2) unstable; urgency=medium
[ David Kalnischkies ]
* Deal with descriptions embedded in displayed record correctly
(Closes: #909155)
-- Julian Andres Klode <email address hidden> Thu, 20 Sep 2018 21:03:54 +0200
-
apt (1.6.4) unstable; urgency=critical
[ David Kalnischkies ]
* SECURITY UPDATE: Fallback in the mirror method allowed a later server to
supply any InRelease file without it having to be verified. (LP: #1787752)
- apt-pkg/acquire-item.cc:: clear alternative URIs for mirror:// between steps
- CVE-2018-0501
- https://mirror.fail/
-- Julian Andres Klode <email address hidden> Mon, 20 Aug 2018 17:38:50 +0200
-
apt (1.6.3) unstable; urgency=medium
* Handle JSON hooks that just close the file/exit and fix some other errors
(LP: #1776218)
-- Julian Andres Klode <email address hidden> Mon, 09 Jul 2018 16:41:27 +0200
-
apt (1.6.2) unstable; urgency=medium
* Fix build with new gtest (Closes: #897149)
* Handle a missed case of timed out ip addresses (LP: #1766542)
* Lower default network timeouts from 120s to 30s
* apt-key: Pass all instead of gpg-agent to gpgconf --kill (LP: #1773992)
* Fix lock counting in debSystem (LP: #1778547)
* CI fixes:
- tests: Do not expect requested-by if sudo was invoked by root
- Run tests on GitLab CI
- CI: Export DEBIAN_FRONTEND=noninteractive in all CI environments
-- Julian Andres Klode <email address hidden> Mon, 25 Jun 2018 17:15:10 +0200
-
apt (1.6.1) unstable; urgency=medium
* CMake: Fix builds without zstd
* apt.conf.autoremove: Catch some new Ubuntu module packages
-- Julian Andres Klode <email address hidden> Fri, 20 Apr 2018 12:08:18 +0200
-
apt (1.6~beta1) unstable; urgency=medium
[ David Kalnischkies ]
* allow the apt/lists/auxfiles/ directory to be missing (Closes: 887624)
* add apt-helper drop-privs command…
* restore gcc visibility=hidden for apt-private
* ensure correct file permissions for auxfiles
* allow the apt/lists/auxfiles/ directory to be missing (Closes: 887624)
* add apt-helper drop-privs command…
* restore gcc visibility=hidden for apt-private
* ensure correct file permissions for auxfiles
[ Julian Andres Klode ]
* indexcopy: Copy uncompressed indices from cdrom again (LP: #1746807)
* Work around test-method-mirror failure by setting umask at start
* Check that Date of Release file is not in the future
* apt.conf.autoremove: Add linux-cloud-tools to list (LP: #1698159)
* indexcopy: Copy uncompressed indices from cdrom again (LP: #1746807)
* Work around test-method-mirror failure by setting umask at start
* Check that Date of Release file is not in the future
* apt.conf.autoremove: Add linux-cloud-tools to list (LP: #1698159)
[ Chris Leick ]
* German manpage translation update
* German manpage translation update
-- Julian Andres Klode <email address hidden> Mon, 26 Feb 2018 13:14:13 +0100
-
apt (1.6~alpha7) unstable; urgency=medium
[ Mert Dirik ]
* Turkish program translation update (Closes: 886250)
[ David Kalnischkies ]
* dpkg status parsing: check if name is valid before use
[ Julian Andres Klode ]
* apt-compat.cron.daily: Correctly handle undetermined power status
(LP: #1742378)
* Introduce inrelease-path option for sources.list (Closes: #886745)
* Drop obsolete Suggests on python-apt (Closes: #887607)
* Point people to salsa.d.o instead of anonscm.d.o for git
[ Justin B Rye ]
* review and fix the three new apt-transport- manpages
[ Holger Wansing ]
* German program translation update (Closes: 886429)
[ Julien Patriarca ]
* French program translation update (Closes: 887017)
-- Julian Andres Klode <email address hidden> Thu, 18 Jan 2018 14:44:14 +0000
-
apt (1.6~alpha6) unstable; urgency=medium
[ Julian Andres Klode ]
* Add Breaks: aptitude (<< 0.8.10) for gzip method removal
* Also look at https_proxy for https URLs
* Run wrap-and-sort
* Translate shared documentation parts again
* tests: Improve handling profiling messages on CI
* connect: Store the IP used when picking a connection
* Add rapid "happy eyeballs" connection fallback (RFC 8305) (Closes: #668948)
(LP: #1308200)
[ David Kalnischkies ]
* allow multivalue fields in deb822 sources to be folded (Closes: 881875)
* support COLUMNS environment variable in apt tools
* allow apt_auth.conf(5) to be translated
* if insecure repo is allowed continue on all http errors
* don't auto-switch candidate if installed is good enough
* update libapt-pkg symbols file
* explicitly name token in auth.conf parsing error
* fix over-calculating dpkg commandline length
* avoid some useless casts reported by -Wuseless-cast
* deal with floats without old-style cast
* support multiline values in LookupTag
* mark some 500 HTTP codes as transient acquire errors
* report transient errors as transient errors
* implement Acquire::Retries support for all items
* give the methods more metadata about the files to acquire
* implement fallback to alternative URIs for all items
* do not remap current files if nullptrs in cache generation
* apt.daily: remove unused dbus signal for apt update (Closes: 849636)
* Support cleartext signed InRelease files with CRLF line endings.
Thanks to Lukas Wunner for detailed report & initial patch! (Closes: 884922)
* document http options in new apt-transport-http manpage
* document https options in new apt-transport-https manpage
* refactor message generation for methods
* allow a method to request auxiliary files
* reimplement and simplify mirror:// method
* require methods to request AuxRequest capability at startup
* add tag-based control over mirror choices from the list
* non-local mirrorlists shouldn't redirect to local
* add apt-transport-mirror manpage
[ Milo Casagrande ]
* Italian program translation update (Closes: 882850)
[ Christian Göttsche ]
* apt.daily: fix several "shellcheck" annotations
-- Julian Andres Klode <email address hidden> Wed, 03 Jan 2018 22:33:37 +0000
-
apt (1.6~alpha5) unstable; urgency=medium
[ Julian Andres Klode ]
* Do not attempt seccomp under qemu-user and drop EFAULT workaround
(Closes: #881519)
[ Frans Spiesschaert ]
* Dutch manpage translation update (Closes: #881402)
-- Julian Andres Klode <email address hidden> Sun, 12 Nov 2017 19:57:00 +0100
-
apt (1.6~alpha4) unstable; urgency=medium
* debian: Set Rules-Requires-Root: no
* debian: Bump Standards-Version to 4.1.1
* Re-introduce a transitional apt-transport-https
-- Julian Andres Klode <email address hidden> Sun, 05 Nov 2017 15:25:53 +0100
-
apt (1.6~alpha3) unstable; urgency=medium
[ Julian Andres Klode ]
* debian/tests/control: Add dpkg so we get triggered by it
* seccomp: Allow ipc() for fakeroot, and allow sysinfo() for sort
(Closes: #879814, #879826)
* Drop unused gzip, lzma, bzip2, and xz symlinks of store
* seccomp: Allow clock_nanosleep() and nanosleep() syscalls
* Prevent overflow in Installed-Size (and Size) in apt show
[ David Kalnischkies ]
* use store: instead of gzip: to open local changelogs
-- Julian Andres Klode <email address hidden> Sat, 28 Oct 2017 17:57:05 +0200
-
apt (1.5) unstable; urgency=medium
* Fix translator comment location for legacy target warning
-- Julian Andres Klode <email address hidden> Sun, 24 Sep 2017 17:54:41 +0200
-
apt (1.5~rc4) unstable; urgency=medium
* apt-daily: Do not Wants=network-online, and add some more After=
We now wait for being online ourselves, so all we need to wait
on is for services we are using to be online first. This avoids
severe boot slowdowns by other services having specified an
After=network-online.target without a Wants=.
-- Julian Andres Klode <email address hidden> Wed, 13 Sep 2017 16:02:30 +0200
-
apt (1.5~rc1) unstable; urgency=medium
* Redefine APT_CONST to mean APT_PURE (APT_CONST is deprecated)
APT_CONST was used on functions where it should not have, causing
the compiler to optimize code it should not have, like turning
the "::" content in StringSplit(name, "::") into garbage because it
figured out that the value is not going to be read anyway, causing
stuff to go horribly wrong (mostly on -O3, really).
* Replace APT_CONST with APT_PURE everywhere
* Make test-bug-818628-unreadable-source work on !amd64
-- Julian Andres Klode <email address hidden> Thu, 24 Aug 2017 23:13:52 +0200
-
apt (1.5~beta2) unstable; urgency=medium
[ M. Willis Monroe ]
* Minor grammar fix
[ Zhou Mo ]
* zh_CN.po: update Simplified Chinese programs translation
[ David Kalnischkies ]
* don't expect more downloads from failed transactions
* remove reference to a-t-debtorrent in description
* ignore SIGPIPE in dump solver if forwarding
* support compressed extended_states file for bug triage
* don't move failed pdiff indexes out of partial (Closes: 869425)
* don't try to parse all fields starting with HTTP as status-line
* send weak-only hashes to methods
* fail earlier if server answers with too much data
* fail early in http if server answer is too small as well
* use FileFd to parse all apt configuration files
* show warnings instead of errors if files are unreadable (LP: #1701852)
* reimplement and document auth.conf (Closes: #811181)
* lookup login info for proxies in auth.conf
* allow the auth.conf to be root:root owned
* update URI scheme descriptions in sources.list(5)
* show a warning for Debian shutting down FTP services
* suggest using auth.conf for sources with passwords
* ftparchive: sort discovered filenames before writing indexes.
Thanks to Chris Lamb for initial patch & Stefan Lippers-Hollmann for testing
(Closes: 869557)
* don't keep configuration files open needlessly
* don't hang if multiple sources use unavailable method (Closes: 870675)
[ Beatrice Torracca ]
* Italian manpage translation update (Closes: 858877)
[ Apollon Oikonomopoulos ]
* Handle supported components with slashes in sources.list (Closes: #868127)
[ Julian Andres Klode ]
* Drop cacheiterators.h include
* methods/aptmethod.h: Add missing fileutl.h include
* Reformat and sort all includes with clang-format
* cacheiterators: Warn about direct include and don't include pkgcache.h
* Update gitignore with new files
* Use C++11 threading support instead of pthread
* Always warn if --force-yes is validly specified, not just if used
* Work around float rounding change in gcc 7 on i386
* Handle GCC 7 std::string operator ABI break (Closes: #871275)
* debian: Update symbols for libapt-pkg5.0
[ Paul Wise ]
* Support zero delay for the various APT::Periodic activities
* Support seconds, minutes, hours and days for APT::Periodic intervals
* Switch from /org to /srv in example apt-ftparchive configuration
[ Balint Reczey ]
* Gracefully terminate process when stopping apt-daily-upgrade (LP: #1690980)
[ Dominik ]
* doc: Add '--allow-unauthenticated' to '--force-yes'
-- Julian Andres Klode <email address hidden> Thu, 17 Aug 2017 19:28:00 +0200
-
apt (1.5~beta1) unstable; urgency=medium
[ Julian Andres Klode ]
* Make Verify-Host and Verify-Peer independent again
* http: A response with Content-Length: 0 has no content
* Ignore download order in test-apt-update-failure-propagation
* tls: Add more details to error messages, and detect more errors
* Do not error out, only warn if ca certificates are not available
[ David Kalnischkies ]
* don't set ip addresses as server names for SNI
[ Алексей Шилин ]
* Russian translation update (Closes: #866749)
-- Julian Andres Klode <email address hidden> Mon, 03 Jul 2017 16:57:59 +0200
