apt-get --allow-unauthenticated still prefers authenticated packages on network to unauthenticated on localhost
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
apt (Debian) |
Fix Released
|
Unknown
|
|||
apt (Ubuntu) |
Fix Released
|
High
|
Michael Vogt |
Bug Description
Automatically imported from Debian bug report #335112 http://
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#1 |
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#2 |
On Fri, Oct 21, 2005 at 05:25:25PM -0700, Steve Langasek wrote:
> The obvious
> workaround here would be to not list apt sources in your configuration that
> you don't actually want apt to use...
So I guess my bug report wasn't clean enough on what is required: the
sources should be used (for example for packages which are newer on
these sources), but with lower priority than the sources on the local
drive. As in previous versions of apt, that is.
--
David A. Madore
(<email address hidden>,
http://
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#3 |
On Sat, Oct 22, 2005 at 02:41:18AM +0200, David Madore wrote:
> On Fri, Oct 21, 2005 at 05:25:25PM -0700, Steve Langasek wrote:
> > The obvious
> > workaround here would be to not list apt sources in your configuration that
> > you don't actually want apt to use...
> So I guess my bug report wasn't clean enough on what is required: the
> sources should be used (for example for packages which are newer on
> these sources), but with lower priority than the sources on the local
> drive. As in previous versions of apt, that is.
No, that's clear; I just don't consider this release critical.
--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
<email address hidden> http://
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #4 |
Automatically imported from Debian bug report #335112 http://
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #5 |
Message-ID: <email address hidden>
Date: Sat, 22 Oct 2005 02:16:39 +0200
From: David Madore <email address hidden>
To: <email address hidden>
Subject: apt-get --allow-
unauthenticated on localhost
Package: apt
Version: 0.6.41
Severity: serious
The --allow-
pre-0.6.27 behavior: even when this flag is passed on the command
line, apt still favors an authenticated package on the network to an
unauthenticated package on the local host (say with a file:/// URL in
the sources.list).
No combination of switches seems to be sufficient to _completely_
remove any kind of authentication-
pre-0.6.27 behavior in all respects).
This severely breaks very-low-bandwidth systems where it is assumed
that the local package set will be favored over the networked ones.
--
David A. Madore
(<email address hidden>,
http://
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #6 |
Message-ID: <email address hidden>
Date: Fri, 21 Oct 2005 17:25:25 -0700
From: Steve Langasek <email address hidden>
To: David Madore <email address hidden>, <email address hidden>
Subject: Re: Bug#335112: apt-get --allow-
network to unauthenticated on localhost
--6TrnltStXW4iwmi0
Content-Type: text/plain; charset=us-ascii
Content-
Content-
severity 335112 important
thanks
On Sat, Oct 22, 2005 at 02:16:39AM +0200, David Madore wrote:
> Package: apt
> Version: 0.6.41
> Severity: serious
> The --allow-
> pre-0.6.27 behavior: even when this flag is passed on the command
> line, apt still favors an authenticated package on the network to an
> unauthenticated package on the local host (say with a file:/// URL in
> the sources.list).
> No combination of switches seems to be sufficient to _completely_
> remove any kind of authentication-
> pre-0.6.27 behavior in all respects).
> This severely breaks very-low-bandwidth systems where it is assumed
> that the local package set will be favored over the networked ones.
This does not fit the description of a severity: serious bug. The obvious
workaround here would be to not list apt sources in your configuration that
you don't actually want apt to use...
--=20
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
<email address hidden> http://
--6TrnltStXW4iwmi0
Content-Type: application/
Content-
Content-
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFDWYb1KN6
6b/9go1HRZcFkXh
=5HZb
-----END PGP SIGNATURE-----
--6TrnltStXW4iw
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #7 |
Message-ID: <email address hidden>
Date: Sat, 22 Oct 2005 02:41:18 +0200
From: David Madore <email address hidden>
To: Steve Langasek <email address hidden>
Cc: <email address hidden>
Subject: Re: Bug#335112: apt-get --allow-
network to unauthenticated on localhost
On Fri, Oct 21, 2005 at 05:25:25PM -0700, Steve Langasek wrote:
> The obvious
> workaround here would be to not list apt sources in your configuration that
> you don't actually want apt to use...
So I guess my bug report wasn't clean enough on what is required: the
sources should be used (for example for packages which are newer on
these sources), but with lower priority than the sources on the local
drive. As in previous versions of apt, that is.
--
David A. Madore
(<email address hidden>,
http://
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #8 |
Message-ID: <email address hidden>
Date: Fri, 21 Oct 2005 17:54:35 -0700
From: Steve Langasek <email address hidden>
To: David Madore <email address hidden>
Cc: <email address hidden>
Subject: Re: Bug#335112: apt-get --allow-
network to unauthenticated on localhost
--SLDf9lqlvOQaIe6s
Content-Type: text/plain; charset=us-ascii
Content-
Content-
On Sat, Oct 22, 2005 at 02:41:18AM +0200, David Madore wrote:
> On Fri, Oct 21, 2005 at 05:25:25PM -0700, Steve Langasek wrote:
> > The obvious
> > workaround here would be to not list apt sources in your configuration =
that
> > you don't actually want apt to use...
> So I guess my bug report wasn't clean enough on what is required: the
> sources should be used (for example for packages which are newer on
> these sources), but with lower priority than the sources on the local
> drive. As in previous versions of apt, that is.
No, that's clear; I just don't consider this release critical.
--=20
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
<email address hidden> http://
--SLDf9lqlvOQaIe6s
Content-Type: application/
Content-
Content-
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFDWY3LKN6
JVCYSM83Eyyywpu
=MIR8
-----END PGP SIGNATURE-----
--SLDf9lqlvOQaI
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#9 |
Package: apt
Version: 0.6.41
Followup-For: Bug #335112
Hi
I can confirm this bug. It's absolutely crippling for those individuals who
run local repositories and results in a very serious limitation. There seems
to be no way around this through configuration either, so the only way of
getting around it is to downgrade. I suspect this is not always possible for
everything.
Removing the official sources from /etc/apt/
repository may seem like the perfect temporary solution. However, during
the downloading phase from the official servers, the local archives are
totally ignored and all required packages are downloaded from the remote
server with no regard for those you may already have. This is a serious
waste of bandwidth and disk space as you end up with multiple copies of
identical packages. This may not be the case with complex repositories, but
it is for trival ones.
According to Debian policy, this bug seems to clearly fit into the
"important" severity level. However, I consider this bug more serious than
any other "important" bug I've submitted to date, given the impact it has
and the number of users it is likely to effect. Perhaps a higher priority
"important" level would be worth considering for Debian in the future.
Regards,
Barrie
-- Package-specific info:
-- apt-config dump --
APT "";
APT::Architecture "i386";
APT::Build-
APT::Build-
APT::Cache-Limit "120000000";
APT::Get "";
APT::Get:
Dir "/";
Dir::State "var/lib/apt/";
Dir::State::lists "lists/";
Dir::State::cdroms "cdroms.list";
Dir::State:
Dir::State::status "/var/lib/
Dir::Cache "var/cache/apt/";
Dir::Cache:
Dir::Cache:
Dir::Cache:
Dir::Etc "etc/apt/";
Dir::Etc:
Dir::Etc:
Dir::Etc:
Dir::Etc::main "apt.conf";
Dir::Etc::parts "apt.conf.d";
Dir::Etc:
Dir::Bin "";
Dir::Bin::methods "/usr/lib/
Dir::Bin::dpkg "/usr/bin/dpkg";
DPkg "";
DPkg::Pre-
DPkg::Pre-
DPkg::Post-Invoke "";
DPkg::Post-Invoke:: "if [ -x /usr/bin/debsums ]; then /usr/bin/debsums --generate=nocheck -sp /var/cache/
-- (no /etc/apt/
-- (/etc/apt/
-- System Information:
Debian Release: 3.0
APT prefers unstable
APT policy: (500, 'unstable'), (500, 'testing')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.4.27-bm041127-k7
Locale: LANG=C, LC_CTYPE=C (charmap=
Versions of packages apt depends on:
ii libc6 2.3.5-3 GNU C Library: Shared libraries an
ii libgcc1 1:4.0.1-3 GCC support library
ii libstdc++6 4.0.2-2 The GNU Standard C++ Library v3
-- no debconf information
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #10 |
Message-Id: <email address hidden>
Date: Thu, 27 Oct 2005 05:38:31 +0100
From: Barrie Millar <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: apt: Bug confirmed
Package: apt
Version: 0.6.41
Followup-For: Bug #335112
Hi
I can confirm this bug. It's absolutely crippling for those individuals who
run local repositories and results in a very serious limitation. There seems
to be no way around this through configuration either, so the only way of
getting around it is to downgrade. I suspect this is not always possible for
everything.
Removing the official sources from /etc/apt/
repository may seem like the perfect temporary solution. However, during
the downloading phase from the official servers, the local archives are
totally ignored and all required packages are downloaded from the remote
server with no regard for those you may already have. This is a serious
waste of bandwidth and disk space as you end up with multiple copies of
identical packages. This may not be the case with complex repositories, but
it is for trival ones.
According to Debian policy, this bug seems to clearly fit into the
"important" severity level. However, I consider this bug more serious than
any other "important" bug I've submitted to date, given the impact it has
and the number of users it is likely to effect. Perhaps a higher priority
"important" level would be worth considering for Debian in the future.
Regards,
Barrie
-- Package-specific info:
-- apt-config dump --
APT "";
APT::Architecture "i386";
APT::Build-
APT::Build-
APT::Cache-Limit "120000000";
APT::Get "";
APT::Get:
Dir "/";
Dir::State "var/lib/apt/";
Dir::State::lists "lists/";
Dir::State::cdroms "cdroms.list";
Dir::State:
Dir::State::status "/var/lib/
Dir::Cache "var/cache/apt/";
Dir::Cache:
Dir::Cache:
Dir::Cache:
Dir::Etc "etc/apt/";
Dir::Etc:
Dir::Etc:
Dir::Etc:
Dir::Etc::main "apt.conf";
Dir::Etc::parts "apt.conf.d";
Dir::Etc:
Dir::Bin "";
Dir::Bin::methods "/usr/lib/
Dir::Bin::dpkg "/usr/bin/dpkg";
DPkg "";
DPkg::Pre-
DPkg::Pre-
DPkg::Post-Invoke "";
DPkg::Post-Invoke:: "if [ -x /usr/bin/debsums ]; then /usr/bin/debsums --generate=nocheck -sp /var/cache/
-- (no /etc/apt/
-- (/etc/apt/
-- System Information:
Debian Release: 3.0
APT prefers unstable
APT policy: (500, 'unstable'), (500, 'testing')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.4.27-bm041127-k7
Locale: LANG=C, LC_CTYPE=C (charmap=
Versions of packages apt depends on:
ii libc6 2.3.5-3 GNU C Library: Shared libraries an
ii libgcc1 1:4.0.1-3 GCC support library
ii libstdc++6 ...
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#11 |
On Sat, Oct 22, 2005 at 02:16:39AM +0200, David Madore wrote:
> Package: apt
> Version: 0.6.41
> Severity: serious
Thanks for your bugreport.
> The --allow-
> pre-0.6.27 behavior: even when this flag is passed on the command
> line, apt still favors an authenticated package on the network to an
> unauthenticated package on the local host (say with a file:/// URL in
> the sources.list).
>
> No combination of switches seems to be sufficient to _completely_
> remove any kind of authentication-
> pre-0.6.27 behavior in all respects).
>
> This severely breaks very-low-bandwidth systems where it is assumed
> that the local package set will be favored over the networked ones.
Could you please test if the attached patch fixes the problem?
Cheers,
Michael
--
Linux is not The Answer. Yes is the answer. Linux is The Question. - Neo
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #12 |
Message-ID: <email address hidden>
Date: Wed, 9 Nov 2005 07:27:31 +0100
From: Michael Vogt <email address hidden>
To: David Madore <email address hidden>, <email address hidden>
Subject: Re: Bug#335112: apt-get --allow-
network to unauthenticated on localhost
--SLDf9lqlvOQaIe6s
Content-Type: text/plain; charset=us-ascii
Content-
On Sat, Oct 22, 2005 at 02:16:39AM +0200, David Madore wrote:
> Package: apt
> Version: 0.6.41
> Severity: serious
Thanks for your bugreport.
> The --allow-
> pre-0.6.27 behavior: even when this flag is passed on the command
> line, apt still favors an authenticated package on the network to an
> unauthenticated package on the local host (say with a file:/// URL in
> the sources.list).
>
> No combination of switches seems to be sufficient to _completely_
> remove any kind of authentication-
> pre-0.6.27 behavior in all respects).
>
> This severely breaks very-low-bandwidth systems where it is assumed
> that the local package set will be favored over the networked ones.
Could you please test if the attached patch fixes the problem?
Cheers,
Michael
--
Linux is not The Answer. Yes is the answer. Linux is The Question. - Neo
--SLDf9lqlvOQaIe6s
Content-Type: text/plain; charset=us-ascii
Content-
* looking for <email address hidden>
* comparing to <email address hidden>
* modified files
--- orig/apt-
+++ mod/apt-
@@ -770,6 +770,12 @@
}
}
+ // "allow-
+ // that means that e.g. unauthenticated file:// uris are higher
+ // priority than authenticated http:// uris
+ if (_config-
+ Trusted = false;
+
// Select a source
if (QueueNext() == false && _error-
--SLDf9lqlvOQaI
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#13 |
Source: apt
Source-Version: 0.6.42.3
We believe that the bug you reported is fixed in the latest version of
apt, which is due to be installed in the Debian FTP archive:
apt-doc_
to pool/main/
apt-utils_
to pool/main/
apt_0.6.42.3.dsc
to pool/main/
apt_0.6.42.3.tar.gz
to pool/main/
apt_0.6.
to pool/main/
libapt-
to pool/main/
libapt-
to pool/main/
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Michael Vogt <email address hidden> (supplier of updated apt package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Wed, 9 Nov 2005 07:22:31 +0100
Source: apt
Binary: apt-utils libapt-pkg-doc libapt-pkg-dev apt-doc apt
Architecture: source all i386
Version: 0.6.42.3
Distribution: unstable
Urgency: low
Maintainer: APT Development Team <email address hidden>
Changed-By: Michael Vogt <email address hidden>
Description:
apt - Advanced front-end for dpkg
apt-doc - Documentation for APT
apt-utils - APT utility programs
libapt-pkg-dev - Development files for APT's libapt-pkg and libapt-inst
libapt-pkg-doc - Documentation for APT development
Closes: 329910 333599 335112 335164 335213 337078 337163 337306 337910 337949 338101
Changes:
apt (0.6.42.3) unstable; urgency=low
.
* Merge <email address hidden>
- patch-118: Russian translation update by Yuri Kozlov (closes: #335164)
- patch-119: add update-po as a pre-req for binary (closes: #329910)
- patch-121: Complete French translation
- patch-125: Fixed localization of y/n questions in German translation
- patch-126: Swedish translation update (closes: #337163)
- patch-127: Complete Tagalog translation (closes: #337306)
- patch-128: Danish translation update (closes: #337949)
- patch-129: Basque translation update (closes: #338101)
* cmdline/apt-get.cc:
- bufix in FindSrc (closes: #335213, #337910)
* added armeb to archtable (closes: #333599)
* with --allow-
sources (closes: #335112)
Files:
aef61765106a06
990abfcb7c17fc
bbc5c7579c058f
6464f205e51db4
ade2c242f1b6ac
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #14 |
Message-Id: <email address hidden>
Date: Wed, 09 Nov 2005 20:17:05 -0800
From: Michael Vogt <email address hidden>
To: <email address hidden>
Subject: Bug#335112: fixed in apt 0.6.42.3
Source: apt
Source-Version: 0.6.42.3
We believe that the bug you reported is fixed in the latest version of
apt, which is due to be installed in the Debian FTP archive:
apt-doc_
to pool/main/
apt-utils_
to pool/main/
apt_0.6.42.3.dsc
to pool/main/
apt_0.6.42.3.tar.gz
to pool/main/
apt_0.6.
to pool/main/
libapt-
to pool/main/
libapt-
to pool/main/
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Michael Vogt <email address hidden> (supplier of updated apt package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Wed, 9 Nov 2005 07:22:31 +0100
Source: apt
Binary: apt-utils libapt-pkg-doc libapt-pkg-dev apt-doc apt
Architecture: source all i386
Version: 0.6.42.3
Distribution: unstable
Urgency: low
Maintainer: APT Development Team <email address hidden>
Changed-By: Michael Vogt <email address hidden>
Description:
apt - Advanced front-end for dpkg
apt-doc - Documentation for APT
apt-utils - APT utility programs
libapt-pkg-dev - Development files for APT's libapt-pkg and libapt-inst
libapt-pkg-doc - Documentation for APT development
Closes: 329910 333599 335112 335164 335213 337078 337163 337306 337910 337949 338101
Changes:
apt (0.6.42.3) unstable; urgency=low
.
* Merge <email address hidden>
- patch-118: Russian translation update by Yuri Kozlov (closes: #335164)
- patch-119: add update-po as a pre-req for binary (closes: #329910)
- patch-121: Complete French translation
- patch-125: Fixed localization of y/n questions in German translation
- patch-126: Swedish translation update (closes: #337163)
- patch-127: Complete Tagalog translation (closes: #337306)
- patch-128: Danish translation update (closes: #337949)
- patch-129: Basque translation update (closes: #338101)
* cmdline/apt-get.cc:
- bufix in FindSrc (closes: #335213, #337910)
* added armeb to archtable (closes: #333599)
* with --allow-
sources (closes: #335112)
Files:
aef61765106a06
990abfcb7c17fc
...
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Michael Vogt (mvo) wrote : | #15 |
We have this fix in dapper now.
severity 335112 important
thanks
On Sat, Oct 22, 2005 at 02:16:39AM +0200, David Madore wrote:
> Package: apt
> Version: 0.6.41
> Severity: serious
> The --allow- unauthenticated option does not revert to the exact
> pre-0.6.27 behavior: even when this flag is passed on the command
> line, apt still favors an authenticated package on the network to an
> unauthenticated package on the local host (say with a file:/// URL in
> the sources.list).
> No combination of switches seems to be sufficient to _completely_ related feature (and revert to the
> remove any kind of authentication-
> pre-0.6.27 behavior in all respects).
> This severely breaks very-low-bandwidth systems where it is assumed
> that the local package set will be favored over the networked ones.
This does not fit the description of a severity: serious bug. The obvious
workaround here would be to not list apt sources in your configuration that
you don't actually want apt to use...
-- www.debian. org/
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
<email address hidden> http://