apt-cache doesn't differentiate sources that share protocol, host, release and archive name

Bug #22354 reported by Debian Bug Importer on 2005-09-23
This bug affects 8 people
Affects Status Importance Assigned to Milestone
apt (Debian)
Fix Released
apt (Ubuntu)
Robert Collins

Bug Description

Automatically imported from Debian bug report #329814 http://bugs.debian.org/329814

Related branches

Debian Bug Importer (debzilla) wrote :
Download full text (5.6 KiB)

Message-ID: <email address hidden>
Date: Fri, 23 Sep 2005 16:23:58 +0200
From: Pierre THIERRY <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: apt-cache doesn't differentiate sources that share protocol, host, release and archive name

Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Package: apt
Severity: serious
Tags: security
Justification: User can think he's installing Debian software when he's not

When multiple sources are used with APT that are hosted on the same host
with the same protocol, and also share combinations of release and
archive (e.g. etch/main), apt-cache policy shows their packages in a
identical form. That has lead me to think that mplayer and transcode had
been accepted in Debian and install a non-official package of ffmpeg,
because I had Christian Marillat's source in my sources.list.

Thus, any source on a server of an official Debian source that contain
packages without security fixes or with additional security holes, whose
version is higher than Debian official packages will lead the user to an
unprotected situation, even if he is cautious of what packages he
installs, in terms of security.

pierre@bateleur:~$ apt-cache policy mplayer-k6
  Install=E9=A0: (aucun)
  Candidat=A0: 1:1.0-pre7-0.0
 Table de version=A0:
     1:1.0-pre7cvs20050716-0.1 0
        500 ftp://ftp.nerim.net sid/main Packages
     1:1.0-pre7-0.0 0
        500 ftp://ftp.nerim.net sarge/main Packages
        990 ftp://ftp.nerim.net etch/main Packages
        100 /var/lib/dpkg/status

pierre@bateleur:~$ apt-cache policy ffmpeg
  Install=E9=A0: 0.cvs20050918-4
  Candidat=A0: 3:20050806-0.2
 Table de version=A0:
     3:20050806-0.2 0
        500 ftp://ftp.nerim.net sid/main Packages
     3:20050427-0sarge0.1 0
        500 ftp://ftp.nerim.net sarge/main Packages
 *** 0.cvs20050918-4 0
        500 ftp://ftp.nerim.net sid/main Packages
        100 /var/lib/dpkg/status
     0.cvs20050313-2 0
        500 ftp://ftp.nerim.net sarge/main Packages
        990 ftp://ftp.nerim.net etch/main Packages

-- Package-specific info:

-- apt-config dump --

APT "";
APT::Architecture "i386";
APT::Build-Essential "";
APT::Build-Essential:: "build-essential";
APT::Default-Release "testing";
Dir "/";
Dir::State "var/lib/apt/";
Dir::State::lists "lists/";
Dir::State::cdroms "cdroms.list";
Dir::State::userstatus "status.user";
Dir::State::status "/var/lib/dpkg/status";
Dir::Cache "var/cache/apt/";
Dir::Cache::archives "archives/";
Dir::Cache::srcpkgcache "srcpkgcache.bin";
Dir::Cache::pkgcache "pkgcache.bin";
Dir::Etc "etc/apt/";
Dir::Etc::sourcelist "sources.list";
Dir::Etc::vendorlist "vendors.list";
Dir::Etc::vendorparts "vendors.list.d";
Dir::Etc::main "apt.conf";
Dir::Etc::parts "apt.conf.d";
Dir::Etc::preferences "preferences";
Dir::Bin "";
Dir::Bin::methods "/usr/lib/apt/methods";
Dir::Bin::dpkg "/usr/bin/dpkg";
DPkg "";
DPkg::Pre-Install-Pkgs "";
DPkg::Pre-Install-Pkgs:: "if dpkg -s apt-listbugs | grep -q '^Status: .* ok=
 installed'; then /usr/sbin/apt-listbugs apt |...


Debian Bug Importer (debzilla) wrote :

Message-Id: <email address hidden>
Date: Fri, 23 Sep 2005 10:42:43 -0700
From: Steve Langasek <email address hidden>
To: <email address hidden>
Subject: severity of 329814 is normal

# Automatically generated email from bts, devscripts version 2.9.4
severity 329814 normal

Matt Zimmerman (mdz) wrote :

Not even remotely critical

David Fraser (davidf) wrote :

Note that with the advent of PPAs this becomes relevant: I cannot tell from which PPA a package is coming, even with specifying -V to apt. The different PPAs are essentially different repositories, so I may only wish to trust packages from certain PPAs.

Not High importance perhaps, but surely not Invalid

Changed in apt:
status: Invalid → New
Changed in apt:
status: New → Confirmed
Ernst (ernst-blaauw) wrote :

Yes, I just installed (with the daily updates) a linux-libc-dev package. I want to disable the PPA repo, but I don't know which of the twenty has offered it.
So, I would also love to have more info from apt-cache. Is this possible (and is it very difficult)?

Matt Zimmerman (mdz) on 2009-09-22
Changed in apt (Ubuntu):
assignee: Matt Zimmerman (mdz) → nobody
Martin Pool (mbp) wrote :

An example of the problems with madison and PPAs:

mbp@grace% apt-cache madison bzr
       bzr | 2.1.0+b1+4878+129~8.10 | http://ppa.launchpad.net karmic/main Packages
       bzr | 2.0.2-1~bazaar1~karmic | http://ppa.launchpad.net karmic/main Packages
       bzr | 2.0.1-1~bazaar1~karmic | http://ppa.launchpad.net karmic/main Packages
       bzr | 2.0.0-0ubuntu1 | http://mirror.internode.on.net karmic/main Packages

How do you know which ppa it is?

Changed in apt (Ubuntu):
assignee: nobody → Robert Collins (lifeless)
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apt -

apt ( lucid; urgency=low

  [ Michael Vogt ]
  * abicheck/
    - add new abitest tester using the ABI Compliance Checker from
  * debian/apt.conf.autoremove:
    - add "oldlibs" to the APT::Never-MarkAuto-Sections as its used
      for transitional packages
  * apt-pkg/deb/dpkgpm.cc:
    - fix backgrounding when dpkg runs (closes: #486222)
  * cmdline/apt-mark:
    - show error on incorrect aguments (LP: #517917), thanks to
      Torsten Spindler
  * cmdline/apt-get.cc:
    - if apt-get source foo=version or foo/distro can not be found,
      error out (LP: #502641)
  * apt-pkg/indexfile.cc:
    - deal correctly with three letter langcodes (LP: #391409)
  * debian/apt.cron.daily:
    - do not look into admin users gconf anymore for the http proxy
      the user now needs to use the "Apply system-wide" UI in the
      gnome-control-center to set it
  * debian/apt.postinst:
    - add set_apt_proxy_from_gconf() and run that once on upgrade if
      there is no proxy configured already system-wide (LP: #432631)
      From that point on gnome-control-center will have to warn if
      the user makes changes to the proxy settings and does not apply
      them system wide

  [ Robert Collins ]
  * Change the package index Info methods to allow apt-cache policy to be
    useful when using several different archives on the same host.
    (Closes: #329814, LP: #22354)
 -- Michael Vogt <email address hidden> Fri, 12 Mar 2010 23:10:52 +0100

Changed in apt (Ubuntu):
status: Confirmed → Fix Released
Changed in apt (Debian):
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Related questions

Remote bug watches

Bug watches keep track of this bug in other bug trackers.