summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2021-04-11io: fix fd leak in error handling pathsTimo Teräs1-5/+20
apk_dir_foreach_file and apk_resolve_[ug]id needs to free the fd in case fdopen/fdopendir fails. Additionally this does not rely on fdopen to fail if openat() returned -1, making sure that we don't call any syscalls with invalid file handle.
2021-03-23apk-tools-2.12.4v2.12.4Timo Teräs1-1/+1
2021-03-19database: do not chroot(".") unless actually necessaryAriadne Conill2-2/+14
If we use default root (/), then we do not have to chroot to run scripts. Use APK_NO_CHROOT flag for this scenario to avoid the chroot. This helps with using apk with bwrap and OSTree. Closes #10736. [TT: backported to 2.12-stable]
2021-03-19del: report correctly package's provides namesTimo Teräs1-9/+21
The code assumed that when package is in world, it would be there by it's primary name. The code is now updated to properly print the package names that are actually present in world. fixes #10718
2021-03-16libfetch: send Proxy-Authorization also for https connectTimo Teräs1-8/+20
fixes #10738
2021-03-13Use correct port when redirectedMartin Vahlensieck1-1/+1
If server redirects from http to https, libfetch detects this, but wrongly uses the old url scheme to determine the port. This subsequently leads to the following OpenSSL error: 139741541575496:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:ssl/record/ssl3_record.c:331: Using the new scheme fixes this. This error message comes from trying to connect to port 80 with TLS, it can also be observed by issuing $ openssl s_client -connect alpinelinux.org:80 This bug was introduced in commit: 7158474 libfetch: keep http auth only if redirect is for the same host
2021-02-07apk-tools-2.12.3v2.12.3Timo Teräs1-1/+1
2021-02-07db: fix control character check to use uint8_tTimo Teräs1-2/+2
fixes #10737
2021-02-07apk-tools-2.12.2v2.12.2Timo Teräs1-1/+1
2021-02-07db: consider control characters in filename as maliciousTimo Teräs3-11/+25
Especially a newline can produce havoc in the database file as the filename is written there as-is. This hardenes the extraction to consider any control character as malicious. Additional hardening is added to database loading to better detect corrupt state and return proper error code about it. Reported-by: Luca Weiss <luca@z3ntu.xyz>
2021-02-07io: Handle really long linesOlliver Schinagl3-19780/+1
While commit 18b0b45 (io: Handle long lines, Thu Jan 7 17:25:23 2021 +0100) did attempt to address this issue, the buffer really is still to small when dealing with big-big dependency lists. Lets make it sufficiently large for now, until the new APKINDEX format can support multi-line dependencies, making this not needed any more. [TT: Originally the buffer size was conservative to run on resource constrained embedded platforms. But since the available memory on those has also increased much, the adjustment to 128kB makes sense also to increase performance a little bit. Removing also the iolimit test.] Signed-off-by: Olliver Schinagl <oliver@schinagl.nl>
2021-02-07gunzip: fix false end-of-file condition in rare circumstancesTimo Teräs1-1/+1
It turns out inflate() can output zero bytes, even if it consumed data. This had the unfortunate side effect of returning zero bytes (end-of-file) condition before calling the boundary callbacks. This fixes the logic to not return zero reads on gzip boundary. In practice this fixes the seldom seen issues of apk reporting bad signature (when it was correct).
2021-01-19apk-tools-2.12.1v2.12.1Timo Teräs1-1/+1
2021-01-19libfetch: harden URL parsingTimo Teräs1-11/+28
Treat URLs with too long individual components as malformed instead of silently truncating that field. There might be unexpected results if hostname, username or password field gets truncated.
2021-01-19libfetch: fix connection pooling for proxied http/https requestsTimo Teräs4-15/+14
The connection pooling was broken in two ways: 1. The original URL was always used as the connection pool URL, resulting in duplicate connections to the proxy for http URLs (each http URL would get separate proxy connection) 2. The cache_url stored was always the socket level connect URL. In case of HTTPS, the lookup was done done with the real URL, but the proxy URL was stored as the "cache URL". Thus HTTPS CONNECT connections were never re-used. This fixes the code with following logic: 1. The cache key url is the real URL when no-proxy, or when HTTPS with proxy (the socket is connected to proxy, but logically it is connected to the real URL due to HTTP CONNECT request). And for HTTP with proxy, it's the proxy URL so same proxy connection can be reused for all requests going through it. 2. fetch_connect() now gets cache key URL separately, and it always gets the same value as the fetch_cache_get() calls.
2021-01-19libfetch: fix use-after-free in connection cache managementTimo Teräs1-3/+3
fixes #10734
2021-01-19libfetch: fix parsing of proxy response to CONNECT requestsConny Seifert1-6/+1
Instead of skipping just one line, properly parse the response headers. [TT: reworded commit message]
2021-01-17libfetch: support for CIDR subnets in no_proxy/NO_PROXYTimo Teräs1-1/+65
This enables matching numeric hosts against CIDR style subnet matches in no_proxy environment variable. Based on work by Thermi. Co-authored-by: Noel Kuntze <noel.kuntze@thermi.consulting>
2021-01-17man info: --install-if and --rinstall-if do not have short optionsTimo Teräs1-7/+7
Commit e4aae45f removed the short options. Update the documentation. Fixes #10733
2021-01-14database.c: Fixed package DESCRIPTION parsingthibault.ferrante2-1/+2
Regression introduced by 0fb0d30 which makes parsing a description a critical failure. [TT: Minor stylistic change. Fix also missing final line change from the earlier commit]
2021-01-11io: Handle long linesthibault.ferrante1-1/+1
As an APKINDEX can become arbitrarely long due to dependencies and other parameters, increasing the buffer size make this less likely to happens. Closes #10731.
2021-01-11database: Propagate errors when loading an APKINDEXthibault.ferrante10-19/+19815
In case of failure when loading an APKINDEX, no errors are propagated to the user which may uncorrectly interpret the current problem.
2021-01-08libfetch: Increase URL password lengthMike Detwiler1-1/+1
Signed-off-by: Mike Detwiler <det@shift5.io>
2020-12-29apk_update: use URL_PRINTFAlex Denes1-2/+4
2020-11-11manual: Add missing rAlex Denes1-1/+1
2020-11-10manual: Fix wrong argument nameAlex Denes1-1/+1
2020-10-09apk-tools-2.12.0v2.12.0Timo Teräs1-1/+1
2020-10-07various changes to make clang not give warningsTimo Teräs5-14/+19
2020-10-06apk-tools-2.12.0_rc2v2.12.0_rc2Timo Teräs1-1/+1
2020-10-06db: make the --repositories-file change more announcedTimo Teräs2-5/+10
Document the version when changed. And print error with similar note if the given repositories-file cannot be read.
2020-10-06libfetch: keep http auth only if redirect is for the same hostTimo Teräs1-1/+7
fixes #10688
2020-10-06database: automatically create missing cache dirPaul Spooren1-0/+6
On some systems the `/var/` dir is mounted in a tmpfs which is reseted after each reboot. For that reason no post-install script can handle the creation of the cache dir at `/var/cache/apk`. Check on database opnening if the folder is available, if not create it. Fixes #10715 Signed-off-by: Paul Spooren <mail@aparcar.org>
2020-10-05db: make --repositories-file relative to host rootTimo Teräs2-4/+4
It used to be relative to the --root specified root, but that causes issues with relative command line filenames and is unintuitive. Update documentation accordingly. Fixes #10702.
2020-10-05db: mask password component of printed URLsTimo Teräs3-12/+55
fixes #10710
2020-10-03commit: rephrase the error messages more understandableTimo Teräs17-19/+19
fixes #10703
2020-10-01db: check cache only if some repositories are enabledTimo Teräs1-1/+1
2020-09-28Implement upgrade --prune to remove stale world dependenciesTimo Teräs4-6/+68
2020-08-29database: clarify the deprecation notice for checksum-less packagesAriadne Conill1-3/+7
Closes #10708.
2020-08-29update mailmap with my newer emailAriadne Conill1-0/+2
2020-08-26fix --repository short option to be -X as beforeTimo Teräs1-1/+1
unintentional regression from commit edb45ae464 fixes #10707
2020-08-25build: make soname explicit and simplify and fix soname linkTimo Teräs1-18/+10
2020-08-25apk-tools-2.12.0_rc1v2.12.0_rc1Timo Teräs2-1/+3
2020-08-24fix, simplify and document upgrade --ignoreTimo Teräs5-31/+24
2020-08-24solver: add more dbg_printfsOliver Smith1-19/+62
2020-08-24enforce options definitions to bind the enum and the descriptorTimo Teräs15-288/+175
This uses some macro trickery to make sure that there's one-to-one mapping with the option index enum and the descriptor. The down side is that enum's are generated via #define's and editors might not pick them up for auto completion, but the benefits are more: it's no longer possible have mismatching enum value and descriptor index, and the amount of source code lines is less.
2020-07-30test: add test for granular upgradeAriadne Conill3-0/+31
2020-07-30upgrade: allow for specified package upgradesAriadne Conill2-1/+23
Fixes #10667 and #10700
2020-05-29libfetch: implement default port for HTTPS.Ariadne Conill2-0/+3
If getservbyname() fails, libfetch will attempt to connect to port 0.
2020-05-28gitignore: add generated help.h headerAriadne Conill1-0/+1
2020-05-27database: create additional device nodes when initializing root fsAriadne Conill1-0/+4
Some triggers and maintainer scripts depend on /dev/random, /dev/urandom, /dev/zero and /dev/console.
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-11-07 23:11:55 +0000