handle weak-security repositories as unauthenticated

[apt.git] / apt-pkg / deb / debmetaindex.cc

diff --git a/apt-pkg/deb/debmetaindex.cc b/apt-pkg/deb/debmetaindex.cc
index 71aee3f728c001f577f766f33ebfd17f8494044c..0c9cde620e048f4299ced4b48e890c4d31212678 100644 (file)
--- a/apt-pkg/deb/debmetaindex.cc
+++ b/apt-pkg/deb/debmetaindex.cc
@@ -80,20 +80,19 @@ std::string debReleaseIndex::MetaIndexFile(const char *Type) const
    return _config->FindDir("Dir::State::lists") +
       URItoFileName(MetaIndexURI(Type));
 }
-
-std::string debReleaseIndex::MetaIndexURI(const char *Type) const
+static std::string constructMetaIndexURI(std::string URI, std::string const &Dist, char const * const Type)
 {
-   std::string Res;
-
    if (Dist == "/")
-      Res = URI;
+      ;
    else if (Dist[Dist.size()-1] == '/')
-      Res = URI + Dist;
+      URI += Dist;
    else
-      Res = URI + "dists/" + Dist + "/";
-   
-   Res += Type;
-   return Res;
+      URI += "dists/" + Dist + "/";
+   return URI + Type;
+}
+std::string debReleaseIndex::MetaIndexURI(const char *Type) const
+{
+   return constructMetaIndexURI(URI, Dist, Type);
 }
                                                                        /*}}}*/
 // ReleaseIndex Con- and Destructors                                   /*{{{*/
@@ -441,18 +440,13 @@ bool debReleaseIndex::Load(std::string const &Filename, std::string * const Erro
       }
    }
 
+   bool AuthPossible = false;
    if(FoundHashSum == false)
-   {
-      if (ErrorText != NULL)
-        strprintf(*ErrorText, _("No Hash entry in Release file %s"), Filename.c_str());
-      return false;
-   }
-   if(FoundStrongHashSum == false)
-   {
-      if (ErrorText != NULL)
-        strprintf(*ErrorText, _("No Hash entry in Release file %s which is considered strong enough for security purposes"), Filename.c_str());
-      return false;
-   }
+      _error->Warning(_("No Hash entry in Release file %s"), Filename.c_str());
+   else if(FoundStrongHashSum == false)
+      _error->Warning(_("No Hash entry in Release file %s which is considered strong enough for security purposes"), Filename.c_str());
+   else
+      AuthPossible = true;
 
    std::string const StrDate = Section.FindS("Date");
    if (RFC1123StrToTime(StrDate.c_str(), Date) == false)
@@ -540,8 +534,9 @@ bool debReleaseIndex::Load(std::string const &Filename, std::string * const Erro
       }
    }
 
-   LoadedSuccessfully = TRI_YES;
-   return true;
+   if (AuthPossible)
+      LoadedSuccessfully = TRI_YES;
+   return AuthPossible;
 }
                                                                        /*}}}*/
 metaIndex * debReleaseIndex::UnloadedClone() const                     /*{{{*/
@@ -687,12 +682,19 @@ bool debReleaseIndex::SetSignedBy(std::string const &pSignedBy)
         std::stringstream os;
         std::copy(fingers.begin(), fingers.end(), std::ostream_iterator<std::string>(os, ","));
         SignedBy = os.str();
-        while (SignedBy[SignedBy.size() - 1] == ',')
-           SignedBy.resize(SignedBy.size() - 1);
       }
+      // Normalize the string: Remove trailing commas
+      while (SignedBy[SignedBy.size() - 1] == ',')
+        SignedBy.resize(SignedBy.size() - 1);
+   }
+   else {
+      // Only compare normalized strings
+      auto pSignedByView = APT::StringView(pSignedBy);
+      while (pSignedByView[pSignedByView.size() - 1] == ',')
+        pSignedByView = pSignedByView.substr(0, pSignedByView.size() - 1);
+      if (pSignedByView != SignedBy)
+        return _error->Error(_("Conflicting values set for option %s regarding source %s %s: %s != %s"), "Signed-By", URI.c_str(), Dist.c_str(), SignedBy.c_str(), pSignedByView.to_string().c_str());
    }
-   else if (SignedBy != pSignedBy)
-      return _error->Error(_("Conflicting values set for option %s regarding source %s %s: %s != %s"), "Signed-By", URI.c_str(), Dist.c_str(), SignedBy.c_str(), pSignedBy.c_str());
    return true;
 }
                                                                        /*}}}*/
@@ -912,27 +914,30 @@ class APT_HIDDEN debSLTypeDebian : public pkgSourceList::Type             /*{{{*/
                           std::string const &Dist, std::string const &Section,
                           bool const &IsSrc, std::map<std::string, std::string> const &Options) const
    {
-      debReleaseIndex *Deb = NULL;
-      for (std::vector<metaIndex *>::const_iterator I = List.begin();
-          I != List.end(); ++I)
+      debReleaseIndex * Deb = nullptr;
+      std::string const FileName = URItoFileName(constructMetaIndexURI(URI, Dist, "Release"));
+      for (auto const &I: List)
       {
         // We only worry about debian entries here
-        if (strcmp((*I)->GetType(), "deb") != 0)
+        if (strcmp(I->GetType(), "deb") != 0)
+           continue;
+
+        auto const D = dynamic_cast<debReleaseIndex*>(I);
+        if (unlikely(D == nullptr))
            continue;
 
-        /* This check insures that there will be only one Release file
+        /* This check ensures that there will be only one Release file
            queued for all the Packages files and Sources files it
            corresponds to. */
-        if ((*I)->GetURI() == URI && (*I)->GetDist() == Dist)
+        if (URItoFileName(D->MetaIndexURI("Release")) == FileName)
         {
-           Deb = dynamic_cast<debReleaseIndex*>(*I);
-           if (Deb != NULL)
-              break;
+           Deb = D;
+           break;
         }
       }
 
       // No currently created Release file indexes this entry, so we create a new one.
-      if (Deb == NULL)
+      if (Deb == nullptr)
       {
         Deb = new debReleaseIndex(URI, Dist);
         List.push_back(Deb);