add testcase and update changelog

[apt.git] / debian / changelog

diff --git a/debian/changelog b/debian/changelog
index ddbc8de89e624e48cdbb72d0c9f0956d5ff9db87..3ef652c56721a4c3d893ad6c12e55b56c4481a7c 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,9 +1,53 @@
-apt (0.9.7.7) UNRELEASED; urgency=low
+apt (0.9.7.9) UNRELEASED; urgency=low
+
+  [ David Kalnischkies ]
+  * apt-pkg/indexcopy.cc:
+    - rename RunGPGV to ExecGPGV and move it to apt-pkg/contrib/gpgv.cc
+  * apt-pkg/contrib/gpgv.cc:
+    - ExecGPGV is a method which should never return, so mark it as such
+      and fix the inconsistency of returning in error cases
+    - don't close stdout/stderr if it is also the statusfd
+    - if ExecGPGV deals with a clear-signed file it will split this file
+      into data and signatures, pass it to gpgv for verification and
+      recombines it after that in a known-good way without unsigned blocks
+      and whitespaces resulting usually in more or less the same file as
+      before, but later code can be sure about the format
+  * apt-pkg/acquire-item.cc:
+    - keep the last good InRelease file around just as we do it with
+      Release.gpg in case the new one we download isn't good for us
+  * apt-pkg/deb/debmetaindex.cc:
+    - reenable InRelease by default
+  
+  [ Michael Vogt ]
+  * add regression test for CVE-2013-1051
+  * implement GPGSplit() based on the idea from Ansgar Burchardt
+    (many thanks!)
+
+ -- David Kalnischkies <kalnischkies@gmail.com>  Fri, 15 Mar 2013 14:15:43 +0100
+
+apt (0.9.7.8) unstable; urgency=criticial
+
+  * SECURITY UPDATE: InRelease verification bypass
+    - CVE-2013-1051
+  
+  [ David Kalnischk ]
+  * apt-pkg/deb/debmetaindex.cc,
+    test/integration/test-bug-595691-empty-and-broken-archive-files,
+    test/integration/test-releasefile-verification:
+    - disable InRelease downloading until the verification issue is
+      fixed, thanks to Ansgar Burchardt for finding the flaw
+
+ -- Michael Vogt <mvo@debian.org>  Thu, 14 Mar 2013 07:47:36 +0100
+
+apt (0.9.7.7) unstable; urgency=low
 
   [ Program translation updates ]
   * Catalan (Jordi Mallach)
   * Drop a confusing non-breaking space. Closes: #691024
   * Thai (Theppitak Karoonboonyanan). Closes: #691613
+  * Vietnamese (Trần Ngọc Quân). Closes: #693773
+  * Fix Plural forms in German, French, Japanese and Portuguese
+    translations. Thanks to Jakub Wilk for reporting these errors.
 
   [ David Kalnischkies ]
   * apt-pkg/packagemanager.cc:
@@ -20,8 +64,15 @@ apt (0.9.7.7) UNRELEASED; urgency=low
   * apt-pkg/algorithms.cc:
     - ensure pkgProblemResolver calls MarkDelete without FromUser set
       so that it can't overrule holds and the protection flag
+  
+  [ Michael Vogt ]
+  * change permissions of /var/log/apt/term.log to 0640 (LP: #975199)
+
+  [ Jonathan Thomas ]
+  * apt-pkg/algorithms.cc:
+    - fix package-pointer array memory leak in ResolveByKeepInternal()
 
- -- Jordi Mallach <jordi@debian.org>  Thu, 18 Oct 2012 23:30:46 +0200
+ -- Michael Vogt <mvo@debian.org>  Thu, 13 Dec 2012 09:52:19 +0100
 
 apt (0.9.7.6) unstable; urgency=low