Discussion:
Bug#910941: apt-get changelog uses insecure HTTP for Debian
Ben Hutchings
2018-10-13 16:06:37 UTC
Permalink
Package: apt
Version: 1.7.0
Severity: normal

The default value of Acquire::Changelogs::URI::Origin::Debian is
"http://metadata.ftp-master.debian.org/changelogs/@***@_changelog".

Since metadata.ftp-master.debian.org supports HTTP-S and redirects to
the https: scheme, the URL should be changed to use it from the start.

Ben.
David Kalnischkies
2018-10-13 23:48:12 UTC
Permalink
Control: clone -1 -2
Control: severity -1 wishlist
Control: reassign -2 ftp.debian.org
Post by Ben Hutchings
The default value of Acquire::Changelogs::URI::Origin::Debian is
Note that this value is not used as long as the Release file contains
a Changelogs: field – which has the same value ATM.

So, for your local setup you will need:
Acquire::Changelogs::URI::Override::Origin::Debian "tor+http://cmgvqnxjoiqthvrc.onion/changelogs/@***@_changelog";
(expect, in your case https instead of tor and hidden service of course)

That is so that any repository can provide changelogs for its packages –
and that the URI can be changed without changing apt which has happened
historically a few times before this mechanism was introduced ~3 years
ago.
Post by Ben Hutchings
Since metadata.ftp-master.debian.org supports HTTP-S and redirects to
the https: scheme, the URL should be changed to use it from the start.
I think the apt client is exempt from such an automatic redirect.
The "reason" is that apt < 1.5 has no built-in support for https and needs
apt-transport-https installed.

Changing that value now means that changelog wont work for stable users
anymore who are trying to access newer Debian releases as long as they
haven't a-t-https installed – but that might be acceptable.
On the other hand we could drop the entry in the Release file for now so
that stable uses http and we change apt/unstable to use https
 decisions
decisions, but that is for ftp/dakmasters to worry about. ;)


Sadly, I haven't thought about allowing this field to be multiline to
give multiple URIs – then again, it might be for the best as that would
turn complicated fast.


Best regards

David Kalnischkies
Debian Bug Tracking System
2018-10-13 23:57:05 UTC
Permalink
Post by David Kalnischkies
clone -1 -2
Bug #910941 [apt] apt-get changelog uses insecure HTTP for Debian
Bug 910941 cloned as bug 910972
Post by David Kalnischkies
severity -1 wishlist
Bug #910941 [apt] apt-get changelog uses insecure HTTP for Debian
Severity set to 'wishlist' from 'normal'
Post by David Kalnischkies
reassign -2 ftp.debian.org
Bug #910972 [apt] apt-get changelog uses insecure HTTP for Debian
Bug reassigned from package 'apt' to 'ftp.debian.org'.
No longer marked as found in versions apt/1.7.0.
Ignoring request to alter fixed versions of bug #910972 to the same values previously set
--
910941: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=910941
910972: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=910972
Debian Bug Tracking System
Contact ***@bugs.debian.org with problems
Debian Bug Tracking System
2018-10-14 19:24:04 UTC
Permalink
tag -1 pending
Bug #910941 [apt] apt-get changelog uses insecure HTTP for Debian
Added tag(s) pending.
--
910941: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=910941
Debian Bug Tracking System
Contact ***@bugs.debian.org with problems
Ben Hutchings
2018-10-14 20:04:56 UTC
Permalink
Post by David Kalnischkies
Control: clone -1 -2
Control: severity -1 wishlist
Control: reassign -2 ftp.debian.org
Post by Ben Hutchings
The default value of Acquire::Changelogs::URI::Origin::Debian is
Note that this value is not used as long as the Release file contains
a Changelogs: field – which has the same value ATM.
[...]
Post by David Kalnischkies
That is so that any repository can provide changelogs for its packages –
and that the URI can be changed without changing apt which has happened
historically a few times before this mechanism was introduced ~3 years
ago.
OK, this makes a lot of sense. Presumably the settings in APT will be
removed once all a distribution's supported releases include this
field?
Post by David Kalnischkies
Post by Ben Hutchings
Since metadata.ftp-master.debian.org supports HTTP-S and redirects to
the https: scheme, the URL should be changed to use it from the start.
I think the apt client is exempt from such an automatic redirect.
The "reason" is that apt < 1.5 has no built-in support for https and needs
apt-transport-https installed.
Yes, I remember that problem. My point was that the redirect indicates
that the https: URLs should be considered canonical.
Post by David Kalnischkies
Changing that value now means that changelog wont work for stable users
anymore who are trying to access newer Debian releases as long as they
haven't a-t-https installed – but that might be acceptable.
[...]

That seems like a reasonable thing to require.

Ben.
--
Ben Hutchings
I haven't lost my mind; it's backed up on tape somewhere.
Debian Bug Tracking System
2018-11-12 11:36:08 UTC
Permalink
Your message dated Mon, 12 Nov 2018 11:34:00 +0000
with message-id <E1gMATg-0008Q3-***@fasolo.debian.org>
and subject line Bug#910941: fixed in apt 1.8.0~alpha1
has caused the Debian Bug report #910941,
regarding apt-get changelog uses insecure HTTP for Debian
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ***@bugs.debian.org
immediately.)
--
910941: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=910941
Debian Bug Tracking System
Contact ***@bugs.debian.org with problems
Loading...