{"push_id":1082319284,"size":86,"distinct_size":14,"ref":"refs/heads/master-pu","head":"516ee81f1c33c18219b6c5d951e92dc24ca00f75","before":"b8c10f2c9686e3a2d7aa40c8adc262e30439e9bb","commits":[{"sha":"20d4340a33c427dd03b84bcdecd71a5e507926e0","author":{"email":"d2545f4f231c5ee12c0323ba407d7abcc5d0de2a@yucom.be","name":"Frans Spiesschaert"},"message":"Dutch program translation update\n\nCloses: 817060","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/20d4340a33c427dd03b84bcdecd71a5e507926e0"},{"sha":"0eb1cd52c8a92f6dc33efb80146d80856529ebea","author":{"email":"d2545f4f231c5ee12c0323ba407d7abcc5d0de2a@yucom.be","name":"Frans Spiesschaert"},"message":"Dutch manpages translation update\n\nCloses: 817062","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/0eb1cd52c8a92f6dc33efb80146d80856529ebea"},{"sha":"e457c94165c9c4dfef8cea7c2f716700d1c84b3f","author":{"email":"e50a3ffded081cb812f3d0e1ef2861b357865fe5@debian.org","name":"Julian Andres Klode"},"message":"Use native architecture instead of amd64 for build-dep-purge test\n\nUsing amd64 broke the test case on non-amd64 architectures. Query\nthe native architecture from dpkg and use that instead.\n\nThe definition of NATIVE is copied from the test\ntest-architecture-specification-parsing.","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/e457c94165c9c4dfef8cea7c2f716700d1c84b3f"},{"sha":"51c04562559d0924aa52cc8c9b69901bc8a5c945","author":{"email":"e50a3ffded081cb812f3d0e1ef2861b357865fe5@debian.org","name":"Julian Andres Klode"},"message":"Do not consider SHA1 usable\n\nSHA1 is not reasonably secure anymore, so we should not consider it\nusable anymore. The test suite is adjusted to account for this.","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/51c04562559d0924aa52cc8c9b69901bc8a5c945"},{"sha":"f345d0571d055c2cd5da3a9e423753f1ac21a9aa","author":{"email":"e50a3ffded081cb812f3d0e1ef2861b357865fe5@debian.org","name":"Julian Andres Klode"},"message":"Test that SHA1-only .diff/Index files are not used\n\nEnsure that .diff/Index files that only contain SHA1 values and no\nSHA2 values are not used.","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/f345d0571d055c2cd5da3a9e423753f1ac21a9aa"},{"sha":"8d0d92558c00d1825e413ce67be51a46a5c18aea","author":{"email":"aa743a0aaec8f7d7a1f01442503957f4d7a2d634@kalnischkies.de","name":"David Kalnischkies"},"message":"test: remove SHA1 support testing as unsupported\n\nGiven that we refuse to use SHA1-only .diff/Indexes no point in shipping\nand running code which pretends to check support for it which given that\nall these tests are run 3 times eats a noticeable amount of time.\n\nGit-Dch: Ignore","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/8d0d92558c00d1825e413ce67be51a46a5c18aea"},{"sha":"4a808deaac462e7714a345dac676c6da294a2ee0","author":{"email":"aa743a0aaec8f7d7a1f01442503957f4d7a2d634@kalnischkies.de","name":"David Kalnischkies"},"message":"require $(HASH)-Download field in .diff/Index files\n\nNow that we ignore SHA1-only files it makes sense to require also the\nprovision of hashes for the compressed patches as this was introduced in\nthe same patchset as support for non-SHA1 hashes in the file itself in\ndak and adding support in other archive creators (if they support pdiffs\nat all) will likely be in the same batch.\n\nThe reason for the change itself is simple: If you are 'scared' enough\nabout the security of SHA1, you shouldn't uncompress a file you haven't\nverified at all – after all, it could be exploiting a bug or a zip bomb.","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/4a808deaac462e7714a345dac676c6da294a2ee0"},{"sha":"12f40394b3940573c0e63d74722a95148fb1ad39","author":{"email":"aa743a0aaec8f7d7a1f01442503957f4d7a2d634@kalnischkies.de","name":"David Kalnischkies"},"message":"aptwebserver: fix html validation issues\n\nIceweasel^WFirefox complains about the missing encoding in its console\nwhich can be a bit annoying in interactive sessions, so fixing these\nissues has no effect on apt itself, but on the testers.\n\nGit-Dch: Ignore","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/12f40394b3940573c0e63d74722a95148fb1ad39"},{"sha":"915f4ac6d9ae239bd1aef47892075d019ec8b581","author":{"email":"aa743a0aaec8f7d7a1f01442503957f4d7a2d634@kalnischkies.de","name":"David Kalnischkies"},"message":"flush line-clearing on progress stop before post-invoke\n\nAll other interactions with std::cout are flushed directly, just in the\nstop case we hadn't done it – no problem expect if there is still output\ncoming after apt is done like in the case of a post-invoke script\nproducing output.\n\nCloses: 793672","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/915f4ac6d9ae239bd1aef47892075d019ec8b581"},{"sha":"6a1de8b79299ca1152106361aa6b41730635c5cc","author":{"email":"aa743a0aaec8f7d7a1f01442503957f4d7a2d634@kalnischkies.de","name":"David Kalnischkies"},"message":"streamline dpkgpm cleanup-handling\n\nThe (unlikely) waitpid failure case should fallthrough the code just\nlike the other failures (and successes) instead of taking a shortcut\navoiding all the cleanup (progress) and finishing touches (log, state).\n\nThis also delays the cleanup of the progress until apt is really done\nwith everything and \"just\" has the post-invokes left to do, so the\nperiod of 'apt looks finished as it stopped the progress' and 'apt\nreally finished as I have the shell-prompt back' is shorter even if\nthere is no progress reported anymore, so the bar lingers at 100%…\n\nIdeally even the post-invokes would be covered by progress, but they\ncan have their own output and dealing with that could be hard.\n\nGit-Dch: Ignore","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/6a1de8b79299ca1152106361aa6b41730635c5cc"},{"sha":"b7a1076f18022cbeb7baf4d82ab8bae0f725a573","author":{"email":"aa743a0aaec8f7d7a1f01442503957f4d7a2d634@kalnischkies.de","name":"David Kalnischkies"},"message":"don't use Desc.URI to calculate .diff/Index filenames\n\nThe URI descibing an item can change via mirrors/redirectors which\ncauses the .diff/Index files to get the wrong names in storage.\n\nGit-Dch: Ignore","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/b7a1076f18022cbeb7baf4d82ab8bae0f725a573"},{"sha":"d4c45145553781418c25343ac1478f62da645851","author":{"email":"aa743a0aaec8f7d7a1f01442503957f4d7a2d634@kalnischkies.de","name":"David Kalnischkies"},"message":"enforce verify of filesize in 'apt-get source'\n\nThe structure we parse the data into has a dedicated size field, but it\ntends to be easier to handle it as a (very weak) checksum.","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/d4c45145553781418c25343ac1478f62da645851"},{"sha":"a4b5567d5e989229a77227f30cfa36110bd12ec6","author":{"email":"dfee7978d2c0dce40f6f4aba7cf1c8bd4fa506af@openmailbox.org","name":"Manuel \"Venturi\" Porras Peralta"},"message":"Spanish apt-mark translation fix\n\n\"%s can not be marked as it is not installed.\" was incorrectly\ntranslated as \"%s no se puede marcar como no instalado.\\n\",\nwhich means \"%s can not be marked as not installed.\"\n\nThanks to Marcos Del Sol Vives for reporting & to the spanish\ntranslation team – and in particular Camaleón and Venturi –\nfor review and correction of this issue!\n\n[commit message by commiter]\n\nCloses: 817999","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/a4b5567d5e989229a77227f30cfa36110bd12ec6"},{"sha":"493a813e8a743cfe763bf5eb18073ef9f51dabc2","author":{"email":"e50a3ffded081cb812f3d0e1ef2861b357865fe5@debian.org","name":"Julian Andres Klode"},"message":"test: Use SHA512 digests for GPG, reject SHA1-based signatures\n\nThis makes the test suite safe if we ever need to reject SHA1\nsignatures in an update.","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/493a813e8a743cfe763bf5eb18073ef9f51dabc2"},{"sha":"0cbb7e29c5dad2178896d8eaf41ad616bb0111da","author":{"email":"e50a3ffded081cb812f3d0e1ef2861b357865fe5@debian.org","name":"Julian Andres Klode"},"message":"test: Move --weak-digest initialization to the right place\n\nThis was wrong and caused some issues because apt-key invoked\nhost apt-config with our library.\n\nGbp-Dch: ignore","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/0cbb7e29c5dad2178896d8eaf41ad616bb0111da"},{"sha":"76a71a1237d22c1990efbc19ce0e02aacf572576","author":{"email":"e50a3ffded081cb812f3d0e1ef2861b357865fe5@debian.org","name":"Julian Andres Klode"},"message":"Handle ERRSIG in the gpgv method like BADSIG\n\nERRSIG is created whenever a key uses an unknown/weak digest\nalgorithm, for example. This allows us to report a more useful\nerror than just \"unknown apt-key error.\":\n\nThe following signatures were invalid: ERRSIG 13B00F1FD2C19886 1 2 01 1457609403 5\n\nWhile still not being the best reportable error message, it's\nbetter than unknown apt-key error and hopefully redirects users\nto complain to their repository owners.","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/76a71a1237d22c1990efbc19ce0e02aacf572576"},{"sha":"0d80586a67622d4d58908fee41c3be8a6813d426","author":{"email":"e50a3ffded081cb812f3d0e1ef2861b357865fe5@debian.org","name":"Julian Andres Klode"},"message":"Revert \"Handle ERRSIG in the gpgv method like BADSIG\"\n\nThis reverts commit 76a71a1237d22c1990efbc19ce0e02aacf572576.\n\nThat commit broke the test suite.\n\nGbp-Dch: ignore","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/0d80586a67622d4d58908fee41c3be8a6813d426"},{"sha":"d91051242d10ada198b4ed59d59ad4aa8f59bcaf","author":{"email":"e50a3ffded081cb812f3d0e1ef2861b357865fe5@debian.org","name":"Julian Andres Klode"},"message":"methods/gpgv: Reject weak digest algorithms\n\nThis keeps a list of weak digest algorithms. For now, only MD5\nis disabled, as SHA1 breaks to many repos.","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/d91051242d10ada198b4ed59d59ad4aa8f59bcaf"},{"sha":"56b4c93f60ebdb828bb8d0b9ea2db448560208f5","author":{"email":"7a7d9513d018522a24d3db01345b1cc5b2580b59@gmail.com","name":"Zhou Mo"},"message":"zh_CN.po: fix translation bug. (Closes: #818177)","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/56b4c93f60ebdb828bb8d0b9ea2db448560208f5"},{"sha":"08fd77e83528fd03795524adf76e359ae2b56e06","author":{"email":"e50a3ffded081cb812f3d0e1ef2861b357865fe5@debian.org","name":"Julian Andres Klode"},"message":"methods/gpgv: Correctly handle weak signatures with multiple keys\n\nWe added weak signatures to BadSigners, meaning that a Release file\nsigned by both a weak signature and a strong signature would be\nrejected; preventing people from migrating from DSA to RSA keys\nin a sane way.\n\nInstead of using BadSigners, treat weak signatures like expired\nkeys: They are no good signatures, and they are worthless.\n\nGbp-Dch: ignore","distinct":false,"url":"https://api.github.com/repos/julian-klode/apt/commits/08fd77e83528fd03795524adf76e359ae2b56e06"}]}