Bug#617690: [PATCH] Fix #617690 (APT::Get::AllowUnauthenticated=true always

[David Kalnischkies <kalnischkies+debian@gmail.com>]

Hi Vadim,

On Thu, Sep 19, 2013 at 3:25 PM, Markovtsev Vadim
<v.markovtsev@samsung.com> wrote:
> I seem to fix this issue with the following patch:

The patch itself looks mostly fine by itself, but it breaks the ABI with a
new class-member and other frontends would need to be changed to use this
aswell to benefit from it (I presume aptitude and co has the same problem).

I haven't tested it myself, but does the following might work just aswell?
>From reading #335112 (<- the "Trusted=false" was added to fix it) I have the
impression that it is the actual intention.

diff --git a/apt-pkg/acquire-item.cc b/apt-pkg/acquire-item.cc
index 97b2d1e..49eadb7 100644
--- a/apt-pkg/acquire-item.cc
+++ b/apt-pkg/acquire-item.cc
@@ -1736,12 +1736,6 @@ pkgAcqArchive::pkgAcqArchive(pkgAcquire
*Owner,pkgSourceList *Sources,
       }
    }

-   // "allow-unauthenticated" restores apts old fetching behaviour
-   // that means that e.g. unauthenticated file:// uris are higher
-   // priority than authenticated http:// uris
-   if (_config->FindB("APT::Get::AllowUnauthenticated",false) == true)
-      Trusted = false;
-
    // Select a source
    if (QueueNext() == false && _error->PendingError() == false)
       _error->Error(_("I wasn't able to locate a file for the %s package. "
@@ -1767,10 +1761,13 @@ bool pkgAcqArchive::QueueNext()
       pkgIndexFile *Index;
       if (Sources->FindIndex(Vf.File(),Index) == false)
            continue;
-
-      // only try to get a trusted package from another source if that source
-      // is also trusted
-      if(Trusted && !Index->IsTrusted())
+
+      // "allow-unauthenticated" restores apts old fetching behaviour
+      // that means that e.g. unauthenticated file:// uris are higher
+      // priority than authenticated http:// uris – otherwise trusted
+      // packages can only be downloaded from trusted sources
+      if (Trusted == true && Index->IsTrusted() == false &&
+           _config->FindB("APT::Get::AllowUnauthenticated",false) == false)
         continue;

       // Grab the text package record



Best regards

David Kalnischkies