[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#787138: marked as done (apt-ftparchive ignores APT::FTPArchive::Release::SHA512)

Your message dated Mon, 26 Oct 2015 21:07:41 +0100
with message-id <20151026200741.GA29957@crossbow>
and subject line Re: Related bug
has caused the Debian Bug report #787138,
regarding apt-ftparchive ignores APT::FTPArchive::Release::SHA512
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
787138: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=787138
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: apt-utils
Version: 1.0.9.8
I'm using apt-ftparchive to create 'Release' file for a small repository. Since I don't need SHA512 sums, I disabled them in my config. 

--
$ cat repo.conf
--
APT::FTPArchive::Release::Architectures "i386 amd64";
APT::FTPArchive::Release::Suite "stable";
APT::FTPArchive::Release::Codename "jessie";
APT::FTPArchive::Release::Components "main";
APT::FTPArchive::Release::Description "Local repository";
APT::FTPArchive::Release::Label "Local repository";
APT::FTPArchive::Release::Origin "localhost";

APT::FTPArchive::Release::MD5 "true";
APT::FTPArchive::Release::SHA1 "true";
APT::FTPArchive::Release::SHA256 "true";
APT::FTPArchive::Release::SHA512 "false";
--

But when I invoke apt-ftparchive, the SHA512 sums are present.

--
$ apt-ftparchive -c repo.conf release .
--
Architectures: i386 amd64
Codename: jessie
Components: main
Date: Thu, 28 May 2015 23:30:22 UTC
Description: Local repository
Label: Local repository
Origin: localhost
Suite: stable
MD5Sum:
41eaef6ee4fef49b3d7ff89ed1bfae27 1190 dists/stable/main/source/Sources 
SHA1:
24153934d2f9a81a0d17cca384bcbe4f5f844fcc 1190 dists/stable/main/source/Sources 
SHA256:
1e6708f6e7a1ae74dcaf91ae0da057c0bc16cb8592165726184ab18f36b93de6 1190 dists/stable/main/source/Sources 
SHA512:
 0f0704e9fe6e5078dcb9dbc494854209b51556e695c475fd79d7254cc63ea3dc3d167319b1a8a4708cc45a1a1f2a11b5c21e8abb600b94c6fbed605bc99de010 1190 dists/stable/main/source/Sources
--
Just to make sure my config is valid, I changed "true" to "false" for other three hash algorithms, and here is my output. 

--
$ apt-ftparchive -c repo.conf release .
--
Architectures: i386 amd64
Codename: jessie
Components: main
Date: Thu, 28 May 2015 23:14:58 UTC
Description: Local repository
Label: Local repository
Origin: localhost
Suite: stable
SHA512:
 0f0704e9fe6e5078dcb9dbc494854209b51556e695c475fd79d7254cc63ea3dc3d167319b1a8a4708cc45a1a1f2a11b5c21e8abb600b94c6fbed605bc99de010 1190 dists/stable/main/source/Sources
--

SHA512 remains. Like that config item is not taken into account at all.
I checked out the sources, and there is *no* code that looks for "APT::FTPArchive::Release::SHA512" (See https://anonscm.debian.org/cgit/apt/apt.git/tree/ftparchive/writer.cc?h=debian/jessie#n1025). 

I attached a patch that will possibly fix this.

My distro: Fresh Debian GNU/Linux 8 with default repos.

--- writer.cc.original	2015-05-28 23:34:13.335067263 +0000
+++ writer.cc	2015-05-28 23:35:07.396137053 +0000
@@ -1025,6 +1025,7 @@ ReleaseWriter::ReleaseWriter(string cons
    DoMD5 = _config->FindB("APT::FTPArchive::Release::MD5",DoMD5);
    DoSHA1 = _config->FindB("APT::FTPArchive::Release::SHA1",DoSHA1);
    DoSHA256 = _config->FindB("APT::FTPArchive::Release::SHA256",DoSHA256);
+   DoSHA512 = _config->FindB("APT::FTPArchive::Release::SHA512",DoSHA512);
 }
 									/*}}}*/
 // ReleaseWriter::DoPackage - Process a single package			/*{{{*/

--- End Message ---
--- Begin Message --- 
Version: 1.1~exp13

Hi,

On Fri, May 29, 2015 at 05:04:07AM +0300, master wrote:
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=680252
> 
> This is a similar bug. It's strange that it was fixed and this one was not.
> Please make sure that writer.cc looks for every kind of hash-related config
> items.

I think you meant it differently, but the way you say it can be read as if you
would be expecting someone to do that because its somehow his/her job, but it
isn't.

The joy of opensource is that everyone can. The bad thing is that noone is
required to. So, next time you feel like something should be done, you might
step up and do it yourself for the benefit of everyone.


Anyway, I worked on hash generation in apt-ftparchive in your current
experimntal release, so that should be fixed by now and hence closing.


  * do not generate bogus hashes if hash is disabled in apt-ftparchive
  * use APT::FTPArchive hash settings as default for APT::FPArchive::$filetype
  * add --sha512 option + documentation for apt-ftparchive


Best regards

David Kalnischkies

Attachment: signature.asc
Description: PGP signature


--- End Message ---
Reply to: