• Bug#266000: apt-proxy

    From Bastian Blank@1:229/2 to All on Mon Aug 16 10:30:12 2004
    From: [email protected]

    Package: apt-proxy
    Version: 1.9.17
    Severity: serious

    apt-proxy happily provides access to not matching Releases and Packages
    files.

    This makes it impossible to install anything if some of the
    clients checks the Packages file against dists/<dist>/Release.

    Bastian

    --
    Pain is a thing of the mind. The mind can be controlled.
    -- Spock, "Operation -- Annihilate!" stardate 3287.2

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.5 (GNU/Linux)

    iEYEARECAAYFAkEgbJEACgkQnw66O/MvCNH3LgCfRsmMQsZ3yOxJG8UjB3/gw3R+ ARYAoI28yatqcskT4bFa/BPubcyAmCaQ
    =gTWz
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Chris Halls@1:229/2 to Bastian Blank on Mon Aug 16 11:10:09 2004
    From: [email protected]

    On Mon, 2004-08-16 at 10:13, Bastian Blank wrote:
    apt-proxy happily provides access to not matching Releases and Packages files.

    Please provide enough information for Otavio to be able to do something
    with this bug. This is not enough information to reproduce a bug, and I
    don't even understand what this sentence is supposed to mean. apt-proxy doesn't tamper with the Releases or Packages files, it passes them
    unmodified from the backend. Please describe exactly what has gone
    wrong for you.

    Chris



    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Bastian Blank@1:229/2 to Chris Halls on Mon Aug 16 11:50:07 2004
    From: [email protected]

    On Mon, Aug 16, 2004 at 11:00:49AM +0200, Chris Halls wrote:
    On Mon, 2004-08-16 at 10:13, Bastian Blank wrote:
    apt-proxy happily provides access to not matching Releases and Packages files.

    Please provide enough information for Otavio to be able to do something
    with this bug. This is not enough information to reproduce a bug, and I don't even understand what this sentence is supposed to mean. apt-proxy doesn't tamper with the Releases or Packages files, it passes them
    unmodified from the backend. Please describe exactly what has gone
    wrong for you.

    The dists part of the archive contains the following files:

    $distribution/Release $distribution/$component/binary-$architecture/{Release,Packages{,.gz,.bz2}} $distribution/$component/source/{Release,Sources{.gz,.bz2}}

    The first file includes checksums of the other files.

    Some of the clients (apt/experimental, debootstrap) fetches the overall
    Release file and checks the checksums of the files. Some (apt/unstable)
    don't.

    The following things happens:
    - a normal client requests the Packages file, it is in the cache now.
    - the mirror gets an update.
    - a client requests the Release file
    - the same client requests the cached Packages file

    The checksums does not match if this happens.

    Bastian

    --
    Not one hundred percent efficient, of course ... but nothing ever is.
    -- Kirk, "Metamorphosis", stardate 3219.8

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.5 (GNU/Linux)

    iEYEARECAAYFAkEgfNgACgkQnw66O/MvCNEf0gCfVOCU0OoVkKH/MzRGrPTBMtig FI8AoK1e+gudCgTW/mVTD/y1MYdvibzF
    =kitG
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Chris Halls@1:229/2 to Bastian Blank on Mon Aug 16 12:30:15 2004
    From: [email protected]

    On Mon, 2004-08-16 at 11:22, Bastian Blank wrote:
    The following things happens:
    - a normal client requests the Packages file, it is in the cache now.
    - the mirror gets an update.
    - a client requests the Release file
    - the same client requests the cached Packages file

    The checksums does not match if this happens.

    Thanks for the clarification. Do you find that setting

    min_refresh_delay = 1

    in your configuration file will work around this problem?

    Thanks,
    Chris



    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)