Accepted python-apt 1.8.5 (source) into unstable
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 15 Jan 2020 16:46:29 +0100
Source: python-apt
Architecture: source
Version: 1.8.5
Distribution: unstable
Urgency: high
Maintainer: APT Development Team <deity@lists.debian.org>
Changed-By: Julian Andres Klode <jak@debian.org>
Closes: 944696 947794
Changes:
python-apt (1.8.5) unstable; urgency=high
.
* SECURITY UPDATE: Check that repository is trusted before downloading
files from it (LP: #1858973)
- apt/cache.py: Add checks to fetch_archives() and commit()
- apt/package.py: Add checks to fetch_binary() and fetch_source()
- CVE-2019-15796
* SECURITY UPDATE: Do not use MD5 for verifying downloadeds
(Closes: #944696) (#LP: #1858972)
- apt/package.py: Use all hashes when fetching packages, and
check that we have trusted hashes when downloading
- CVE-2019-15795
* To work around the new checks, the parameter allow_unauthenticated=True
can be passed to the functions. It defaults to the value of the
APT::Get::AllowUnauthenticated option.
- Bump Breaks aptdaemon (<< 1.1.1+bzr982-0ubuntu21.2), as it will have
to set that parameter after having done validation.
* Automatic changes and fixes for external regressions:
- Adjustments to test suite and CI to fix CI regressions
- Automatic mirror list update
- d/tests/control: Add "Restrictions: allow-stderr" (Closes: #947794)
Checksums-Sha1:
f0b49ffa3f186ba0c2d63b80b551970d6f2f8f83 2451 python-apt_1.8.5.dsc
3592b15feb50e9d6d02a87a0447d75d5a814dc9b 343344 python-apt_1.8.5.tar.xz
67cfc6193f15bcefff16d2624553b6ef122a04ab 10358 python-apt_1.8.5_source.buildinfo
Checksums-Sha256:
d57d34982561e6373625b1b22d6d4e0416778eade6f126db702f98bb8b5853be 2451 python-apt_1.8.5.dsc
f7fe0023f9ea2193a8b7a8cdd5be00f88eb44c59b184e8b0d9c64f38e33e353c 343344 python-apt_1.8.5.tar.xz
0873481ceb4b45197e0a58320e675d68da46e582f307f2de22807d2593c498a7 10358 python-apt_1.8.5_source.buildinfo
Files:
6c2120799bb20e99737cdd832d449b50 2451 python optional python-apt_1.8.5.dsc
2f82338e36a8bf76d16e338e8e2a4651 343344 python optional python-apt_1.8.5.tar.xz
fe2e1ac81f6edfc291ef24080e13571b 10358 python optional python-apt_1.8.5_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJDBAEBCgAtFiEET7WIqEwt3nmnTHeHb6RY3R2wP3EFAl4lchgPHGpha0BkZWJp
YW4ub3JnAAoJEG+kWN0dsD9xOqMQAISpI3BoO/1aoTGQmL+y9TqtotbVUgyvldwn
Be8B7BpUylml2iX8FJoEX7nQxdoDvmBNHhYV6YvZr+seoKn0cPHlSx3OwuzJwzlC
/o/TmbJCrPPMp8drHBRBC/eSVEO/K36koRG+OjR0EaPqsPdA/Fv1cp3UclroEeC6
pWG5WXHerhvKiCdeO5ABuEa1X0Q87fqEGldzH7Z3eC2aWX93ilBAC383QIVwPVcN
fk5WAYQcc8PE/wV1Vzt4JOCPdXuCrw9WECQmvjFTu6pLfWmXioZt4HWmFyGyf5A7
jBNuhX0TWnXV+mFIbjF6+Blg0r3zSMA8omW4m4VEUmiru7K8NDUp+Sa7FLqQAL+f
3PlQhTllo3l3E+MuB42A+v5+gvyfw+a3TcVmdq4iPr/GKk25V3f/zur5mPm5+PPl
lSRdm/8xBcxdcRZqBDsTbp6Lh7UcKJmUWr1Mq6mWrHcZ6jE0R/aAUn1XwD0hL5vh
9tO7wvuy0LbcvvMa7sYCXq1mwBR5exU54CK6mbMlSSaGMDYTGOn9OJWfqmTQlYky
aOmFsccb1jlVxFqbN575K6m3XoOm4rD3i4iZdIizMKy5CsBu6I+kte2l7FGDSFcy
OZT2BJkek1SBNzsjD9RNiw2aKsh8s/aH6OL/ls7XgV9MWIyXXCJz6R7LbzWWV6sv
lHfZixb0
=j9Rj
-----END PGP SIGNATURE-----