merged lp:~mvo/apt/source-hashes

apt-pkg/deb/debsrcrecords.cc

@@ -17,6 +17,7 @@
 #include <apt-pkg/strutl.h>
 #include <apt-pkg/configuration.h>
 #include <apt-pkg/aptconfiguration.h>
+#include <apt-pkg/hashes.h>
 
 using std::max;
 									/*}}}*/
@@ -114,64 +115,86 @@ bool debSrcRecordParser::BuildDepends(std::vector<pkgSrcRecords::Parser::BuildDe
 bool debSrcRecordParser::Files(std::vector<pkgSrcRecords::File> &List)
 {
    List.erase(List.begin(),List.end());
+
+   // map from the Hashsum field to the hashsum function,
+   // unfortunately this is not a 1:1 mapping from
+   // Hashes::SupporedHashes as e.g. Files is a historic name for the md5
+   const std::pair<const char*, const char*> SourceHashFields[] = {
+      std::make_pair( "Checksums-Sha512",  "SHA512"),
+      std::make_pair( "Checksums-Sha256",  "SHA256"),
+      std::make_pair( "Checksums-Sha1",  "SHA1"),
+      std::make_pair( "Files",  "MD5Sum"),      // historic Name
+   };
    
-   string Files = Sect.FindS("Files");
-   if (Files.empty() == true)
-      return false;
+   for (unsigned int i=0;
+        i < sizeof(SourceHashFields)/sizeof(SourceHashFields[0]);
+        i++)
+   {
+      string Files = Sect.FindS(SourceHashFields[i].first);
+      if (Files.empty() == true)
+         continue;
 
-   // Stash the / terminated directory prefix
-   string Base = Sect.FindS("Directory");
-   if (Base.empty() == false && Base[Base.length()-1] != '/')
-      Base += '/';
+      // Stash the / terminated directory prefix
+      string Base = Sect.FindS("Directory");
+      if (Base.empty() == false && Base[Base.length()-1] != '/')
+         Base += '/';
 
-   std::vector<std::string> const compExts = APT::Configuration::getCompressorExtensions();
+      std::vector<std::string> const compExts = APT::Configuration::getCompressorExtensions();
 
-   // Iterate over the entire list grabbing each triplet
-   const char *C = Files.c_str();
-   while (*C != 0)
-   {   
-      pkgSrcRecords::File F;
-      string Size;
-      
-      // Parse each of the elements
-      if (ParseQuoteWord(C,F.MD5Hash) == false ||
-	  ParseQuoteWord(C,Size) == false ||
-	  ParseQuoteWord(C,F.Path) == false)
-	 return _error->Error("Error parsing file record");
-      
-      // Parse the size and append the directory
-      F.Size = atoi(Size.c_str());
-      F.Path = Base + F.Path;
-      
-      // Try to guess what sort of file it is we are getting.
-      string::size_type Pos = F.Path.length()-1;
-      while (1)
-      {
-	 string::size_type Tmp = F.Path.rfind('.',Pos);
-	 if (Tmp == string::npos)
-	    break;
-	 if (F.Type == "tar") {
-	    // source v3 has extension 'debian.tar.*' instead of 'diff.*'
-	    if (string(F.Path, Tmp+1, Pos-Tmp) == "debian")
-	       F.Type = "diff";
-	    break;
-	 }
-	 F.Type = string(F.Path,Tmp+1,Pos-Tmp);
+      // Iterate over the entire list grabbing each triplet
+      const char *C = Files.c_str();
+      while (*C != 0)
+      {   
+         pkgSrcRecords::File F;
+         string Size;
+         
+         // Parse each of the elements
+         std::string RawHash;
+         if (ParseQuoteWord(C, RawHash) == false ||
+             ParseQuoteWord(C, Size) == false ||
+             ParseQuoteWord(C, F.Path) == false)
+            return _error->Error("Error parsing '%s' record", 
+                                 SourceHashFields[i].first);
+         // assign full hash string
+         F.Hash = HashString(SourceHashFields[i].second, RawHash).toStr();
+         // API compat hack 
+         if(SourceHashFields[i].second == "MD5Sum")
+            F.MD5Hash = RawHash;
+         
+         // Parse the size and append the directory
+         F.Size = atoi(Size.c_str());
+         F.Path = Base + F.Path;
+         
+         // Try to guess what sort of file it is we are getting.
+         string::size_type Pos = F.Path.length()-1;
+         while (1)
+         {
+            string::size_type Tmp = F.Path.rfind('.',Pos);
+            if (Tmp == string::npos)
+               break;
+            if (F.Type == "tar") {
+               // source v3 has extension 'debian.tar.*' instead of 'diff.*'
+               if (string(F.Path, Tmp+1, Pos-Tmp) == "debian")
+                  F.Type = "diff";
+               break;
+            }
+            F.Type = string(F.Path,Tmp+1,Pos-Tmp);
+            
+            if (std::find(compExts.begin(), compExts.end(), std::string(".").append(F.Type)) != compExts.end() ||
+                F.Type == "tar")
+            {
+               Pos = Tmp-1;
+               continue;
+            }
 	 
-	 if (std::find(compExts.begin(), compExts.end(), std::string(".").append(F.Type)) != compExts.end() ||
-	     F.Type == "tar")
-	 {
-	    Pos = Tmp-1;
-	    continue;
-	 }
-	 
-	 break;
-      }
+            break;
+         }
       
-      List.push_back(F);
+         List.push_back(F);
+      }
+      break;
    }
-   
-   return true;
+   return (List.size() > 0);
 }
 									/*}}}*/
 // SrcRecordParser::~SrcRecordParser - Destructor			/*{{{*/

apt-pkg/srcrecords.h

@@ -32,6 +32,7 @@ class pkgSrcRecords
    struct File
    {
       std::string MD5Hash;
+      std::string Hash;
       unsigned long Size;
       std::string Path;
       std::string Type;

cmdline/apt-get.cc

@@ -2555,15 +2555,12 @@ bool DoSource(CommandLine &CmdL)
 	 if(queued.find(Last->Index().ArchiveURI(I->Path)) != queued.end())
 	    continue;
 	 queued.insert(Last->Index().ArchiveURI(I->Path));
-	    
+
 	 // check if we have a file with that md5 sum already localy
-	 if(!I->MD5Hash.empty() && FileExists(flNotDir(I->Path)))  
+	 if(!I->Hash.empty() && FileExists(flNotDir(I->Path)))  
 	 {
-	    FileFd Fd(flNotDir(I->Path), FileFd::ReadOnly);
-	    MD5Summation sum;
-	    sum.AddFD(Fd.Fd(), Fd.Size());
-	    Fd.Close();
-	    if((string)sum.Result() == I->MD5Hash) 
+            HashString hash_string = HashString(I->Hash);
+            if(hash_string.VerifyFile(flNotDir(I->Path)))
 	    {
 	       ioprintf(c1out,_("Skipping already downloaded file '%s'\n"),
 			flNotDir(I->Path).c_str());
@@ -2572,7 +2569,7 @@ bool DoSource(CommandLine &CmdL)
 	 }
 
 	 new pkgAcqFile(&Fetcher,Last->Index().ArchiveURI(I->Path),
-			I->MD5Hash,I->Size,
+			I->Hash,I->Size,
 			Last->Index().SourceInfo(*Last,*I),Src);
       }
    }

configure.in

@@ -18,7 +18,7 @@ AC_CONFIG_AUX_DIR(buildlib)
 AC_CONFIG_HEADER(include/config.h:buildlib/config.h.in include/apti18n.h:buildlib/apti18n.h.in)
 
 PACKAGE="apt"
-PACKAGE_VERSION="0.9.8~exp1~20121017"
+PACKAGE_VERSION="0.9.8~exp1~20130301"
 PACKAGE_MAIL="APT Development Team <deity@lists.debian.org>"
 AC_DEFINE_UNQUOTED(PACKAGE,"$PACKAGE")
 AC_DEFINE_UNQUOTED(PACKAGE_VERSION,"$PACKAGE_VERSION")

debian/changelog

@@ -20,7 +20,9 @@ apt (0.9.8~exp1) UNRELEASED; urgency=low
     - print error in log if tcgetattr() fails instead of writing
       a empty file
   * use sha512 when available (LP: #1098752)
-  
+  * [ABI-Break] lp:~mvo/apt/source-hashes:
+    - use sha{512,256,1} for deb-src when available LP: #1098738
+ 
   [ Marc Deslauriers ]
   * make apt-ftparchive generate missing deb-src hashes (LP: #1078697)
 

debian/control

@@ -36,7 +36,7 @@ Description: commandline package manager
   * apt-config as an interface to the configuration settings
   * apt-key as an interface to manage authentication keys
 
-Package: libapt-pkg4.12
+Package: libapt-pkg4.13
 Architecture: any
 Multi-Arch: same
 Pre-Depends: ${misc:Pre-Depends}

debian/libapt-pkg4.12.symbols

@@ -1,4 +1,4 @@
-libapt-pkg.so.4.12 libapt-pkg4.12 #MINVER#
+libapt-pkg.so.4.13 libapt-pkg4.13 #MINVER#
 * Build-Depends-Package: libapt-pkg-dev
  TFRewritePackageOrder@Base 0.8.0
  TFRewriteSourceOrder@Base 0.8.0

doc/apt-verbatim.ent

@@ -213,7 +213,7 @@
 ">
 
 <!-- this will be updated by 'prepare-release' -->
-<!ENTITY apt-product-version "0.9.7.7">
+<!ENTITY apt-product-version "0.9.8~exp1~20130301">
 
 <!-- Codenames for debian releases -->
 <!ENTITY oldstable-codename "squeeze">

doc/po/apt-doc.pot

@@ -6,9 +6,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: apt-doc 0.9.7.5\n"
+"Project-Id-Version: apt-doc 0.9.8~exp1~20121017\n"
 "Report-Msgid-Bugs-To: APT Development Team <deity@lists.debian.org>\n"
-"POT-Creation-Date: 2012-10-15 09:49+0300\n"
+"POT-Creation-Date: 2013-03-01 12:27+0100\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

test/integration/test-debsrc-hashes

@@ -0,0 +1,77 @@
+#!/bin/sh
+set -e
+
+TESTDIR=$(readlink -f $(dirname $0))
+. $TESTDIR/framework
+
+setupenvironment
+configarchitecture "i386"
+
+# pkg-sha256-bad has a bad SHA sum, but good MD5 sum.  If apt is
+# checking the best available hash (as it should), this will trigger
+# a hash mismatch.
+
+cat > aptarchive/Sources <<EOF
+Package: pkg-md5-ok
+Binary: pkg-md5-ok
+Version: 1.0
+Maintainer: Joe Sixpack <joe@example.org>
+Architecture: i386
+Files:
+ d41d8cd98f00b204e9800998ecf8427e 0 pkg-md5-ok_1.0.dsc
+ d41d8cd98f00b204e9800998ecf8427e 0 pkg-md5-ok_1.0.tar.gz
+
+Package: pkg-sha256-ok
+Binary: pkg-sha256-ok
+Version: 1.0
+Maintainer: Joe Sixpack <joe@example.org>
+Architecture: i386
+Files:
+ d41d8cd98f00b204e9800998ecf8427e 0 pkg-sha256-ok_1.0.dsc
+ d41d8cd98f00b204e9800998ecf8427e 0 pkg-sha256-ok_1.0.tar.gz
+Checksums-Sha1:
+ da39a3ee5e6b4b0d3255bfef95601890afd80709 0 pkg-sha256-ok_1.0.dsc
+ da39a3ee5e6b4b0d3255bfef95601890afd80709 0 pkg-sha256-ok_1.0.tar.gz
+Checksums-Sha256:
+ e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 pkg-sha256-ok_1.0.dsc
+ e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 pkg-sha256-ok_1.0.tar.gz
+
+Package: pkg-sha256-bad
+Binary: pkg-sha256-bad
+Version: 1.0
+Maintainer: Joe Sixpack <joe@example.org>
+Architecture: i386
+Files:
+ d41d8cd98f00b204e9800998ecf8427e 0 pkg-sha256-bad_1.0.dsc
+ d41d8cd98f00b204e9800998ecf8427e 0 pkg-sha256-bad_1.0.tar.gz
+Checksums-Sha1:
+ da39a3ee5e6b4b0d3255bfef95601890afd80709 0 pkg-sha256-bad_1.0.dsc
+ da39a3ee5e6b4b0d3255bfef95601890afd80709 0 pkg-sha256-bad_1.0.tar.gz
+Checksums-Sha256:
+ xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 0 pkg-sha256-bad_1.0.dsc
+ xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 0 pkg-sha256-bad_1.0.tar.gz
+EOF
+
+# create fetchable files
+for x in "pkg-md5-ok" "pkg-sha256-ok" "pkg-sha256-bad"; do
+    touch aptarchive/${x}_1.0.dsc
+    touch aptarchive/${x}_1.0.tar.gz
+done
+
+testok() {
+    msgtest "Test for hash ok of" "$*"
+    $* 2>&1 | grep "Download complete" > /dev/null && msgpass || msgfail
+}
+
+testmismatch() {
+    msgtest "Test for hash mismatch of" "$*"
+    $* 2>&1 | grep "Hash Sum mismatch" > /dev/null && msgpass || msgfail
+}
+
+setupaptarchive
+changetowebserver
+aptget update -qq
+
+testok aptget source -d pkg-md5-ok
+testok aptget source -d pkg-sha256-ok
+testmismatch aptget source -d pkg-sha256-bad