6 Commits

Include renames

Author	SHA1	Message	Date
vhaudiquet	7601524b7c	apt: move the keyserver lookup URL to data/keyserver.yml	2026-09-18 13:28:05 +02:00
vhaudiquet	7af767898e	launchpad: drive the endpoints from data/launchpad.yml	2026-09-18 13:27:20 +02:00
vhaudiquet	3ed95725e4	net: retry flaky archive fetches and pin index downloads via by-hash ... Busy mirrors and CDNs routinely break bulk fetches: pooled keep-alive connections get closed remotely ('error sending request'), downloads are cut short (surfacing as bogus checksum mismatches), and index generations momentarily drift from the Release file fetched moments before. - shared client: short idle-pool timeout and TCP keepalive, and a bounded-retry GET helper now used for index, Release, keyring and Launchpad fetches (previously reqwest::get, which has no timeouts) - downloads: retry the whole download, and check the content length so truncation is reported as such instead of a checksum mismatch - sources index: on a checksum mismatch against the Release file, retry pinned to the exact listed generation via Debian's by-hash mechanism; body-read errors are retried and reported per component instead of aborting the whole lookup	2026-09-17 15:18:14 +02:00
vhaudiquet	4af8dbddb0	fmt: fix clippy warnings on all targets ... Drop an unused test fixture constant, move download_trust_ppa_key above the test module that precedes it, and simplify two test borrows.	2026-09-16 09:15:52 +02:00
vhaudiquet	512a1cb778	deb: unmount and remove the ephemeral chroot on Ctrl-C ... The SIGINT handler libc::_exit(130)s, skipping EphemeralContextGuard's drop and leaking the freshly bootstrapped chroot with its bind-mounted /proc and overlay mounts. Resources now register a self-contained cleanup hook in a process-global registry that the handler drains right before exiting: the hook unmounts everything under the chroot path (children first, lazy fallback) and removes the tree, using only stored paths and direct umount/rm subprocesses so it cannot deadlock on a lock the interrupted thread may hold; sudo -n keeps it from ever hanging on a password prompt. Drop deregisters the hook first, so the normal cleanup path is unchanged. Also fixes the hex grouping of the CRC-24 polynomial in apt::release.	2026-09-16 01:55:35 +02:00
vhaudiquet	213668fa82	pull: authenticate archive indexes against signed Release files ... The Sources index was downloaded with no authentication: per-artifact checksums were verified, but against hashes taken from an index a MITM could substitute along with the artifacts. Fetch each suite's InRelease (or Release + Release.gpg), verify the signature with gpgv against the archive keyring (or the PPA signing key) the same way apt does, and checksum-check every Sources index against it before parsing. Distro archives and PPAs verify strictly: an invalid or unverifiable signature, or a missing gpgv binary, is a hard error. Flat repositories keep working without a Release file or without a verifiable one (warned as unauthenticated), but tampering evidence is a hard error there too. Also switches all archive, PPA and keyring base URLs to https, and reads suite components from the verified Release instead of fetching them separately over an unauthenticated channel.	2026-09-16 01:22:22 +02:00