6 Commits

Include renames

Author	SHA1	Message	Date
vhaudiquet	941f91decf	distro_info: read the YAML local series path, drop the dead dist_info stanza	2026-09-18 13:09:02 +02:00
vhaudiquet	f27d27ea99	new: add pkh put, a native dput replacement for PPA uploads ... Upload built source packages over SFTP with host-key verification (Launchpad fingerprints pinned in host_keys.yml, ask-to-accept otherwise), Launchpad account discovery (git config lp.user), and pre-flight checks the upload queue itself never does: changes file discovery/validation, PPA existence via the Launchpad API, target series validity, and debian/control Section validity (sections bundled in distro_info.yml). Upload log prevents duplicate uploads unless --force.	2026-09-16 21:38:53 +02:00
vhaudiquet	60ee99adc8	pull: search pockets in release order by default ... Without an explicit --pocket, find_package stops at the first pocket containing the package, but the search order listed '-proposed' first and never included '-security': unreleased proposed packages won by default and security-only updates were unreachable. Search the main archive first, then updates, security, and proposed last.	2026-09-16 01:27:25 +02:00
vhaudiquet	213668fa82	pull: authenticate archive indexes against signed Release files ... The Sources index was downloaded with no authentication: per-artifact checksums were verified, but against hashes taken from an index a MITM could substitute along with the artifacts. Fetch each suite's InRelease (or Release + Release.gpg), verify the signature with gpgv against the archive keyring (or the PPA signing key) the same way apt does, and checksum-check every Sources index against it before parsing. Distro archives and PPAs verify strictly: an invalid or unverifiable signature, or a missing gpgv binary, is a hard error. Flat repositories keep working without a Release file or without a verifiable one (warned as unauthenticated), but tampering evidence is a hard error there too. Also switches all archive, PPA and keyring base URLs to https, and reads suite components from the verified Release instead of fetching them separately over an unauthenticated channel.	2026-09-16 01:22:22 +02:00
vhaudiquet	dd9cc07285	deb: make sure to have the right apt keyrings	2026-01-20 19:31:07 +01:00
vhaudiquet	ab35af5fb5	package_info: refactor into distro_info and package_info split, yaml data	2026-01-14 21:18:25 +01:00