[Touch-packages] [Bug 1814727] Re: Backport never pinning and Packages-Require-Authorization

2019-03-21 Thread Launchpad Bug Tracker
This bug was fixed in the package apt - 1.0.1ubuntu2.22

---
apt (1.0.1ubuntu2.22) trusty; urgency=medium

  * apt.dirs: Install auth.conf.d directory (LP: #1818996)
  * Merge translations from 1.2.31

apt (1.0.1ubuntu2.21) trusty; urgency=medium

  [ Julian Andres Klode ]
  * travis CI: Use docker container to get useful results
  * fix and non-silent fail dpkg-overwrite error test (LP: #1817088)
  * Introduce experimental 'never' pinning for sources (LP: #1814727)
  * Add support for /etc/apt/auth.conf.d/*.conf (netrcparts) (LP: #1811120)
  * Add a Packages-Require-Authorization Release file field (LP: #1814727)
  * NeverAutoRemove kernel meta packages (LP: #1787460)
  * Introduce APT::Install::Pre-Invoke / Post-Invoke-Success (LP: #1815761)

  [ David Kalnischkies ]
  * ftparchive/writer.cc: use a std::vector instead of hardcoded array
(LP: #1817048)

 -- Julian Andres Klode   Tue, 12 Mar 2019 15:15:54
+0100

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1814727

Title:
  Backport never pinning and Packages-Require-Authorization

Status in apt package in Ubuntu:
  Fix Released
Status in apt source package in Trusty:
  Fix Released
Status in apt source package in Xenial:
  Fix Released
Status in apt source package in Bionic:
  Fix Released
Status in apt source package in Cosmic:
  Fix Released
Status in apt source package in Disco:
  Fix Released

Bug description:
  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:

  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify
  code quite a bit.

  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful
  both for private repositories, as it can prevent unattended-upgrades
  failures if you remove authorization info; and it also allows creating
  a new form of semi-private repository, where only pool/ requires
  authorization.

  [Test case]
  Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins

  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1814727/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp


[Touch-packages] [Bug 1814727] Re: Backport never pinning and Packages-Require-Authorization

2019-03-21 Thread Launchpad Bug Tracker
This bug was fixed in the package apt - 1.2.31

---
apt (1.2.31) xenial; urgency=medium

  * Fix name of APT::Update::Post-Invoke-Stats (was ...Update-Post...)
  * apt.dirs: Install auth.conf.d directory (LP: #1818996)
  * Merge translations from 1.6.10 (via 1.4.y branch)

apt (1.2.30) xenial; urgency=medium

  * merge security upload for content injection in http method (CVE-2019-3462);
with fixed autopkgtest (LP: #1815750)
  * Introduce experimental 'never' pinning for sources (LP: #1814727)
  * Add support for /etc/apt/auth.conf.d/*.conf (netrcparts) (LP: #1811120)
  * Add a Packages-Require-Authorization Release file field (LP: #1814727)
  * NeverAutoRemove kernel meta packages (LP: #1787460)
  * doc: Set ubuntu-codename to xenial (LP: #1812696)
  * update: Provide APT::Update-Post-Invoke-Stats script hook point
(LP: #1815760)
  * Introduce APT::Install::Pre-Invoke / Post-Invoke-Success (LP: #1815761)

 -- Julian Andres Klode   Tue, 12 Mar 2019 14:59:01
+0100

** Changed in: apt (Ubuntu Xenial)
   Status: Fix Committed => Fix Released

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-3462

** Changed in: apt (Ubuntu Trusty)
   Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1814727

Title:
  Backport never pinning and Packages-Require-Authorization

Status in apt package in Ubuntu:
  Fix Released
Status in apt source package in Trusty:
  Fix Released
Status in apt source package in Xenial:
  Fix Released
Status in apt source package in Bionic:
  Fix Released
Status in apt source package in Cosmic:
  Fix Released
Status in apt source package in Disco:
  Fix Released

Bug description:
  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:

  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify
  code quite a bit.

  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful
  both for private repositories, as it can prevent unattended-upgrades
  failures if you remove authorization info; and it also allows creating
  a new form of semi-private repository, where only pool/ requires
  authorization.

  [Test case]
  Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins

  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1814727/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp


[Touch-packages] [Bug 1814727] Re: Backport never pinning and Packages-Require-Authorization

2019-03-21 Thread Launchpad Bug Tracker
This bug was fixed in the package apt - 1.6.10

---
apt (1.6.10) bionic; urgency=medium

  * Fix name of APT::Update::Post-Invoke-Stats (was ...Update-Post...)
  * CMake: Install auth.conf.d directory (LP: #1818996)
  * Merge translations from 1.7.4

apt (1.6.9) bionic; urgency=medium

  [ Michael Vogt ]
  * private-json-hooks.cc: deal with EPIPE (LP: #1814543)

  [ Julian Andres Klode ]
  * Introduce experimental 'never' pinning for sources (LP: #1814727)
  * Add a Packages-Require-Authorization Release file field (LP: #1814727)
  * doc: Set ubuntu-codename to bionic (LP: #1812696)
  * update: Provide APT::Update-Post-Invoke-Stats script hook point
(LP: #1815760)
  * Introduce APT::Install::Pre-Invoke / Post-Invoke-Success (LP: #1815761)

 -- Julian Andres Klode   Mon, 11 Mar 2019 10:34:07
+0100

** Changed in: apt (Ubuntu Bionic)
   Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1814727

Title:
  Backport never pinning and Packages-Require-Authorization

Status in apt package in Ubuntu:
  Fix Released
Status in apt source package in Trusty:
  Fix Committed
Status in apt source package in Xenial:
  Fix Committed
Status in apt source package in Bionic:
  Fix Released
Status in apt source package in Cosmic:
  Fix Released
Status in apt source package in Disco:
  Fix Released

Bug description:
  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:

  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify
  code quite a bit.

  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful
  both for private repositories, as it can prevent unattended-upgrades
  failures if you remove authorization info; and it also allows creating
  a new form of semi-private repository, where only pool/ requires
  authorization.

  [Test case]
  Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins

  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1814727/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp


[Touch-packages] [Bug 1814727] Re: Backport never pinning and Packages-Require-Authorization

2019-03-21 Thread Launchpad Bug Tracker
This bug was fixed in the package apt - 1.7.4

---
apt (1.7.4) cosmic; urgency=medium

  * Fix name of APT::Update::Post-Invoke-Stats (was ...Update-Post...)
  * CMake: Install auth.conf.d directory (LP: #1818996)
  * Merge translations from 1.8.0

apt (1.7.3) cosmic; urgency=medium

  [ Michael Vogt ]
  * private-json-hooks.cc: deal with EPIPE (LP: #1814543)

  [ Julian Andres Klode ]
  * Introduce experimental 'never' pinning for sources (LP: #1814727)
  * Add a Packages-Require-Authorization Release file field (LP: #1814727)
  * doc: Set ubuntu-codename to cosmic (LP: #1812696)
  * update: Provide APT::Update-Post-Invoke-Stats script hook point
(LP: #1815760)
  * Introduce APT::Install::Pre-Invoke / Post-Invoke-Success (LP: #1815761)

 -- Julian Andres Klode   Mon, 11 Mar 2019 10:31:46
+0100

** Changed in: apt (Ubuntu Cosmic)
   Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1814727

Title:
  Backport never pinning and Packages-Require-Authorization

Status in apt package in Ubuntu:
  Fix Released
Status in apt source package in Trusty:
  Fix Committed
Status in apt source package in Xenial:
  Fix Committed
Status in apt source package in Bionic:
  Fix Committed
Status in apt source package in Cosmic:
  Fix Released
Status in apt source package in Disco:
  Fix Released

Bug description:
  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:

  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify
  code quite a bit.

  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful
  both for private repositories, as it can prevent unattended-upgrades
  failures if you remove authorization info; and it also allows creating
  a new form of semi-private repository, where only pool/ requires
  authorization.

  [Test case]
  Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins

  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1814727/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp


[Touch-packages] [Bug 1814727] Re: Backport never pinning and Packages-Require-Authorization

2019-03-15 Thread Julian Andres Klode
I have reverfied from the autopkgtest runs that the specified tests have
passed in all releases:

- 1.7.4 in cosmic
- 1.6.10 in bionic
- 1.2.31 in xenial
- 1.0.1ubuntu2.22 in trusty

** Tags removed: verification-needed verification-needed-bionic 
verification-needed-cosmic verification-needed-trusty verification-needed-xenial
** Tags added: verification-done verification-done-bionic 
verification-done-cosmic verification-done-trusty verification-done-xenial

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1814727

Title:
  Backport never pinning and Packages-Require-Authorization

Status in apt package in Ubuntu:
  Fix Released
Status in apt source package in Trusty:
  Fix Committed
Status in apt source package in Xenial:
  Fix Committed
Status in apt source package in Bionic:
  Fix Committed
Status in apt source package in Cosmic:
  Fix Committed
Status in apt source package in Disco:
  Fix Released

Bug description:
  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:

  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify
  code quite a bit.

  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful
  both for private repositories, as it can prevent unattended-upgrades
  failures if you remove authorization info; and it also allows creating
  a new form of semi-private repository, where only pool/ requires
  authorization.

  [Test case]
  Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins

  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1814727/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp


[Touch-packages] [Bug 1814727] Re: Backport never pinning and Packages-Require-Authorization

2019-03-14 Thread Łukasz Zemczak
Hello Julian, or anyone else affected,

Accepted apt into trusty-proposed. The package will build now and be
available at https://launchpad.net/ubuntu/+source/apt/1.0.1ubuntu2.22 in
a few hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested and change the tag from
verification-needed-trusty to verification-done-trusty. If it does not
fix the bug for you, please add a comment stating that, and change the
tag to verification-failed-trusty. In either case, without details of
your testing we will not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Tags removed: verification-done-trusty
** Tags added: verification-needed-trusty

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1814727

Title:
  Backport never pinning and Packages-Require-Authorization

Status in apt package in Ubuntu:
  Fix Released
Status in apt source package in Trusty:
  Fix Committed
Status in apt source package in Xenial:
  Fix Committed
Status in apt source package in Bionic:
  Fix Committed
Status in apt source package in Cosmic:
  Fix Committed
Status in apt source package in Disco:
  Fix Released

Bug description:
  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:

  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify
  code quite a bit.

  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful
  both for private repositories, as it can prevent unattended-upgrades
  failures if you remove authorization info; and it also allows creating
  a new form of semi-private repository, where only pool/ requires
  authorization.

  [Test case]
  Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins

  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1814727/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp


[Touch-packages] [Bug 1814727] Re: Backport never pinning and Packages-Require-Authorization

2019-03-14 Thread Łukasz Zemczak
Hello Julian, or anyone else affected,

Accepted apt into cosmic-proposed. The package will build now and be
available at https://launchpad.net/ubuntu/+source/apt/1.7.4 in a few
hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested and change the tag from
verification-needed-cosmic to verification-done-cosmic. If it does not
fix the bug for you, please add a comment stating that, and change the
tag to verification-failed-cosmic. In either case, without details of
your testing we will not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Tags removed: verification-done verification-done-cosmic
** Tags added: verification-needed verification-needed-cosmic

** Tags removed: verification-done-bionic
** Tags added: verification-needed-bionic

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1814727

Title:
  Backport never pinning and Packages-Require-Authorization

Status in apt package in Ubuntu:
  Fix Released
Status in apt source package in Trusty:
  Fix Committed
Status in apt source package in Xenial:
  Fix Committed
Status in apt source package in Bionic:
  Fix Committed
Status in apt source package in Cosmic:
  Fix Committed
Status in apt source package in Disco:
  Fix Released

Bug description:
  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:

  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify
  code quite a bit.

  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful
  both for private repositories, as it can prevent unattended-upgrades
  failures if you remove authorization info; and it also allows creating
  a new form of semi-private repository, where only pool/ requires
  authorization.

  [Test case]
  Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins

  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1814727/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp


[Touch-packages] [Bug 1814727] Re: Backport never pinning and Packages-Require-Authorization

2019-03-06 Thread Julian Andres Klode
I have verfied from the autopkgtest runs that the specified tests have
passed in all releases:

- 1.7.3 in cosmic
- 1.6.9 in bionic
- 1.2.30 in xenial
- 1.0.1ubuntu2.21 in trusty

I specifically checked that test-packages-require-authorization run, and
that test-policy-pinning has more tests run than before; indicating the
presence of the additional tests.


** Description changed:

  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:
  
  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify code
  quite a bit.
  
  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful both
  for private repositories, as it can prevent unattended-upgrades failures
  if you remove authorization info; and it also allows creating a new form
  of semi-private repository, where only pool/ requires authorization.
  
  [Test case]
  Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies
  
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins
  
- Tests in older releases should be the same, but it's not clear yet. Bug
- will be updated once the SRUs are ready.
- 
  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

** Tags removed: verification-needed verification-needed-bionic 
verification-needed-cosmic verification-needed-trusty verification-needed-xenial
** Tags added: verification-done verification-done-bionic 
verification-done-cosmic verification-done-trusty verification-done-xenial

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1814727

Title:
  Backport never pinning and Packages-Require-Authorization

Status in apt package in Ubuntu:
  Fix Released
Status in apt source package in Trusty:
  Fix Committed
Status in apt source package in Xenial:
  Fix Committed
Status in apt source package in Bionic:
  Fix Committed
Status in apt source package in Cosmic:
  Fix Committed
Status in apt source package in Disco:
  Fix Released

Bug description:
  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:

  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify
  code quite a bit.

  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful
  both for private repositories, as it can prevent unattended-upgrades
  failures if you remove authorization info; and it also allows creating
  a new form of semi-private repository, where only pool/ requires
  authorization.

  [Test case]
  Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins

  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1814727/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp


[Touch-packages] [Bug 1814727] Re: Backport never pinning and Packages-Require-Authorization

2019-03-05 Thread Brian Murray
Hello Julian, or anyone else affected,

Accepted apt into trusty-proposed. The package will build now and be
available at https://launchpad.net/ubuntu/+source/apt/1.0.1ubuntu2.21 in
a few hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested and change the tag from
verification-needed-trusty to verification-done-trusty. If it does not
fix the bug for you, please add a comment stating that, and change the
tag to verification-failed-trusty. In either case, without details of
your testing we will not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: apt (Ubuntu Trusty)
   Status: In Progress => Fix Committed

** Tags added: verification-needed-trusty

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1814727

Title:
  Backport never pinning and Packages-Require-Authorization

Status in apt package in Ubuntu:
  Fix Released
Status in apt source package in Trusty:
  Fix Committed
Status in apt source package in Xenial:
  Fix Committed
Status in apt source package in Bionic:
  Fix Committed
Status in apt source package in Cosmic:
  Fix Committed
Status in apt source package in Disco:
  Fix Released

Bug description:
  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:

  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify
  code quite a bit.

  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful
  both for private repositories, as it can prevent unattended-upgrades
  failures if you remove authorization info; and it also allows creating
  a new form of semi-private repository, where only pool/ requires
  authorization.

  [Test case]
  Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins

  Tests in older releases should be the same, but it's not clear yet.
  Bug will be updated once the SRUs are ready.

  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1814727/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp


[Touch-packages] [Bug 1814727] Re: Backport never pinning and Packages-Require-Authorization

2019-03-05 Thread Brian Murray
Hello Julian, or anyone else affected,

Accepted apt into xenial-proposed. The package will build now and be
available at https://launchpad.net/ubuntu/+source/apt/1.2.30 in a few
hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested and change the tag from
verification-needed-xenial to verification-done-xenial. If it does not
fix the bug for you, please add a comment stating that, and change the
tag to verification-failed-xenial. In either case, without details of
your testing we will not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: apt (Ubuntu Xenial)
   Status: In Progress => Fix Committed

** Tags added: verification-needed-xenial

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1814727

Title:
  Backport never pinning and Packages-Require-Authorization

Status in apt package in Ubuntu:
  Fix Released
Status in apt source package in Trusty:
  In Progress
Status in apt source package in Xenial:
  Fix Committed
Status in apt source package in Bionic:
  Fix Committed
Status in apt source package in Cosmic:
  Fix Committed
Status in apt source package in Disco:
  Fix Released

Bug description:
  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:

  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify
  code quite a bit.

  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful
  both for private repositories, as it can prevent unattended-upgrades
  failures if you remove authorization info; and it also allows creating
  a new form of semi-private repository, where only pool/ requires
  authorization.

  [Test case]
  Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins

  Tests in older releases should be the same, but it's not clear yet.
  Bug will be updated once the SRUs are ready.

  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1814727/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp


[Touch-packages] [Bug 1814727] Re: Backport never pinning and Packages-Require-Authorization

2019-03-05 Thread Brian Murray
Hello Julian, or anyone else affected,

Accepted apt into cosmic-proposed. The package will build now and be
available at https://launchpad.net/ubuntu/+source/apt/1.7.3 in a few
hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested and change the tag from
verification-needed-cosmic to verification-done-cosmic. If it does not
fix the bug for you, please add a comment stating that, and change the
tag to verification-failed-cosmic. In either case, without details of
your testing we will not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: apt (Ubuntu Cosmic)
   Status: Incomplete => Fix Committed

** Tags added: verification-needed verification-needed-cosmic

** Changed in: apt (Ubuntu Bionic)
   Status: In Progress => Fix Committed

** Tags added: verification-needed-bionic

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1814727

Title:
  Backport never pinning and Packages-Require-Authorization

Status in apt package in Ubuntu:
  Fix Released
Status in apt source package in Trusty:
  In Progress
Status in apt source package in Xenial:
  In Progress
Status in apt source package in Bionic:
  Fix Committed
Status in apt source package in Cosmic:
  Fix Committed
Status in apt source package in Disco:
  Fix Released

Bug description:
  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:

  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify
  code quite a bit.

  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful
  both for private repositories, as it can prevent unattended-upgrades
  failures if you remove authorization info; and it also allows creating
  a new form of semi-private repository, where only pool/ requires
  authorization.

  [Test case]
  Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins

  Tests in older releases should be the same, but it's not clear yet.
  Bug will be updated once the SRUs are ready.

  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1814727/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp


[Touch-packages] [Bug 1814727] Re: Backport never pinning and Packages-Require-Authorization

2019-03-05 Thread Julian Andres Klode
Sure

** Changed in: apt (Ubuntu Disco)
   Status: Incomplete => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1814727

Title:
  Backport never pinning and Packages-Require-Authorization

Status in apt package in Ubuntu:
  Fix Released
Status in apt source package in Trusty:
  In Progress
Status in apt source package in Xenial:
  In Progress
Status in apt source package in Bionic:
  In Progress
Status in apt source package in Cosmic:
  Incomplete
Status in apt source package in Disco:
  Fix Released

Bug description:
  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:

  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify
  code quite a bit.

  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful
  both for private repositories, as it can prevent unattended-upgrades
  failures if you remove authorization info; and it also allows creating
  a new form of semi-private repository, where only pool/ requires
  authorization.

  [Test case]
  Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins

  Tests in older releases should be the same, but it's not clear yet.
  Bug will be updated once the SRUs are ready.

  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1814727/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp


[Touch-packages] [Bug 1814727] Re: Backport never pinning and Packages-Require-Authorization

2019-03-05 Thread Brian Murray
Is this fixed in Disco yet?

** Changed in: apt (Ubuntu Cosmic)
   Status: In Progress => Incomplete

** Changed in: apt (Ubuntu Disco)
   Status: In Progress => Incomplete

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1814727

Title:
  Backport never pinning and Packages-Require-Authorization

Status in apt package in Ubuntu:
  Incomplete
Status in apt source package in Trusty:
  In Progress
Status in apt source package in Xenial:
  In Progress
Status in apt source package in Bionic:
  In Progress
Status in apt source package in Cosmic:
  Incomplete
Status in apt source package in Disco:
  Incomplete

Bug description:
  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:

  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify
  code quite a bit.

  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful
  both for private repositories, as it can prevent unattended-upgrades
  failures if you remove authorization info; and it also allows creating
  a new form of semi-private repository, where only pool/ requires
  authorization.

  [Test case]
  Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins

  Tests in older releases should be the same, but it's not clear yet.
  Bug will be updated once the SRUs are ready.

  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1814727/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp


[Touch-packages] [Bug 1814727] Re: Backport never pinning and Packages-Require-Authorization

2019-03-01 Thread Julian Andres Klode
** Changed in: apt (Ubuntu Trusty)
   Status: New => In Progress

** Changed in: apt (Ubuntu Xenial)
   Status: New => In Progress

** Changed in: apt (Ubuntu Bionic)
   Status: New => In Progress

** Changed in: apt (Ubuntu Cosmic)
   Status: New => In Progress

** Changed in: apt (Ubuntu Disco)
   Status: New => In Progress

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1814727

Title:
  Backport never pinning and Packages-Require-Authorization

Status in apt package in Ubuntu:
  In Progress
Status in apt source package in Trusty:
  In Progress
Status in apt source package in Xenial:
  In Progress
Status in apt source package in Bionic:
  In Progress
Status in apt source package in Cosmic:
  In Progress
Status in apt source package in Disco:
  In Progress

Bug description:
  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:

  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify
  code quite a bit.

  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful
  both for private repositories, as it can prevent unattended-upgrades
  failures if you remove authorization info; and it also allows creating
  a new form of semi-private repository, where only pool/ requires
  authorization.

  [Test case]
  Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins

  Tests in older releases should be the same, but it's not clear yet.
  Bug will be updated once the SRUs are ready.

  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1814727/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp


[Touch-packages] [Bug 1814727] Re: Backport never pinning and Packages-Require-Authorization

2019-03-01 Thread Julian Andres Klode
** Description changed:

  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:
  
  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify code
  quite a bit.
  
  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful both
  for private repositories, as it can prevent unattended-upgrades failures
  if you remove authorization info; and it also allows creating a new form
  of semi-private repository, where only pool/ requires authorization.
  
  [Test case]
- Tests are included in autopkgtests and cover the common scenarios, except for 
trusty, where they have to be simulated:
- 
+ Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies
  
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins
  
  Tests in older releases should be the same, but it's not clear yet. Bug
  will be updated once the SRUs are ready.
  
  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1814727

Title:
  Backport never pinning and Packages-Require-Authorization

Status in apt package in Ubuntu:
  New
Status in apt source package in Trusty:
  New
Status in apt source package in Xenial:
  New
Status in apt source package in Bionic:
  New
Status in apt source package in Cosmic:
  New
Status in apt source package in Disco:
  New

Bug description:
  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:

  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify
  code quite a bit.

  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful
  both for private repositories, as it can prevent unattended-upgrades
  failures if you remove authorization info; and it also allows creating
  a new form of semi-private repository, where only pool/ requires
  authorization.

  [Test case]
  Tests are included in autopkgtests and cover the common scenarios
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins

  Tests in older releases should be the same, but it's not clear yet.
  Bug will be updated once the SRUs are ready.

  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1814727/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp


[Touch-packages] [Bug 1814727] Re: Backport never pinning and Packages-Require-Authorization

2019-03-01 Thread Julian Andres Klode
** Description changed:

  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:
  
  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify code
  quite a bit.
  
  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful both
  for private repositories, as it can prevent unattended-upgrades failures
  if you remove authorization info; and it also allows creating a new form
  of semi-private repository, where only pool/ requires authorization.
  
  [Test case]
- Tests are included in autopkgtests and cover the common scenarios.
+ Tests are included in autopkgtests and cover the common scenarios, except for 
trusty, where they have to be simulated:
  
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies
  
  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins
  
  Tests in older releases should be the same, but it's not clear yet. Bug
  will be updated once the SRUs are ready.
  
  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

** Also affects: apt (Ubuntu Xenial)
   Importance: Undecided
   Status: New

** Also affects: apt (Ubuntu Cosmic)
   Importance: Undecided
   Status: New

** Also affects: apt (Ubuntu Trusty)
   Importance: Undecided
   Status: New

** Also affects: apt (Ubuntu Disco)
   Importance: Undecided
   Status: New

** Also affects: apt (Ubuntu Bionic)
   Importance: Undecided
   Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1814727

Title:
  Backport never pinning and Packages-Require-Authorization

Status in apt package in Ubuntu:
  New
Status in apt source package in Trusty:
  New
Status in apt source package in Xenial:
  New
Status in apt source package in Bionic:
  New
Status in apt source package in Cosmic:
  New
Status in apt source package in Disco:
  New

Bug description:
  [Impact]
  These are not driven from a direct user experience, but are related to other 
developments:

  (1) unattended-upgrades could use the never pinning to disable
  repositories rather than switching candidates. That would simplify
  code quite a bit.

  (2) Packages-Require-Authorization lets a repository declare that
  downloading packages from it requires authorization. This is useful
  both for private repositories, as it can prevent unattended-upgrades
  failures if you remove authorization info; and it also allows creating
  a new form of semi-private repository, where only pool/ requires
  authorization.

  [Test case]
  Tests are included in autopkgtests and cover the common scenarios, except for 
trusty, where they have to be simulated:

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-packages-require-authorization:
  (1) Add repository with Packages-Require-Authorization and no auth.conf 
entry: pin -32768
  (2) Add repository with Packages-Require-Authorization and a auth.conf entry: 
pin 500
  (3) As (2), but a custom pin still applies

  
https://salsa.debian.org/apt-team/apt/blob/master/test/integration/test-policy-pinning#L365
  (1) Test that Pin-Priority: never overrides both per-package pins and 
per-repository pins
  (2) Test that Pin-Priority: never is only applied for per-repository 
(Package: *) pins

  Tests in older releases should be the same, but it's not clear yet.
  Bug will be updated once the SRUs are ready.

  [Regression potential]
  The changes might introduce regressions in pinning. The pinning 
implementation in trusty is substantially different from the other releases, 
and should thus require more testing.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1814727/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp