Devuan bug report logs - #787
Security problem in apt-get download

Package: apt; Reported by: David Garfield <[email protected]>; dated Sat, 2 Sep 2023 13:54:01 UTC; Maintainer for apt is Andreas Messer <[email protected]>.

Message received at [email protected]:

Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=2a03:4000:24:9b0::1; helo=nyx.bastelmap.de; [email protected]; receiver=<UNKNOWN> 
Date: Mon, 4 Sep 2023 18:32:04 +0200
From: Andreas Messer <[email protected]>
To: David Garfield <[email protected]>, [email protected]
Subject: Re: bug#787: Also in daedalus.
Message-ID: <[email protected]>
References: <MW4PR15MB5232AF97D608FE4DB2391C74A0EBA@MW4PR15MB5232.namprd15.prod.outlook.com>
 <MW4PR15MB5232C011D69EF5B9798D982FA0EBA@MW4PR15MB5232.namprd15.prod.outlook.com>
 <[email protected]>
 <MW4PR15MB5232AF97D608FE4DB2391C74A0EBA@MW4PR15MB5232.namprd15.prod.outlook.com>
 <MW4PR15MB5232A1B26729613F400858C5A0EBA@MW4PR15MB5232.namprd15.prod.outlook.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="71s4TpQIRD1Gg8O+"
Content-Disposition: inline
In-Reply-To: <MW4PR15MB5232A1B26729613F400858C5A0EBA@MW4PR15MB5232.namprd15.prod.outlook.com>


--71s4TpQIRD1Gg8O+
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi David,

sorry, for my late reply

Am Sat, Sep 02, 2023 at 09:35:59PM +0000 schrieb David Garfield:
> I accept that it should be fixed upstream, but am aware that if I give
> Devuan version numbers, they will almost certainly want it referred to
> Devuan.  In this case, do I report it as versions 2.2.4 and 2.6.1?

yes, just cut of the "devuanXYZ" suffix from the version and you get
the origin Debian package version. Thanks for you help & support.

cheers,
Andreas

--=20
gnuPG keyid: 8C2BAF51
fingerprint: 28EE 8438 E688 D992 3661 C753 90B3 BAAA 8C2B AF51

--71s4TpQIRD1Gg8O+
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iF0EABEIAB0WIQQo7oQ45ojZkjZhx1OQs7qqjCuvUQUCZPYGgAAKCRCQs7qqjCuv
USpkAJ9iCDdS3RKcgcl0GcMKbtNBhi2rqACdEIinyMZWTaRuExre2MIHEgKo/Y4=
=vvOO
-----END PGP SIGNATURE-----

--71s4TpQIRD1Gg8O+--

Acknowledgement sent to Andreas Messer <[email protected]>:
Extra info received and forwarded to list. Full text available.

Information forwarded to [email protected]:
bug#787; Package apt. Full text available.

Message received at [email protected]:

Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=40.107.243.49; helo=nam12-dm6-obe.outbound.protection.outlook.com; [email protected]; receiver=<UNKNOWN> 
From: David Garfield <[email protected]>
To: Andreas Messer <[email protected]>, "[email protected]"
	<[email protected]>
Subject: Re: bug#787: Also in daedalus.
Thread-Topic: bug#787: Also in daedalus.
Thread-Index: AQHZ3cYAxtW1vwDQU0G02/s0cicQIbAIDZKAgAAAfUY=
Date: Sat, 2 Sep 2023 21:35:59 +0000
Message-ID:
 <MW4PR15MB5232A1B26729613F400858C5A0EBA@MW4PR15MB5232.namprd15.prod.outlook.com>
References:
 <MW4PR15MB5232AF97D608FE4DB2391C74A0EBA@MW4PR15MB5232.namprd15.prod.outlook.com>
 <MW4PR15MB5232C011D69EF5B9798D982FA0EBA@MW4PR15MB5232.namprd15.prod.outlook.com>
 <[email protected]>
In-Reply-To: <[email protected]>
Accept-Language: en-US
Content-Language: en-US
msip_labels:
authentication-results: dkim=none (message not signed)
 header.d=none;dmarc=none action=none header.from=barlinq.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MW4PR15MB5232:EE_|SA1PR15MB4500:EE_
x-ms-office365-filtering-correlation-id: 10772e47-e7da-45d3-251a-08dbabfc9934
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info:
 mppFnhAGMWWxUGD/R2nATnaNt8PViuhYIE0oo17QIM0TpmLjZwJltVNdmKxpSlWlLukQd/q9WvAxGM//Hb9l90U252jgnQRd9GZDqwSbt9F2VpMccjgpBJrAD4f0ra2lvGfd0vFDLIvA6uWfJSL6ZN20XBGzBxaWMzRclco/dDR/EkHUVY1/wlKwnB4BtwXNMkvLsoHvubhsK5uoNPUNVsL/YbH2UJIEDw81897WlC2HRgl/hVY/IJlVCOdxxGJGxFn5Yh+DxV64LnGlo+G8cFRS5JZImAqG79bguMXl4/r7UnVK+dZMP/THxwMAubvHnzC2X9I77O1KOQhZY8M3tA9iOpYsUgN0CeyXxP3HisNrkRVsRohbwDAhYxzUzckOp4Em/tFvJ5NzWlX0aA5oAchnpTN/rTqXtj4evku5Sm2NfbIzIDHC6qa4xUOzEFhHQmGE68QIjG6vaS3PXoivtVolDw/KPMY8Xm3ufOM+miuddQYUoWBEcUcTIHHyDXKXjDIU59/z9mv1ZZXIE4wudLaaRlADODQHOeb+z0PBBWXvfGVg/nbKL9Bzhi91xJVDcw94P7N/cD9KWisZPTDBMvJefQrigk8SFOTj4Hg7A3mO9WX8JeMYe6K4+UVCsKfS
x-forefront-antispam-report:
 CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MW4PR15MB5232.namprd15.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(366004)(136003)(39830400003)(346002)(376002)(396003)(186009)(1800799009)(451199024)(478600001)(71200400001)(91956017)(110136005)(64756008)(66556008)(66946007)(76116006)(66446008)(66476007)(6506007)(7696005)(9686003)(2906002)(8676002)(8936002)(316002)(41300700001)(52536014)(5660300002)(86362001)(558084003)(33656002)(122000001)(38070700005)(38100700002)(55016003);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
 =?iso-8859-1?Q?+DwEbbe08hXIk9XEySUbXiyH3eOG7bkvRlTCuG0I97kCxZLs1box6ZOkEf?=
 =?iso-8859-1?Q?j+dAYfQ/6sTHp2gqqyvq9q4WthMPPzvr5tQGL1NJ1FWEfRlccW+jeOh2UF?=
 =?iso-8859-1?Q?CuoZoGERCuyzxKnj7uk7jBiwz3bn/hrx5Engy5Nuivp6xmtHwQilSspz7M?=
 =?iso-8859-1?Q?K8R3s3ZEgTnUH1Qr+Utxq2ywtC3uOBT2wRuk1yLyNWuubzIGjBG7BQ9YBl?=
 =?iso-8859-1?Q?WTYmURuKvYfrVEvLW5WEBdIDqEkd3V7mpKdZ6BNzeCPYxciJ+KdZt5c0Jf?=
 =?iso-8859-1?Q?67vv1/PI2j5PnSBZhVyY+m20itc3D/4/2gbpYE/Aca0mAw99FwdC97uBzJ?=
 =?iso-8859-1?Q?1KrVJVX0Ge8FBVAwe2EStgRAWFS5sYX+9djm6PExA+g1I14sH+Dlq9H7dv?=
 =?iso-8859-1?Q?b8PDeWZiYMFrbL5rHME9PBuv6EaYt6KsRqjA4tG19Qrq7f27tRsOMdmwkn?=
 =?iso-8859-1?Q?r4aoqiN458y3mwUINalybHCrx8WJeRsGUKD0sDWww8ocX7+htp04vZ0NEk?=
 =?iso-8859-1?Q?lGJ4SnO8lEoIU+ouPsYLenNNl+msJPhTJ5ewAHmzqTk4f0kArPAxXaUkKf?=
 =?iso-8859-1?Q?cj3y3kaqjcxPfch/lxvuIiJuPVahMoPtsmm77+Zw3mSKAzlC04zIXqjCrL?=
 =?iso-8859-1?Q?Skqr/WtVlF70fiMsW+h491WGtKngc8l3lm1ciEtE3yHdxg4S0Kq1OsRoFk?=
 =?iso-8859-1?Q?Gb0I6iU9rS9E2NrzEdaFaItFK7rKkzfpo2H1uhOCCAok884tbGJbLpOmrZ?=
 =?iso-8859-1?Q?C4mHqlGvz2ocnCUfR+r+7ct/0yuBYsemNBi7jSh0bIkKaIVVmwZ/B/1Jge?=
 =?iso-8859-1?Q?FXXvdTpJWLtiFwGGrUBB2qpL4R24LFVSni9VMgkKxFFYvHmdcjortq4PHP?=
 =?iso-8859-1?Q?OicX4ziYzp9rVIEQZywhUukyNPdUNUjGh72N/C0c3valCxYq384ji8KI6w?=
 =?iso-8859-1?Q?7fvvp1L6UhdRmJeTwpmgziSP5ON62OHrVBJFvkT4OVtM6D1lpQpOu8ALy0?=
 =?iso-8859-1?Q?q6YqRMz8u+sP4OfvNVdrbShfrJQFvS+cHtWM0GCSN3Izwa4UmFE2PwNxX/?=
 =?iso-8859-1?Q?vj+uZO7k5JF150Y9lQDpfIpbDUShoABZIR7aRshsHawVkz7HnOolBzGmtp?=
 =?iso-8859-1?Q?nfzH4IQTYDHfUwxSRS4lcm2dl+OwmBgPVMgix/IpWZjzgr/SKUD//yIxZ5?=
 =?iso-8859-1?Q?5Ybm+TGOpfcf+9u3MhGmYBf5dJSCYikj4ShKj8mfdG+txyB1RMYbyGvbNT?=
 =?iso-8859-1?Q?BkeoviN3vwNvQz8PZH/rjXPrss8UkQUDT2WazQdqEPhAQo8deuzp7PMmMv?=
 =?iso-8859-1?Q?RhgxBaWl84syEn/EcJRKi0Psd46o50SzOmJli8SO9HAzeODnfIjK6Dl6BW?=
 =?iso-8859-1?Q?ZQ/iKm4t3aTezNBkH0moKmCX0ncohy/wbNexIPt4bu3iuTy3z61n7bcew3?=
 =?iso-8859-1?Q?du0ZbvMvLKUGsaJtyIUav8HILUfmFYY0mG0sW+38QNTlOoLZ+ZW/DngiQ0?=
 =?iso-8859-1?Q?W7Cly+70qJ77ZCLHexd/VVqPSovUxmiObU8dYU9DekxD9y6Vc/ZF7phAjV?=
 =?iso-8859-1?Q?zgcj4xIhA9HRj9WlfY3Bc8AyddF8JQXO99z4w0DJoo5bMYwVKbCnwiWZWE?=
 =?iso-8859-1?Q?LEjij4IXiy0KwzJat0wWtuB7fqf5mjsSTjCQDWnbFO1G6rgfulvpPNMBKZ?=
 =?iso-8859-1?Q?P8clrthz8PUZl1ocnQw=3D?=
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: barlinq.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MW4PR15MB5232.namprd15.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 10772e47-e7da-45d3-251a-08dbabfc9934
X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Sep 2023 21:35:59.3417
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: a9fb585b-2832-4cb7-8219-8a6d478ec428
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: DoMJRmJaQY9kV3NiXadrVYOCQkw2iAxxtKC8eXyvZgE9L7SnhaLIHL47B5eLVsP4xuLm+YvsuewnANBHdcOP8Q==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR15MB4500

I accept that it should be fixed upstream, but am aware that if I give Devu=
an version numbers, they will almost certainly want it referred to Devuan. =
 In this case, do I report it as versions 2.2.4 and 2.6.1?=0A=
=0A=
--David=

Acknowledgement sent to David Garfield <[email protected]>:
Extra info received and forwarded to list. Copy sent to Andreas Messer <[email protected]>. Full text available.

Information forwarded to [email protected], Andreas Messer <[email protected]>:
bug#787; Package apt. Full text available.

Message received at [email protected]:

Received: (at 787) by bugs.devuan.org; 2 Sep 2023 21:30:03 +0000
Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: from email.devuan.org [2a01:4f8:140:32a1::58c6:6473]
	by doc.devuan.org with IMAP (fetchmail-6.4.16)
	for <debbugs@localhost> (single-drop); Sat, 02 Sep 2023 21:30:03 +0000 (UTC)
Received: from email.devuan.org
	by email.devuan.org with LMTP
	id 3GG+LUKp82SHdQAAmSBk0A
	(envelope-from <[email protected]>)
	for <[email protected]>; Sat, 02 Sep 2023 21:29:38 +0000
Received: by email.devuan.org (Postfix, from userid 109)
	id AEC201CB; Sat,  2 Sep 2023 21:29:38 +0000 (UTC)
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on email.devuan.org
X-Spam-Level: 
X-Spam-Status: No, score=-0.0 required=5.0 tests=SPF_PASS autolearn=ham
	autolearn_force=no version=3.4.6
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=2a03:4000:24:9b0::1; helo=nyx.bastelmap.de; [email protected]; receiver=<UNKNOWN> 
Received: from nyx.bastelmap.de (nyx.bastelmap.de [IPv6:2a03:4000:24:9b0::1])
	by email.devuan.org (Postfix) with ESMTPS id 3ADAC81
	for <[email protected]>; Sat,  2 Sep 2023 21:29:33 +0000 (UTC)
Received: from zeus.ad.home.arpa (pd95e12bf.dip0.t-ipconnect.de [217.94.18.191])
	by nyx.bastelmap.de (Postfix) with ESMTPSA id 8A0BF33FAA7;
	Sat,  2 Sep 2023 23:29:32 +0200 (CEST)
Date: Sat, 2 Sep 2023 23:29:31 +0200
From: Andreas Messer <[email protected]>
To: David Garfield <[email protected]>, [email protected]
Subject: Re: bug#787: Also in daedalus.
Message-ID: <[email protected]>
References: <MW4PR15MB5232AF97D608FE4DB2391C74A0EBA@MW4PR15MB5232.namprd15.prod.outlook.com>
 <MW4PR15MB5232C011D69EF5B9798D982FA0EBA@MW4PR15MB5232.namprd15.prod.outlook.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="nt0KUSR3kJbxOJ6K"
Content-Disposition: inline
In-Reply-To: <MW4PR15MB5232C011D69EF5B9798D982FA0EBA@MW4PR15MB5232.namprd15.prod.outlook.com>


--nt0KUSR3kJbxOJ6K
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi David,

apt on Devuan is identical to the original version from Debian despite
that I have patched out systemd dependency. So it would be great, if
you report this directly to Debian maintainers since Debian will be
affected by this as well. I believe it makes most sense to correct this
upstream. Thanks for your help!

cheers,
Andreas
--=20
gnuPG keyid: 8C2BAF51
fingerprint: 28EE 8438 E688 D992 3661 C753 90B3 BAAA 8C2B AF51

--nt0KUSR3kJbxOJ6K
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iF0EABEIAB0WIQQo7oQ45ojZkjZhx1OQs7qqjCuvUQUCZPOpNwAKCRCQs7qqjCuv
UZpfAJ9VvLl7/22bj/KYvBw9TwuO1/NbrgCgquGSAgizNt2kSrN2vIlihlZaKYc=
=zG1t
-----END PGP SIGNATURE-----

--nt0KUSR3kJbxOJ6K--

Acknowledgement sent to Andreas Messer <[email protected]>:
Extra info received and forwarded to list. Full text available.

Information forwarded to [email protected]:
bug#787; Package apt. Full text available.

Message received at [email protected]:

Received: (at 787) by bugs.devuan.org; 2 Sep 2023 17:57:05 +0000
Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: from email.devuan.org [2a01:4f8:140:32a1::58c6:6473]
	by doc.devuan.org with IMAP (fetchmail-6.4.16)
	for <debbugs@localhost> (single-drop); Sat, 02 Sep 2023 17:57:05 +0000 (UTC)
Received: from email.devuan.org
	by email.devuan.org with LMTP
	id LvO6HyB382S1bAAAmSBk0A
	(envelope-from <[email protected]>)
	for <[email protected]>; Sat, 02 Sep 2023 17:55:44 +0000
Received: by email.devuan.org (Postfix, from userid 109)
	id 098C7173; Sat,  2 Sep 2023 17:55:29 +0000 (UTC)
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on email.devuan.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.0 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	HTML_MESSAGE,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_PASS
	autolearn=ham autolearn_force=no version=3.4.6
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=40.107.220.48; helo=nam11-co1-obe.outbound.protection.outlook.com; [email protected]; receiver=<UNKNOWN> 
Received: from NAM11-CO1-obe.outbound.protection.outlook.com (mail-co1nam11on2048.outbound.protection.outlook.com [40.107.220.48])
	by email.devuan.org (Postfix) with ESMTPS id 60E9F1D
	for <[email protected]>; Sat,  2 Sep 2023 17:55:12 +0000 (UTC)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
 b=T7sITP/8kQcYUqx8h10YVnKbEHs3C1+FfrTU3CEab68Qn3jq1wV2rEnuuYWeQdFEfnJeIZwq8CY9bTJFL9CI173ToAFkv7hImfsqsL3LsagiqBJtIs8mJe1r4GtRA9oxiBj49iMcVwfBvhkugvMor0MPwFsWFYWXwkGkOyGmprsEgKMVqb6vKXVgcy/5S5pGLoUqoRfFjzjuM0KpKI/YwIiURM5wY+7NAeft4GelPeNV49o4YE5TxSrdtblKiFn02rUvnwXCOuecdbEsF5vRh+r2OnwNefk5ov+AzrbDE3RQTSvdbMfO/C4qqJRmDfIeO8QpTNb8g8o/XvubpQZraA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
 bh=cRgRNprIzT/cTYngghHkQrOFV/XVOxMXNgj6B/zDuUc=;
 b=EJ2AdhZvbqQIzCmC5sEy6AtcnHL2JHpmFzsCBBu74Ftg1RBriLYDCUILu7Ini+ao2tUqLSXvEI9g09hqHL8UGrkHFBzy3ZydR3fT7SA66cwIolU2FzhmReuAXGpvlpCqFBsufhde9DG2iNmccJelVzwJU6oLVu9pXsjYdXpIsGT9qP719tJbuEl6jwBGhG+uwTKVbbjDA4SLJakFUUQXCbg6OVHDxWwsRgNshc0cpvXAZTuMX2BDDa+EEeMZRImg34zy5vNvdG2Rh9kswfrcs8zAYdFUO2plICWYVH7/l85YRNdnrBspvH8j1kXmHbq6qU6kAIzZoSHgbVSoDT7neQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
 smtp.mailfrom=barlinq.com; dmarc=pass action=none header.from=barlinq.com;
 dkim=pass header.d=barlinq.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=NETORGFT3607363.onmicrosoft.com;
 s=selector2-NETORGFT3607363-onmicrosoft-com;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=cRgRNprIzT/cTYngghHkQrOFV/XVOxMXNgj6B/zDuUc=;
 b=eOw4ea1zsF3qtSYv49FAx/7pMBTH1xN3U+fMyaTrhjgzHIYe4ayeOYzCs3EMEP4LGbEFLPh2kfwhVzBOxZi36fhYrrWkhBIzzxbZku4OIpGfGiEPfhI4eVu4r+PSfTO7qm2lu/i/3l7jnUkTSglADTxrV5stiK3YrLKEgojyKyA=
Received: from MW4PR15MB5232.namprd15.prod.outlook.com (2603:10b6:303:169::10)
 by PH7PR15MB5452.namprd15.prod.outlook.com (2603:10b6:510:1f8::17) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6745.28; Sat, 2 Sep
 2023 17:55:04 +0000
Received: from MW4PR15MB5232.namprd15.prod.outlook.com
 ([fe80::8e98:8707:e49e:f29d]) by MW4PR15MB5232.namprd15.prod.outlook.com
 ([fe80::8e98:8707:e49e:f29d%7]) with mapi id 15.20.6745.026; Sat, 2 Sep 2023
 17:55:04 +0000
From: David Garfield <[email protected]>
To: "[email protected]" <[email protected]>
Subject: Also in daedalus.
Thread-Topic: Also in daedalus.
Thread-Index: AQHZ3cYAxtW1vwDQU0G02/s0cicQIQ==
Date: Sat, 2 Sep 2023 17:55:04 +0000
Message-ID:
 <MW4PR15MB5232C011D69EF5B9798D982FA0EBA@MW4PR15MB5232.namprd15.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
authentication-results: dkim=none (message not signed)
 header.d=none;dmarc=none action=none header.from=barlinq.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MW4PR15MB5232:EE_|PH7PR15MB5452:EE_
x-ms-office365-filtering-correlation-id: 552b2c3f-c22e-4df9-16e4-08dbabddbcb7
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info:
 CgNLN5XtK4ZyeNlAhJBRBw2W7JVlW/LieioicsH1S43GFMNd5P140y4z9kiD+ckEd2vCB687jJ8fUV/8lcYusxI6GX9NBEvbb8OEPEAl8YGm2Y69OVgc3RxCxg/vx+x+TED5oZSn7B7RUJAH4KRrAlxLFc0UGqBNC4jXNBAeX9QjUaXxR0GblkBRbyMvs7l7GjwwMxqpSLzxAV59EX4+GVzSQoRdhVB18fP9v85ZirWp+icxBXe9MG+XhVw92a7JjZRshVCtFXlpfCFbkzVOqHnt5b5S1v+XQPlVFqNwOKeXhXqY6NVJhS9RiITa2d7LiqgigLPJFxmctbrKrYrnm6K+l96kkfu7XFrf1vzdWjGPBBGNJPQrGS3+1/FVFncC6KgQf30ZYNF+wGLTNq/pLMDeG/7Jp8IJssRmxF9Xu85NDkRQzRA/q4oFVG72+uA5QSUydBYDxxXZ0GqaNAkznPDYdZEF7vmiz1Kja/bRXhcA+xkfZuxkRysdIslFdqK7r5lRmmyHweFtxQe0nZmj8fDnJqVIi56JbChlVHAE8a0mnrA74DMK4hEN/63RP16uwz/hYiVcOEmPKpWhcEFJFQNcz11MeP41OiuwICBZoYL+D30WvRwq11M/BImTNpnl
x-forefront-antispam-report:
 CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MW4PR15MB5232.namprd15.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(136003)(39830400003)(396003)(376002)(346002)(366004)(1800799009)(451199024)(186009)(8676002)(8936002)(5660300002)(316002)(6916009)(64756008)(66446008)(66476007)(2906002)(91956017)(66556008)(76116006)(66946007)(19627405001)(7116003)(52536014)(41300700001)(6506007)(7696005)(9686003)(3480700007)(55016003)(38070700005)(38100700002)(122000001)(71200400001)(478600001)(83380400001)(86362001)(33656002)(558084003);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
 =?iso-8859-1?Q?VcET9/GaFx22AwKqhE9YK9LwTwi3Okwg5fPUZKi6MjsfBSQL8cXZYMWZTn?=
 =?iso-8859-1?Q?cCFwGzn2kW7a67XjgaPib+VHJkRUZ13slB2LGMAVAHQmzWg0CFvK6uCy8N?=
 =?iso-8859-1?Q?OtMhCrmeiiUg/I6+Iv/8+4u/G8iV7e4OzIamYQMirgRv+LEDoFLHlIxzc8?=
 =?iso-8859-1?Q?kY99AXYwstfp7oGGscMoW6eduDIhvUKt18dSq73dLgtDXzVg06bHVXGiUV?=
 =?iso-8859-1?Q?sHmM+BIWjh2hNdpaKXF1/EOlgXczXPeIGNDDKaNwEP56z66nBNMwfmsjni?=
 =?iso-8859-1?Q?rVwU+OkAkXRCx4i50hUnHyOQGS2FtvvxvlW18hScD8X0ljraLIisjnjX96?=
 =?iso-8859-1?Q?rrdamZ8msEEcqxdn0KUgve7Kce6IwBrXTdR8UBEcqzow1c0+zNpqpqZUll?=
 =?iso-8859-1?Q?dsxDPGEfShul6sdnpH40Fv8rvJXJmnvlPe4P0SaZbt8Zpf8DvT7nQWVF1R?=
 =?iso-8859-1?Q?5YOtvxTp89BQXsF50eiIqGBk3RzUF9jVGMz2YE3yTzUKrhcrQchf5GYpue?=
 =?iso-8859-1?Q?qt1VTkI8GJuQfkk9fz9fQbuCwNfv8cR5qRQxWG2uMka2JSBQheZsNjbSBe?=
 =?iso-8859-1?Q?rhlJj+CvP64kaMxLlO+QzotM3SY82mSry+vRHW84qSGBguPOmf2pVnNrNU?=
 =?iso-8859-1?Q?b2QP7bxJuFfm070ThBFPN7bhpm2cG+tv+lLfaSzU9lLPbI0OL5Ee5CxEg2?=
 =?iso-8859-1?Q?QhH0ZPV4p6UB08IbKx0t+AEwgwuSKdBQU8MNtsQ+iH59fKVYIwHLIZBkXq?=
 =?iso-8859-1?Q?v0Y78liGRQYUIbQfiLKx/OGCI9jAx4mBMH/XAE8Fa8Ywdjg4YO0pN6mGb7?=
 =?iso-8859-1?Q?85nuHIjTQ0NTTAEEPHGRe/8jyJAiV2kqIR7IYMchVt1cijWbNQOJaWOIOp?=
 =?iso-8859-1?Q?+H47rFWqeTp6heaTXPq8YrzdAzAst7OATdJDYiClJegGhz7SuyV6aPvUdB?=
 =?iso-8859-1?Q?S9NaSMuC/1DmYDvk3rzlKwxl9o1p9bBl6hfkKzVFLw/5WLiKnNuu37hp6v?=
 =?iso-8859-1?Q?4fxMxT+2vf55Z0vcoBwtgTzWwal/+Af2aD42B2nPSIatER7Ye0Jw3Y7gdv?=
 =?iso-8859-1?Q?VaspNzLEOG69a0NqP1dNVKvvcnP8FUCwzx8BW7Y2klfSC+mwCivrtm43bq?=
 =?iso-8859-1?Q?qLh0UlchPsDYrFf0sWvv9MaKwGSCfvcWI3jwwhkPoL1PbthK9NuVsw+b7M?=
 =?iso-8859-1?Q?V6ckHPFdz0QIEmOBwXlUfOCEKYCw5awEJJRJXPhwyANJ9yNHK2E7RY3kBk?=
 =?iso-8859-1?Q?A7oCHIlyS3IoxfVUet7dRJC/n02W7EZ1Nk1x9k/968xpGLWa4If2+psGZo?=
 =?iso-8859-1?Q?LVItwRBmwtOUvXFprgqZts3KzdXQERhW2zQyNxuC+tVj2l24j+Na5hgexN?=
 =?iso-8859-1?Q?w3IV3l8ZBxDIU/KWPVS1Je3YWOBnbqKBYmK/bNhkBsrl/t6AkWiPNIa7Ih?=
 =?iso-8859-1?Q?9MbFfm6mlsNKaEmKvoKXefdeLge2ls9aUmkBWWrXTfOpbNh4/fycxsdMVO?=
 =?iso-8859-1?Q?zsne27cHdCkv8F+W1j6oba2FV0gcQrBf1k5JHILYYNf4Nirr1JMpbP990u?=
 =?iso-8859-1?Q?oaoGSAh786+f/VnV+OAsLa/cBWRmYNugdXOO86YpLl2venAzGEF2HgLIop?=
 =?iso-8859-1?Q?KQk5CV7K9ZBX/nPLrnPCJll5hdTxp0LjT+ljZQk0N0PEqsAUmWhf524vNh?=
 =?iso-8859-1?Q?paC0/zDCmjIsRVtvVOw=3D?=
Content-Type: multipart/alternative;
	boundary="_000_MW4PR15MB5232C011D69EF5B9798D982FA0EBAMW4PR15MB5232namp_"
MIME-Version: 1.0
X-OriginatorOrg: barlinq.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MW4PR15MB5232.namprd15.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 552b2c3f-c22e-4df9-16e4-08dbabddbcb7
X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Sep 2023 17:55:04.4818
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: a9fb585b-2832-4cb7-8219-8a6d478ec428
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: p/0rvafae8VSoUnd4DI0TGGtiueYAysz3vbWSIPQYAXZW8Eg1c3wfKJ8HPGzwIRu7jh6dnvrad04JlhubG1viQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR15MB5452

--_000_MW4PR15MB5232C011D69EF5B9798D982FA0EBAMW4PR15MB5232namp_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Version: 2.6.1devuan1

I can now confirm the problem also occurs in version 2.6.1devuan1 as used i=
n daedalus.

--_000_MW4PR15MB5232C011D69EF5B9798D982FA0EBAMW4PR15MB5232namp_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof ContentPasted0 ContentPasted1">
Version: 2.6.1devuan1<br>
</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof ContentPasted0">
<br>
</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof ContentPasted0">
I can now confirm the problem also occurs in version 2.6.1devuan1 as used i=
n daedalus.<br>
</div>
</body>
</html>

--_000_MW4PR15MB5232C011D69EF5B9798D982FA0EBAMW4PR15MB5232namp_--

Acknowledgement sent to David Garfield <[email protected]>:
Extra info received and forwarded to list. Copy sent to Andreas Messer <[email protected]>. Full text available.

Information forwarded to [email protected], Andreas Messer <[email protected]>:
bug#787; Package apt. Full text available.

Message received at [email protected]:

Received: (at submit) by bugs.devuan.org; 2 Sep 2023 13:52:35 +0000
Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: from email.devuan.org [2a01:4f8:140:32a1::58c6:6473]
	by doc.devuan.org with IMAP (fetchmail-6.4.16)
	for <debbugs@localhost> (single-drop); Sat, 02 Sep 2023 13:52:35 +0000 (UTC)
Received: from email.devuan.org
	by email.devuan.org with LMTP
	id 6iwbLOU982TRYQAAmSBk0A
	(envelope-from <[email protected]>)
	for <[email protected]>; Sat, 02 Sep 2023 13:51:33 +0000
Received: by email.devuan.org (Postfix, from userid 109)
	id A7246AC6; Sat,  2 Sep 2023 13:51:33 +0000 (UTC)
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on email.devuan.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.0 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_PASS autolearn=ham
	autolearn_force=no version=3.4.6
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=40.107.96.89; helo=nam02-sn1-obe.outbound.protection.outlook.com; [email protected]; receiver=<UNKNOWN> 
Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on2089.outbound.protection.outlook.com [40.107.96.89])
	by email.devuan.org (Postfix) with ESMTPS id F174C27
	for <[email protected]>; Sat,  2 Sep 2023 13:51:25 +0000 (UTC)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
 b=HbOSMbFQ1Gg7kk20QCpLfh4XSCCOgSu+8FOBLtqFrP4G66iON5uHeShQO3SEH2Bxgjjiy2+CtbJWO80hHmF8Wq5NN8ZMSAqLmhcopl2bh7C0Bqq2W+kdnhqySBYMvpDkhr1805FXl+B3kVwYwnW4SphRnJNDYnbsurE3Yw/IeluveWfeND4MTl8wCVw4bslbHcLV50nj6mYLLKwEVQjdlOaHJwtn6XcVou2KFvDZANpEu4mLODYMC2CWYgalb8qeqPAttmFqXCEcl7kRSiy9Es5ZXsPQmqTTX2YG39ukbJEJTYTGJJFYYltFaO9nQcthblotnxNsTlSmGsUFVWmBDw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
 bh=akrA3WU7dLT/XY6G4M2S5eubhjf4+8zNJfIXTLGsn74=;
 b=lKdwM2guIdE5S/CL8BPnWaYvB4kqpj+vBXmINel1bl9wh+SDJDrZGQUIUhnMmPl6/op07VpgQo/libntxzeCCcYAm2X76b4UiJ8Ziv/BxC/4ND8JikP8c0B6egdsPE4ySrGGp3ZlUOvMVw4U9CzHp71mZUxx4j13uThPezCoE3Kb8fSd+FUKzxiar0JwswdryVh9jfBhMmaqE0WQEAOUfzin1T6mlaPLMfjD0JEUGF5yo1iBSGKQFcuSR4haA8B73APEtOT/4kZCBY0+3kelUJaQGA4FY3kxo17peJeTk0nZcmIWWx3uC9jrYE+W53JUPbr0+ZkOgmUXdYBS3nBK5g==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
 smtp.mailfrom=barlinq.com; dmarc=pass action=none header.from=barlinq.com;
 dkim=pass header.d=barlinq.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=NETORGFT3607363.onmicrosoft.com;
 s=selector2-NETORGFT3607363-onmicrosoft-com;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=akrA3WU7dLT/XY6G4M2S5eubhjf4+8zNJfIXTLGsn74=;
 b=c5CBi2nNaQJgfOgjJzwMNJ+JdswcuFef/zp2NJz+VmzLrT+5XGLOolH+qezcaVW2/yURtuFolsSBV6l5cSTem7NEhu+j2FpILcdg/NYus0EecfzrDwQnCir7GpuvkeAcOJOtZjGTSKe7tSVga/Tyqq7EvU0oLA4u5ggUFuJsTM0=
Received: from MW4PR15MB5232.namprd15.prod.outlook.com (2603:10b6:303:169::10)
 by IA1PR15MB5583.namprd15.prod.outlook.com (2603:10b6:208:429::15) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6745.28; Sat, 2 Sep
 2023 13:51:21 +0000
Received: from MW4PR15MB5232.namprd15.prod.outlook.com
 ([fe80::8e98:8707:e49e:f29d]) by MW4PR15MB5232.namprd15.prod.outlook.com
 ([fe80::8e98:8707:e49e:f29d%7]) with mapi id 15.20.6745.026; Sat, 2 Sep 2023
 13:51:20 +0000
From: David Garfield <[email protected]>
To: "[email protected]" <[email protected]>
Subject: Security problem in apt-get download
Thread-Topic: Security problem in apt-get download
Thread-Index: AQHZ3aJQZOJYFd4Qp0yF6rc0wjVhxQ==
Date: Sat, 2 Sep 2023 13:51:20 +0000
Message-ID:
 <MW4PR15MB5232AF97D608FE4DB2391C74A0EBA@MW4PR15MB5232.namprd15.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
authentication-results: dkim=none (message not signed)
 header.d=none;dmarc=none action=none header.from=barlinq.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MW4PR15MB5232:EE_|IA1PR15MB5583:EE_
x-ms-office365-filtering-correlation-id: 1d07efe3-6611-4845-07c5-08dbabbbafe9
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info:
 KaxAprPbkUB2+LUDDr4bwkkol3mIOYfb+XTQ9/h28JLVCKeC47qZF8sPMCj2BOs3admm9iHjn7Wy0QsNzXqlVa0bJnVD2UJTmgQWXZn69w32fjDOrF7UBx+AzAM/FAPxU4hDV2lPZ0eEyDGXbdyhmEcprFIyd91chXij2G0ey1Kyz70h+PJqnwTzPkPoNz9WtqqFvHA86hAIb5xyWooxTu4VZX6RBPElcGcVv91wN61W/NVrG2J+MGCeqDuxJjo9LtQPEp8sPVFaLMKfePC/KJUMz7UFoBcCysc5Y2iM0J1QKqMlQmMBwnJNMlhnd9sMIgemwaL+hWxftLMIVtRqfxMpsASLeSimcqbaVDr1kSr7CmtrWafGo41NRd+RXLY1U6GTSQBCIovuA1qhsHzQElEev4FElLqRcSeDnSjDHZR+/PdP8Dd220dZ2B6knxTy4v3Eso2OJQdqZptDDmeYCeAH+lrsI5W59QhpH6e7WQKWRFWmKdXl8JPTytsUW5PwVgUgY1cJGqtKP+jp9dsKMqcqoltFG/u1x389dLuKt8+6GDQ4Uo5PTIzXZZyxf1cAHWnL9Bz4QP1DPWDkthCzAKPtiQMI5Qc++gEOebXySHK/dINTLVi1/0ccVFqoAzNa
x-forefront-antispam-report:
 CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MW4PR15MB5232.namprd15.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(376002)(396003)(366004)(346002)(39830400003)(136003)(186009)(1800799009)(451199024)(41300700001)(71200400001)(7696005)(6506007)(478600001)(122000001)(38070700005)(38100700002)(83380400001)(9686003)(15650500001)(55016003)(91956017)(76116006)(66946007)(2906002)(66556008)(316002)(66476007)(66446008)(64756008)(6916009)(33656002)(86362001)(5660300002)(52536014)(8936002)(8676002);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
 =?iso-8859-1?Q?SD1IlZ/d0izjiu+rJ5fhBT7YOjL1RiU3F7H6vog8v6uxIVMzaQN5SoCCh2?=
 =?iso-8859-1?Q?X7CIbF+kwvGG9jTFDJopVa1yN8NeOO7VnIRzd0532uAT3PMe1QCxtTs2CN?=
 =?iso-8859-1?Q?kroADU2p3gRLPiJ/1teTDekPIiljPA9AdsbwENRdA0md6bj0zWYN0xl1j4?=
 =?iso-8859-1?Q?1rERF6f7gpB6+yZmZHdK+gve7ClHpsNRY1wUQK1twVtrr1OHC86JeP28yK?=
 =?iso-8859-1?Q?G8ScqQoDpnNwPJKXkcasHMo3+JuhYkQ2nACDcFdrCxODkNIOpp4KMhZvNJ?=
 =?iso-8859-1?Q?4QoHrcTX5OMcGDkcKqM6Jrah7QYl8e3cZqWyg2YMjqG1XYorYxwdlOnpIK?=
 =?iso-8859-1?Q?+QJcu4nGQO5p0chxAgLAVPbwPlJn3Q/0ekn6AvhfcqTLhysyUAwVbJIXmI?=
 =?iso-8859-1?Q?k+DPvuNRfVNPIG0pV8nT8/l2Y0fa3oPT0F982WVvH2GYJCqG15ampQxkOU?=
 =?iso-8859-1?Q?fhycGzx9nl9Ckx9tY6c0tYDhjX1VA2BsFJ4nOLoKHQPCMtE5lrpGr5iG21?=
 =?iso-8859-1?Q?O035CWuIPFUF1uwzh7Ku2p5WDEc16busFsHJurFJrRVEPEODLFTI1p70tl?=
 =?iso-8859-1?Q?aNWOcyo6hA2NdOYZY+4M7u6myPnTAmpYW1cZs/QeeTRiCb7mqBMSOBozb3?=
 =?iso-8859-1?Q?N3hp4jEBqAlRsD/Dy6h0bmAB81HX48p2L2vHcrQWjqzFERhCggfB6RdpjV?=
 =?iso-8859-1?Q?z+ffUbk8CZvG9Nwcf0gEBDGDZLeH4AFQqO9d83lXLGm/siSoD9/V/JIxm8?=
 =?iso-8859-1?Q?Dg2LALrZIli7MmYOh3bkM8wzJ3wCNNLppG+KDn37CQfjtx7D82yBL6mMLI?=
 =?iso-8859-1?Q?IqhGKnZ18TBtB50BHuZ8RvfPlj+UXzsAy1ZOP+pqaoPjIV3Y59ZrY3UDSy?=
 =?iso-8859-1?Q?11mDiUQW1V7el5wvxNl+yzO1yzZuJaDaheVsobiQpQBO5rxbNrM9B9WcKK?=
 =?iso-8859-1?Q?spvlVMj3Xf/ktTFyBvYAdQ5RyDjp3HIbcMD4z1lOpTfDNCvat/RARa3Jem?=
 =?iso-8859-1?Q?+8/dyROMSObquCaD7kN8yG1/wH0kEgre/A3dM5J/T4geXWNBTw1Rt9KwOa?=
 =?iso-8859-1?Q?jAT0sIDkzsM7aDuqWQQsmDxAUV0R6hi/ZKYAscQa5d9IZHmoY0wjSugNe9?=
 =?iso-8859-1?Q?gM3JLayAWOQqsrx+8wBlXkGvbgep7/HnldnCjzwlzkdre3qN1X4VN0g0pM?=
 =?iso-8859-1?Q?1a3MpvvtzShm2YFJFsgny3+mEBRXlkkmAQPZRmpQqGX4XcPPygcKA0arhX?=
 =?iso-8859-1?Q?53CltE/VQRtMR26VQQB1wNRWx7xY8zNOwG3RJxTanEsLgz8cHX/WktwxLD?=
 =?iso-8859-1?Q?tFL27xm700EZrMeRaG9CLO1aYg7l14P2yQBlcsnz1Fgp41C5Epy0nFQo7n?=
 =?iso-8859-1?Q?rQcoUmQXuh+PI7MxPD1cI0F0fMUpaSEd2ydjvnYWViQok/cVfSGZ07drkO?=
 =?iso-8859-1?Q?zU/2sFukSVLBD/sN/GF/XK71jDzuolRfm/WbblvuKrM47m4tT4NHR7K0Gh?=
 =?iso-8859-1?Q?a4eON7A5swqv39xMyChK/zwXRK4CC+jDzPH5JY+3/g9bbmmhCNV9eVDGiU?=
 =?iso-8859-1?Q?stXkFUOYW7JfotsqcKbs3QEZfNr/x02VBYf3MkF8/ZY/btriRB9zS3kYiF?=
 =?iso-8859-1?Q?NnyXJhX9vwiSoJa0z1XvYFzwClppp9brx5QxAMsGTuGrGrUdPVZDp1Qom4?=
 =?iso-8859-1?Q?3VGf+l+Kj+dieFOuGk4=3D?=
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: barlinq.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MW4PR15MB5232.namprd15.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 1d07efe3-6611-4845-07c5-08dbabbbafe9
X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Sep 2023 13:51:20.1430
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: a9fb585b-2832-4cb7-8219-8a6d478ec428
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 6n47SvvLecm3R72vocuHnRa+jm4Vnc6ikPCt8RhxcOqALzWfrkNd58sO+HhgqsZdNe9dlCUG5K5rdejPCazVOQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR15MB5583

Package: apt=0A=
Version: 2.2.4+devuan1=0A=
=0A=
Normally, "apt-get download package" will leave "package_version_arch.deb" =
if all goes right, and "package_version_arch.deb.FAILED" if the download fa=
ils.=0A=
=0A=
Under certain errors, the .deb form will be left when it is damaged or othe=
rwise unverified.=0A=
=0A=
These errors include:=0A=
1) Sending a signal to the download (pressing ^\).=0A=
2) Running out of disk space.=0A=
=0A=
Getting a complete but unverified file would be a race condition.=0A=
=0A=
This might not seem like a serious issue, but if you are doing an unattende=
d operation and not paying particular attention to the messages, instead dt=
rusting to the filename being right, then in this case we get the wrong fil=
ename making us believe that we have a valid download when we do not.=0A=
=0A=
I think the obvious solution to this is to download the file as "package_ve=
rsion_arch.deb.PARTIAL" and rename it as appropriate after package verifica=
tion.=0A=
=0A=
For testing purposes, I recommend using a large package, like "flightgear-d=
ata-base", or a kernel image.=0A=
=0A=

Acknowledgement sent to David Garfield <[email protected]>:
New bug report received and forwarded. Copy sent to Andreas Messer <[email protected]>. Full text available.

Report forwarded to [email protected], Andreas Messer <[email protected]>:
bug#787; Package apt. Full text available.

Devuan bug report logs - #787 Security problem in apt-get download

Message received at [email protected]:

Message received at [email protected]:

Message received at [email protected]:

Message received at [email protected]:

Message received at [email protected]:

Devuan bug report logs - #787
Security problem in apt-get download