apt-cache doesn't differentiate sources that share protocol, host, release and archive name

Message-ID: <email address hidden>
Date: Fri, 23 Sep 2005 16:23:58 +0200
From: Pierre THIERRY <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: apt-cache doesn't differentiate sources that share protocol, host, release and archive name

--1kVeyRzorzGcO9ta
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Package: apt
Version: 0.5.28.6
Severity: serious
Tags: security
Justification: User can think he's installing Debian software when he's not

When multiple sources are used with APT that are hosted on the same host
with the same protocol, and also share combinations of release and
archive (e.g. etch/main), apt-cache policy shows their packages in a
identical form. That has lead me to think that mplayer and transcode had
been accepted in Debian and install a non-official package of ffmpeg,
because I had Christian Marillat's source in my sources.list.

Thus, any source on a server of an official Debian source that contain
packages without security fixes or with additional security holes, whose
version is higher than Debian official packages will lead the user to an
unprotected situation, even if he is cautious of what packages he
installs, in terms of security.

pierre@bateleur:~$ apt-cache policy mplayer-k6
mplayer-k6:
  Install=E9=A0: (aucun)
  Candidat=A0: 1:1.0-pre7-0.0
 Table de version=A0:
     1:1.0-pre7cvs20050716-0.1 0
        500 ftp://ftp.nerim.net sid/main Packages
     1:1.0-pre7-0.0 0
        500 ftp://ftp.nerim.net sarge/main Packages
        990 ftp://ftp.nerim.net etch/main Packages
        100 /var/lib/dpkg/status

pierre@bateleur:~$ apt-cache policy ffmpeg
ffmpeg:
  Install=E9=A0: 0.cvs20050918-4
  Candidat=A0: 3:20050806-0.2
 Table de version=A0:
     3:20050806-0.2 0
        500 ftp://ftp.nerim.net sid/main Packages
     3:20050427-0sarge0.1 0
        500 ftp://ftp.nerim.net sarge/main Packages
 *** 0.cvs20050918-4 0
        500 ftp://ftp.nerim.net sid/main Packages
        100 /var/lib/dpkg/status
     0.cvs20050313-2 0
        500 ftp://ftp.nerim.net sarge/main Packages
        990 ftp://ftp.nerim.net etch/main Packages

-- Package-specific info:

-- apt-config dump --

APT "";
APT::Architecture "i386";
APT::Build-Essential "";
APT::Build-Essential:: "build-essential";
APT::Default-Release "testing";
Dir "/";
Dir::State "var/lib/apt/";
Dir::State::lists "lists/";
Dir::State::cdroms "cdroms.list";
Dir::State::userstatus "status.user";
Dir::State::status "/var/lib/dpkg/status";
Dir::Cache "var/cache/apt/";
Dir::Cache::archives "archives/";
Dir::Cache::srcpkgcache "srcpkgcache.bin";
Dir::Cache::pkgcache "pkgcache.bin";
Dir::Etc "etc/apt/";
Dir::Etc::sourcelist "sources.list";
Dir::Etc::vendorlist "vendors.list";
Dir::Etc::vendorparts "vendors.list.d";
Dir::Etc::main "apt.conf";
Dir::Etc::parts "apt.conf.d";
Dir::Etc::preferences "preferences";
Dir::Bin "";
Dir::Bin::methods "/usr/lib/apt/methods";
Dir::Bin::dpkg "/usr/bin/dpkg";
DPkg "";
DPkg::Pre-Install-Pkgs "";
DPkg::Pre-Install-Pkgs:: "if dpkg -s apt-listbugs | grep -q '^Status: .* ok=
 installed'; then /usr/sbin/apt-listbugs apt |...

Message-Id: <email address hidden>
Date: Fri, 23 Sep 2005 10:42:43 -0700
From: Steve Langasek <email address hidden>
To: <email address hidden>
Subject: severity of 329814 is normal

# Automatically generated email from bts, devscripts version 2.9.4
severity 329814 normal

Not even remotely critical

Note that with the advent of PPAs this becomes relevant: I cannot tell from which PPA a package is coming, even with specifying -V to apt. The different PPAs are essentially different repositories, so I may only wish to trust packages from certain PPAs.

Not High importance perhaps, but surely not Invalid

Yes, I just installed (with the daily updates) a linux-libc-dev package. I want to disable the PPA repo, but I don't know which of the twenty has offered it.
So, I would also love to have more info from apt-cache. Is this possible (and is it very difficult)?

An example of the problems with madison and PPAs:

mbp@grace% apt-cache madison bzr
       bzr | 2.1.0+b1+4878+129~8.10 | http://ppa.launchpad.net karmic/main Packages
       bzr | 2.0.2-1~bazaar1~karmic | http://ppa.launchpad.net karmic/main Packages
       bzr | 2.0.1-1~bazaar1~karmic | http://ppa.launchpad.net karmic/main Packages
       bzr | 2.0.0-0ubuntu1 | http://mirror.internode.on.net karmic/main Packages

How do you know which ppa it is?

This bug was fixed in the package apt - 0.7.25.3ubuntu2

---------------
apt (0.7.25.3ubuntu2) lucid; urgency=low

  [ Michael Vogt ]
  * abicheck/
    - add new abitest tester using the ABI Compliance Checker from
      http://ispras.linuxfoundation.org/index.php/ABI_compliance_checker
  * debian/apt.conf.autoremove:
    - add "oldlibs" to the APT::Never-MarkAuto-Sections as its used
      for transitional packages
  * apt-pkg/deb/dpkgpm.cc:
    - fix backgrounding when dpkg runs (closes: #486222)
  * cmdline/apt-mark:
    - show error on incorrect aguments (LP: #517917), thanks to
      Torsten Spindler
  * cmdline/apt-get.cc:
    - if apt-get source foo=version or foo/distro can not be found,
      error out (LP: #502641)
  * apt-pkg/indexfile.cc:
    - deal correctly with three letter langcodes (LP: #391409)
  * debian/apt.cron.daily:
    - do not look into admin users gconf anymore for the http proxy
      the user now needs to use the "Apply system-wide" UI in the
      gnome-control-center to set it
  * debian/apt.postinst:
    - add set_apt_proxy_from_gconf() and run that once on upgrade if
      there is no proxy configured already system-wide (LP: #432631)
      From that point on gnome-control-center will have to warn if
      the user makes changes to the proxy settings and does not apply
      them system wide

  [ Robert Collins ]
  * Change the package index Info methods to allow apt-cache policy to be
    useful when using several different archives on the same host.
    (Closes: #329814, LP: #22354)
 -- Michael Vogt <email address hidden> Fri, 12 Mar 2010 23:10:52 +0100