Package "python-apt"

  python-apt (1.1.0~beta1ubuntu0.16.04.7) xenial-security; urgency=medium

  * SECURITY UPDATE: Check that repository is trusted before downloading
    files from it (LP: #1858973)
    - apt/cache.py: Add checks to fetch_archives() and commit()
    - apt/package.py: Add checks to fetch_binary() and fetch_source()
    - CVE-2019-15796
  * SECURITY UPDATE: Do not use MD5 for verifying downloadeds
    (Closes: #944696) (#LP: #1858972)
    - apt/package.py: Use all hashes when fetching packages, and
      check that we have trusted hashes when downloading
    - CVE-2019-15795
  * To work around the new checks, the parameter allow_unauthenticated=True
    can be passed to the functions. It defaults to the value of the
    APT::Get::AllowUnauthenticated option.
    - Bump Breaks aptdaemon (<< 1.1.1+bzr982-0ubuntu14.2), as it will have
      to set that parameter after having done validation.
  * Necessary backports:
    - turn elements in apt_pkg.SourceRecords.files into a class, rather than
      a tuple (w/ legacy compat), so we can get to their hashes
    - add apt_pkg.HashStringList
    - add apt_pkg.Hashes.hashes
  * Automatic changes and fixes for external regressions:
    - Adjustments to test suite and CI to fix CI regressions
    - Automatic mirror list update

 -- Julian Andres Klode <email address hidden> Wed, 15 Jan 2020 17:14:05 +0100

  python-apt (1.1.0~beta1ubuntu0.16.04.5) xenial; urgency=medium

  * Fix erronous use of apt_pkg.Error
    apt_pkg.Error was introduced in later versions, and accidentally
    used when backporting fixes in the previous SRU. (LP: #1830635)
  * Update mirror lists

 -- Julian Andres Klode <email address hidden> Mon, 27 May 2019 18:05:12 +0200

  python-apt (1.1.0~beta1ubuntu0.16.04.4) xenial; urgency=medium

  * apt.Cache: Fix (un)locking of archives (Closes: #922416) (LP: #1826870)
  * apt.Cache: Use explicit, more safe locking in update()
  * Update mirror lists

  python-apt (1.1.0~beta1ubuntu0.16.04.2) xenial; urgency=medium

  * python/tag.cc: Fix invalid read in TagFileNext
  * DepCache: Check that candidate we are setting belongs to package
  * Raise CacheMismatchError if objects passed to DepCache are from different cache
    (LP: #1737441); also includes the following regression fixes from bionic:
    - apt.Cache: Remap objects when reopening cache (LP: 1773316 in bionic+), incl. regression fixes:
      + Add more extensive test cases for cache remapping
      + Regression fix: Do not override __hash__ in apt.package.Package (LP: 1780099 in bionic+)
  * CI / pre-build / data changes:
    - Replace broken travis CI integration with current docker-based one
    - utils/get_debian_mirrors.py: Get data from salsa (for pre-build hook)
    - debian/control: Point to salsa instead of anonscm
    - debian/gbp.conf: Point to 1.1.y-xenial branch
    - Updated mirror list

 -- Julian Andres Klode <email address hidden> Tue, 10 Jul 2018 12:47:50 +0200

  python-apt (1.1.0~beta1ubuntu0.16.04.1) xenial; urgency=medium

  * Refreshed mirror list for upcoming point-release.

 -- Łukasz 'sil2100' Zemczak <email address hidden> Tue, 20 Feb 2018 11:14:53 +0100