import new release

.gitlab-ci.yml

-image: debian:testing
-variables:
-  DEBIAN_FRONTEND: noninteractive
-
-test as root:
-  stage: test
-  script:
-    - adduser --home /home/travis travis --quiet --disabled-login --gecos "" --uid 1000
-    - rm -f /etc/dpkg/dpkg.cfg.d/excludes
-    - apt-get update
-    - apt-get install -qq build-essential expect gcovr sudo
-    - chmod -R o+rwX $PWD
-    - ./prepare-release travis-ci
-    - sudo -u travis mkdir build
-    - sudo -u travis env -C build cmake -DCMAKE_BUILD_TYPE=Coverage -G Ninja ..
-    - sudo -u travis ninja -C build
-    - CTEST_OUTPUT_ON_FAILURE=1 ninja -C build test
-    - unbuffer ./test/integration/run-tests -q -j 4
-    - gcovr
-
-test as user:
-  stage: test
-  script:
-    - adduser --home /home/travis travis --quiet --disabled-login --gecos "" --uid 1000
-    - rm -f /etc/dpkg/dpkg.cfg.d/excludes
-    - apt-get update
-    - apt-get install -qq build-essential expect gcovr sudo
-    - chmod 755 /root
-    - chmod -R o+rwX $PWD
-    - ./prepare-release travis-ci
-    - sudo -u travis mkdir build
-    - sudo -u travis env -C build cmake -DCMAKE_BUILD_TYPE=Coverage -G Ninja ..
-    - sudo -u travis ninja -C build
-    - sudo -u travis CTEST_OUTPUT_ON_FAILURE=1 ninja -C build test
-    - sudo -u travis unbuffer ./test/integration/run-tests -q -j 4
-    - sudo -u travis gcovr
+include: https://nest.parrotsec.org/parrot-organization/ci/raw/master/deb-build.yml

CMake/FindSystemd.cmake

+# - Try to find SYSTEMD
+# Once done, this will define
+#
+#  SYSTEMD_FOUND - system has SYSTEMD
+#  SYSTEMD_INCLUDE_DIRS - the SYSTEMD include directories
+#  SYSTEMD_LIBRARIES - the SYSTEMD library
+find_package(PkgConfig)
+
+pkg_check_modules(SYSTEMD_PKGCONF libsystemd)
+
+find_path(SYSTEMD_INCLUDE_DIRS
+  NAMES systemd/sd-bus.h
+  PATHS ${SYSTEMD_PKGCONF_INCLUDE_DIRS}
+)
+
+find_library(SYSTEMD_LIBRARIES
+  NAMES systemd
+  PATHS ${SYSTEMD_PKGCONF_LIBRARY_DIRS}
+)
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(Systemd DEFAULT_MSG SYSTEMD_INCLUDE_DIRS SYSTEMD_LIBRARIES)
+
+mark_as_advanced(SYSTEMD_INCLUDE_DIRS SYSTEMD_LIBRARIES)

CMake/config.h.in

@@ -20,6 +20,9 @@
 /* Define if we have the zstd library for zst */
 #cmakedefine HAVE_ZSTD
 
+/* Define if we have the systemd library */
+#cmakedefine HAVE_SYSTEMD
+
 /* Define if we have the udev library */
 #cmakedefine HAVE_UDEV
 

CMakeLists.txt

@@ -115,6 +115,11 @@ if (UDEV_FOUND)
   set(HAVE_UDEV 1)
 endif()
 
+find_package(Systemd)
+if (SYSTEMD_FOUND)
+  set(HAVE_SYSTEMD 1)
+endif()
+
 find_package(Seccomp)
 if (SECCOMP_FOUND)
   set(HAVE_SECCOMP 1)
@@ -188,7 +193,7 @@ check_cxx_target(HAVE_FMV_SSE42_AND_CRC32DI "sse4.2" "__builtin_ia32_crc32di(0,
 # Configure some variables like package, version and architecture.
 set(PACKAGE ${PROJECT_NAME})
 set(PACKAGE_MAIL "APT Development Team <deity@lists.debian.org>")
-set(PACKAGE_VERSION "1.8.0")
+set(PACKAGE_VERSION "1.8.2")
 
 if (NOT DEFINED DPKG_DATADIR)
   execute_process(COMMAND ${PERL_EXECUTABLE} -MDpkg -e "print $Dpkg::DATADIR;"

apt-pkg/CMakeLists.txt

@@ -46,6 +46,7 @@ target_include_directories(apt-pkg
                                    ${LZ4_INCLUDE_DIRS}
                                    $<$<BOOL:${ZSTD_FOUND}>:${ZSTD_INCLUDE_DIRS}>
                                    $<$<BOOL:${UDEV_FOUND}>:${UDEV_INCLUDE_DIRS}>
+                                   $<$<BOOL:${SYSTEMD_FOUND}>:${SYSTEMD_INCLUDE_DIRS}>
                                    ${ICONV_INCLUDE_DIRS}
 )
 
@@ -58,6 +59,7 @@ target_link_libraries(apt-pkg
                              ${LZ4_LIBRARIES}
                              $<$<BOOL:${ZSTD_FOUND}>:${ZSTD_LIBRARIES}>
                              $<$<BOOL:${UDEV_FOUND}>:${UDEV_LIBRARIES}>
+                             $<$<BOOL:${SYSTEMD_FOUND}>:${SYSTEMD_LIBRARIES}>
                              ${ICONV_LIBRARIES}
 )
 set_target_properties(apt-pkg PROPERTIES VERSION ${MAJOR}.${MINOR})

apt-pkg/contrib/fileutl.cc

@@ -71,6 +71,9 @@
 #ifdef HAVE_ZSTD
 #include <zstd.h>
 #endif
+#ifdef HAVE_SYSTEMD
+#include <systemd/sd-bus.h>
+#endif
 #include <endian.h>
 #include <stdint.h>
 
@@ -3393,3 +3396,48 @@ bool OpenConfigurationFileFd(std::string const &File, FileFd &Fd) /*{{{*/
    return true;
 }
 									/*}}}*/
+int Inhibit(const char *what, const char *who, const char *why, const char *mode) /*{{{*/
+{
+#ifdef HAVE_SYSTEMD
+   sd_bus_error error = SD_BUS_ERROR_NULL;
+   sd_bus_message *m = NULL;
+   sd_bus *bus = NULL;
+   int fd;
+   int r;
+
+   r = sd_bus_open_system(&bus);
+   if (r < 0)
+      goto out;
+
+   r = sd_bus_call_method(bus,
+			  "org.freedesktop.login1",
+			  "/org/freedesktop/login1",
+			  "org.freedesktop.login1.Manager",
+			  "Inhibit",
+			  &error,
+			  &m,
+			  "ssss",
+			  what,
+			  who,
+			  why,
+			  mode);
+   if (r < 0)
+      goto out;
+
+   r = sd_bus_message_read(m, "h", &fd);
+   if (r < 0)
+      goto out;
+
+   // We received a file descriptor, return it - systemd will close the read fd
+   // on free, so let's duplicate it here.
+   r = dup(fd);
+out:
+   sd_bus_error_free(&error);
+   sd_bus_message_unref(m);
+   sd_bus_unref(bus);
+   return r;
+#else
+   return -ENOTSUP;
+#endif
+}
+									/*}}}*/

apt-pkg/contrib/fileutl.h

@@ -300,4 +300,6 @@ bool Popen(const char* Args[], FileFd &Fd, pid_t &Child, FileFd::OpenMode Mode);
 
 APT_HIDDEN bool OpenConfigurationFileFd(std::string const &File, FileFd &Fd);
 
+APT_HIDDEN int Inhibit(const char *what, const char *who, const char *why, const char *mode);
+
 #endif

apt-pkg/deb/debsystem.cc

@@ -153,8 +153,8 @@ bool debSystem::UnLock(bool NoErrors)
       return _error->Error(_("Not locked"));
    if (--d->LockCount == 0)
    {
-      close(d->FrontendLockFD);
       close(d->LockFD);
+      close(d->FrontendLockFD);
       d->LockCount = 0;
    }
    

apt-pkg/deb/dpkgpm.cc

@@ -1463,6 +1463,21 @@ bool pkgDPkgPM::ExpandPendingCalls(std::vector<Item> &List, pkgDepCache &Cache)
 }
 bool pkgDPkgPM::Go(APT::Progress::PackageManager *progress)
 {
+   struct Inhibitor
+   {
+      int Fd = -1;
+      Inhibitor()
+      {
+	 if (_config->FindB("DPkg::Inhibit-Shutdown", true))
+	    Fd = Inhibit("shutdown", "APT", "APT is installing or removing packages", "block");
+      }
+      ~Inhibitor()
+      {
+	 if (Fd > 0)
+	    close(Fd);
+      }
+   } inhibitor;
+
    // explicitly remove&configure everything for hookscripts and progress building
    // we need them only temporarily through, so keep the length and erase afterwards
    decltype(List)::const_iterator::difference_type explicitIdx =

debian/NEWS

 apt (1.8.0~alpha3) unstable; urgency=medium
 
   The PATH for running dpkg is now configured by the option DPkg::Path,
-  and defaults to "/usr/sbin:/usr/bin:/sbin/:bin". Previous behavior of
+  and defaults to "/usr/sbin:/usr/bin:/sbin:/bin". Previous behavior of
   not changing PATH may be restored by setting the option to an empty string.
 
   Support for /etc/apt/auth.conf.d/ has been added, see apt_auth.conf(5).

debian/apt.conf.autoremove

@@ -17,6 +17,7 @@ APT
 	"linux-modules";
 	"linux-modules-extra";
 	"linux-signed-image";
+	"linux-image-unsigned";
 	# kfreebsd kernels
 	"kfreebsd-image";
 	"kfreebsd-headers";
@@ -30,6 +31,10 @@ APT
         # tools
         "linux-tools";
         "linux-cloud-tools";
+	# build info
+	"linux-buildinfo";
+	# source code
+	"linux-source";
   };
 
   Never-MarkAuto-Sections

debian/changelog

+apt (1.8.2+parrot2) testing; urgency=medium
+
+  * Update CI Configuration.
+
+ -- Lorenzo "Palinuro" Faletra <palinuro@parrotsec.org>  Wed, 05 Jun 2019 16:27:38 +0200
+
+apt (1.8.2+parrot1) testing; urgency=medium
+
+  * Import new Debian release.
+  * Re-apply https downgrade patch.
+
+ -- Lorenzo "Palinuro" Faletra <palinuro@parrotsec.org>  Wed, 05 Jun 2019 15:47:44 +0200
+
+apt (1.8.2) unstable; urgency=medium
+
+  [ Alwin Henseler ]
+  * Flip /: in documented default value of DPkg::Path (Closes: #917986)
+
+  [ TilmanK ]
+  * Fix typo in German manpage translation
+
+  [ Américo Monteiro ]
+  * Portuguese manpages translation update (Closes: #926614)
+
+  [ Jean-Pierre Giraud ]
+  * French manpages translation update (Closes: #929290)
+
+  [ Michael Zhivich ]
+  * methods: https: handle requests for TLS re-handshake (LP: #1829861)
+
+  [ Julian Andres Klode ]
+  * Unlock dpkg locks in reverse locking order (LP: #1829860)
+
+ -- Julian Andres Klode <jak@debian.org>  Tue, 28 May 2019 16:40:29 +0200
+
+apt (1.8.1+parrot1) testing; urgency=medium
+
+  * Import new Debian release.
+  * Re-apply https downgrade patch.
+
+ -- Lorenzo "Palinuro" Faletra <palinuro@parrotsec.org>  Fri, 10 May 2019 21:47:56 +0200
+
+apt (1.8.1) unstable; urgency=medium
+
+  * Add test case for local-only packages pinned to never
+  * Prevent shutdown while running dpkg (LP: #1820886)
+  * Add linux-{buildinfo,image-unsigned,source} versioned kernel pkgs
+    (LP: #1821640)
+
+ -- Julian Andres Klode <jak@debian.org>  Mon, 06 May 2019 10:41:52 +0200
+
 apt (1.8.0) unstable; urgency=medium
 
   [ David Kalnischkies ]

debian/control

@@ -21,6 +21,7 @@ Build-Depends: cmake (>= 3.4),
                liblz4-dev (>= 0.0~r126),
                liblzma-dev,
                libseccomp-dev [amd64 arm64 armel armhf i386 mips mips64el mipsel ppc64el s390x hppa powerpc powerpcspe ppc64 x32],
+               libsystemd-dev [linux-any],
                libudev-dev [linux-any],
                libzstd-dev (>= 1.0),
                ninja-build,

doc/apt-verbatim.ent

@@ -268,7 +268,7 @@
 ">
 
 <!-- this will be updated by 'prepare-release' -->
-<!ENTITY apt-product-version "1.8.0">
+<!ENTITY apt-product-version "1.8.2">
 
 <!-- (Code)names for various things used all over the place -->
 <!ENTITY debian-oldstable-codename "stretch">

doc/examples/configure-index

@@ -503,6 +503,9 @@ DPkg
       progress-bg "<STRING>";
       progress-bar "<BOOL>";
    };
+
+   // Set a shutdown block inhibitor on systemd systems while running dpkg
+   Inhibit-Shutdown "<BOOL>";
 }
 
 /* Options you can set to see some debugging text They correspond to names

doc/po/apt-doc.pot

@@ -5,9 +5,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: apt-doc 1.8.0\n"
+"Project-Id-Version: apt-doc 1.8.2\n"
 "Report-Msgid-Bugs-To: APT Development Team <deity@lists.debian.org>\n"
-"POT-Creation-Date: 2019-03-08 09:41+0100\n"
+"POT-Creation-Date: 2019-05-28 16:41+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

doc/po/de.po

@@ -670,7 +670,7 @@ msgid ""
 msgstr ""
 "Ganz wie <command>apt</command> selbst ist seine Handbuchseite als "
 "Endanwenderschnittstelle gedacht und erwähnt als solche nur die am "
-"häufigsten benutzten Befehle sowie Optionen. Die geschieht zum Teil, um "
+"häufigsten benutzten Befehle sowie Optionen. Dies geschieht zum Teil, um "
 "keine Informationen an mehreren Stellen zu duplizieren und zum Teil, um "
 "Leser nicht mit einem Überfluss an Optionen und Einzelheiten zu überwältigen."
 

doc/po/fr.po

@@ -7,13 +7,13 @@
 # Jérôme Marant, 2000.
 # Philippe Batailler, 2005.
 # Christian Perrier <bubulle@debian.org>, 2009, 2010, 2011, 2012, 2013.
-# Jean-Pierre Giraud <jean-pierregiraud@neuf.fr>, 2014, 2017, 2018.
+# Jean-Pierre Giraud <jean-pierregiraud@neuf.fr>, 2014, 2017-2019.
 msgid ""
 msgstr ""
 "Project-Id-Version: apt-doc 1.8.0\n"
 "Report-Msgid-Bugs-To: APT Development Team <deity@lists.debian.org>\n"
-"POT-Creation-Date: 2019-02-04 15:34+0100\n"
-"PO-Revision-Date: 2018-11-26 17:47+0100\n"
+"POT-Creation-Date: 2019-05-21 14:38+0200\n"
+"PO-Revision-Date: 2019-05-01 17:00+0100\n"
 "Last-Translator: Jean-Pierre Giraud <jean-pierregiraud@neuf.fr>\n"
 "Language-Team: French <debian-l10n-french@lists.debian.org>\n"
 "Language: fr\n"
@@ -1174,16 +1174,12 @@ msgstr ""
 
 #. type: Content of: <refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: apt-get.8.xml
-#, fuzzy
-#| msgid ""
-#| "A new <literal>list</literal> command is available similar to "
-#| "<literal>dpkg --list</literal>."
 msgid ""
 "<literal>reinstall</literal> is an alias for <literal>install --reinstall</"
 "literal>."
 msgstr ""
-"Une nouvelle commande <literal>list</literal> est disponible, semblable à la "
-"commande <literal>dpkg --list</literal>."
+"<literal>reinstall</literal> est un alias de la commande <literal>install --"
+"reinstall</literal>."
 
 #. type: Content of: <refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: apt-get.8.xml
@@ -3093,11 +3089,6 @@ msgstr ""
 
 #. type: Content of: <refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: apt-mark.8.xml
-#, fuzzy
-#| msgid ""
-#| "<literal>auto</literal> is used to mark a package as being automatically "
-#| "installed, which will cause the package to be removed when no more "
-#| "manually installed packages depend on this package."
 msgid ""
 "<literal>minimize-manual</literal> is used to mark (transitive) dependencies "
 "of metapackages as automatically installed.  This can be used after an "
@@ -3105,9 +3096,11 @@ msgid ""
 "packages; or continuously on systems managed by system configuration "
 "metapackages."
 msgstr ""
-"<literal>auto</literal> permet de marquer un paquet comme ayant été installé "
-"automatiquement. Un tel paquet sera supprimé automatiquement dès que plus "
-"aucun paquet installé manuellement ne dépend de lui."
+"<literal>minimize-manual</literal> permet de marquer les dépendances "
+"(transitives) de métapaquets comme ayant été installées automatiquement. "
+"Cela peut être utilisé par exemple après une installation pour réduire le "
+"nombre de paquets installés manuellement, ou de façon permanente sur des "
+"systèmes gérés par des métapaquets de configuration système."
 
 #. type: Content of: <refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: apt-mark.8.xml
@@ -5570,6 +5563,10 @@ msgid ""
 "used when running dpkg. It may be set to any valid value of that environment "
 "variable; or the empty string, in which case the variable is not changed."
 msgstr ""
+"Il s'agit d'une chaîne qui définit la variable d'environnement <envar>PATH</"
+"envar> utilisée lors de l'exécution de dpkg. Elle peut être définie à "
+"n'importe quelle valeur valable pour cette variable d'environnement ou être "
+"une chaîne vide, dans ce cas la variable n'est pas modifiée."
 
 #. type: Content of: <refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: apt.conf.5.xml
@@ -9870,19 +9867,15 @@ msgstr ""
 
 #. type: Content of: <refentry><refsect1><para>
 #: apt_auth.conf.5.xml
-#, fuzzy
-#| msgid ""
-#| "The APT auth.conf file <filename>/etc/apt/auth.conf</filename> can be "
-#| "used to store login information in a netrc-like format with restrictive "
-#| "file permissions."
 msgid ""
 "The APT auth.conf file <filename>/etc/apt/auth.conf</filename>, and .conf "
 "files inside <filename>/etc/apt/auth.conf.d</filename> can be used to store "
 "login information in a netrc-like format with restrictive file permissions."
 msgstr ""
-"Le fichier auth.conf d'APT <filename>/etc/apt/auth.conf</filename> peut être "
-"utilisé pour stocker les informations de connexion dans un format detype "
-"netrc avec des droits d'accès restreints"
+"Le fichier auth.conf d'APT <filename>/etc/apt/auth.conf</filename> ainsi que "
+"les fichiers .conf dans <filename>/etc/apt/auth.conf.d</filename> peuvent "
+"être utilisés pour stocker les informations de connexion dans un format de "
+"type netrc avec des droits d'accès restreints."
 
 #. type: Content of: <refentry><refsect1><title>
 #: apt_auth.conf.5.xml
@@ -10092,24 +10085,18 @@ msgstr ""
 
 #. type: Content of: <refentry><refsect1><variablelist><varlistentry><term>
 #: apt_auth.conf.5.xml
-#, fuzzy
-#| msgid "<filename>/etc/apt/auth.conf</filename>"
 msgid "<filename>/etc/apt/auth.conf.d/*.conf</filename>"
-msgstr "<filename>/etc/apt/auth.conf</filename>"
+msgstr "<filename>/etc/apt/auth.conf.d/*.conf</filename>"
 
 #. type: Content of: <refentry><refsect1><variablelist><varlistentry><listitem><para>
 #: apt_auth.conf.5.xml
-#, fuzzy
-#| msgid ""
-#| "Login information for APT sources and proxies in a netrc-like format.  "
-#| "Configuration Item: <literal>Dir::Etc::netrc</literal>."
 msgid ""
 "Login information for APT sources and proxies in a netrc-like format.  "
 "Configuration Item: <literal>Dir::Etc::netrcparts</literal>."
 msgstr ""
 "Informations de connexion pour les sources et les mandataires d'APT dans un "
-"format de type netrc. Élément de configuration : <literal>Dir::Etc::netrc</"
-"literal>."
+"format de type netrc. Élément de configuration : <literal>Dir::Etc::"
+"netrcparts</literal>."
 
 #. type: Content of: <refentry><refsect1><para>
 #: apt_auth.conf.5.xml

methods/basehttp.cc

@@ -373,6 +373,9 @@ BaseHttpMethod::DealWithHeaders(FetchResult &Res, RequestState &Req)
 	 // as well as http to https
 	 else if ((Uri.Access == "http" || Uri.Access == "https+http") && tmpURI.Access == "https")
 	    return TRY_AGAIN_OR_REDIRECT;
+	 // allow https to http redirects (for https mirrordirectors with http mirrors)
+	 else if ((Uri.Access == "https" || Uri.Access == "https+http") && tmpURI.Access == "http")
+	    return TRY_AGAIN_OR_REDIRECT;
 	 else
 	 {
 	    auto const tmpplus = tmpURI.Access.find('+');

methods/connect.cc

@@ -808,6 +808,7 @@ struct TlsFd : public MethodFd
    gnutls_session_t session;
    gnutls_certificate_credentials_t credentials;
    std::string hostname;
+   unsigned long Timeout;
 
    int Fd() APT_OVERRIDE { return UnderlyingFd->Fd(); }
 
@@ -820,9 +821,56 @@ struct TlsFd : public MethodFd
       return HandleError(gnutls_record_send(session, buf, count));
    }
 
+   ssize_t DoTLSHandshake()
+   {
+      int err;
+      // Do the handshake. Our socket is non-blocking, so we need to call WaitFd()
+      // accordingly.
+      do
+      {
+         err = gnutls_handshake(session);
+         if ((err == GNUTLS_E_INTERRUPTED || err == GNUTLS_E_AGAIN) &&
+             WaitFd(this->Fd(), gnutls_record_get_direction(session) == 1, Timeout) == false)
+         {
+            _error->Errno("select", "Could not wait for server fd");
+            return err;
+         }
+      } while (err < 0 && gnutls_error_is_fatal(err) == 0);
+
+      if (err < 0)
+      {
+         // Print reason why validation failed.
+         if (err == GNUTLS_E_CERTIFICATE_VERIFICATION_ERROR)
+         {
+            gnutls_datum_t txt;
+            auto type = gnutls_certificate_type_get(session);
+            auto status = gnutls_session_get_verify_cert_status(session);
+            if (gnutls_certificate_verification_status_print(status, type, &txt, 0) == 0)
+            {
+               _error->Error("Certificate verification failed: %s", txt.data);
+            }
+            gnutls_free(txt.data);
+         }
+         _error->Error("Could not handshake: %s", gnutls_strerror(err));
+      }
+      return err;
+   }
+
    template <typename T>
    T HandleError(T err)
    {
+      // Server may request re-handshake if client certificates need to be provided
+      // based on resource requested
+      if (err == GNUTLS_E_REHANDSHAKE)
+      {
+        int rc = DoTLSHandshake();
+	// Only reset err if DoTLSHandshake() fails.
+        // Otherwise, we want to follow the original error path and set errno to EAGAIN
+        // so that the request is retried.
+        if (rc < 0)
+          err = rc;
+      }
+
       if (err < 0 && gnutls_error_is_fatal(err))
 	 errno = EIO;
       else if (err < 0)
@@ -859,6 +907,7 @@ ResultState UnwrapTLS(std::string Host, std::unique_ptr<MethodFd> &Fd,
 
    tlsFd->hostname = Host;
    tlsFd->UnderlyingFd = MethodFd::FromFd(-1); // For now
+   tlsFd->Timeout = Timeout;
 
    if ((err = gnutls_init(&tlsFd->session, GNUTLS_CLIENT | GNUTLS_NONBLOCK)) < 0)
    {
@@ -992,37 +1041,11 @@ ResultState UnwrapTLS(std::string Host, std::unique_ptr<MethodFd> &Fd,
    tlsFd->UnderlyingFd = std::move(Fd);
    Fd.reset(tlsFd);
 
-   // Do the handshake. Our socket is non-blocking, so we need to call WaitFd()
-   // accordingly.
-   do
-   {
-      err = gnutls_handshake(tlsFd->session);
-      if ((err == GNUTLS_E_INTERRUPTED || err == GNUTLS_E_AGAIN) &&
-	  WaitFd(Fd->Fd(), gnutls_record_get_direction(tlsFd->session) == 1, Timeout) == false)
-      {
-	 _error->Errno("select", "Could not wait for server fd");
-	 return ResultState::TRANSIENT_ERROR;
-      }
-   } while (err < 0 && gnutls_error_is_fatal(err) == 0);
+   // Do the handshake.
+   err = tlsFd->DoTLSHandshake();
 
    if (err < 0)
-   {
-      // Print reason why validation failed.
-      if (err == GNUTLS_E_CERTIFICATE_VERIFICATION_ERROR)
-      {
-	 gnutls_datum_t txt;
-	 auto type = gnutls_certificate_type_get(tlsFd->session);
-	 auto status = gnutls_session_get_verify_cert_status(tlsFd->session);
-	 if (gnutls_certificate_verification_status_print(status,
-							  type, &txt, 0) == 0)
-	 {
-	    _error->Error("Certificate verification failed: %s", txt.data);
-	 }
-	 gnutls_free(txt.data);
-      }
-      _error->Error("Could not handshake: %s", gnutls_strerror(err));
       return ResultState::FATAL_ERROR;
-   }
 
    return ResultState::SUCCESSFUL;
 }

po/apt-all.pot

@@ -5,9 +5,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: apt 1.8.0\n"
+"Project-Id-Version: apt 1.8.2\n"
 "Report-Msgid-Bugs-To: APT Development Team <deity@lists.debian.org>\n"
-"POT-Creation-Date: 2019-03-08 09:41+0100\n"
+"POT-Creation-Date: 2019-05-28 16:41+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

test/integration/test-policy-pinning

@@ -407,7 +407,20 @@ testsuccessequal "coolstuff:
         500 file:${tmppath}/aptarchive stable/main all Packages" aptcache policy coolstuff
 
 
-
+msgmsg "Check that local-only versions can be pinned correctly (LP: #1821308)"
+echo "Package: coolstuff
+Pin: version 2.0~bpo1
+Pin-Priority: 1000" > rootdir/etc/apt/preferences
+testsuccessequal "coolstuff:
+  Installed: 2.0~bpo1
+  Candidate: 2.0~bpo1
+  Version table:
+     2.0~bpo2 100
+        100 file:${tmppath}/aptarchive backports/main all Packages
+ *** 2.0~bpo1 1000
+        100 ${tmppath}/rootdir/var/lib/dpkg/status