#1095230 apt-cacher-ng sends RFC non-compliant timestamps to clients

Package:
apt-cacher-ng
Source:
apt-cacher-ng
Description:
caching proxy server for software repositories
Submitter:
John Hallam
Date:
2025-02-05 15:45:02 UTC
Severity:
normal
#1095230#5
Date:
2025-02-05 15:34:29 UTC
From:
To:
  When sending files to clients, apt-cacher-ng generates obsolete timestamps for
the HTTP interaction, since it uses asctime() to produce them.  This causes
interoperability problems.  The relevant spec at

https://datatracker.ietf.org/doc/html/rfc2616#section-3.3.1

says:

        HTTP/1.1 clients and servers that parse the date value MUST
        accept all three formats (for compatibility with HTTP/1.0),
        though they MUST only generate the RFC 1123 format for
        representing HTTP-date values in header fields.

  To fix this:

  - change FormatTime(...) in meta.cc to generate a standards-compliant timestamp
    RFC 1123 format

  - change the definition of tLocalGetFitem(...) in job.cc so that the magic
    number 26 becomes 28  (or, better, arrange for the magic number, which is
    the length of the timestamp, to be computed rather than assumed)

  No doubt the same issue affects earlier versions of the apt-cacher-ng package.

  I noticed this issue while running Devuan Chimaera with C library (libc-bin)
2.31-13+deb11u11 -- though that's irrelevant since the package is non-conformant
to RFC whatever it is run on.