vcswatch reports that
this package seems to have new commits in its VCS but has
not yet updated debian/changelog. You should consider updating
the Debian changelog and uploading this new version into the archive.
Here are the relevant commit logs:
commit db6bacfc868bcae99708ca009b87c4d3d8115f93
Merge: c1278ed2 1f97d88e
Author: Julian Andres Klode <jak@debian.org>
Date: Fri Oct 23 16:03:36 2026 +0000
Merge branch 'gpg-pgp-cleanup' into 'main'
Clean up some confused vocabulary about GPG and OpenPGP
See merge request apt-team/apt!627
commit 1f97d88ee64279b1d8c92c088932161beac3b1a6
Author: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Thu Oct 1 16:17:45 2026 -0400
Clean up some confused vocabulary about GPG and OpenPGP
commit c1278ed208db40be9dee3a6c83549def3e84e7aa
Merge: 8366f94e b185b3e3
Author: Julian Andres Klode <jak@debian.org>
Date: Fri Oct 23 16:00:38 2026 +0000
Merge branch 'fix/build-profile-bounded-view' into 'main'
deblistparser: bound build-profile restriction parsing
See merge request apt-team/apt!632
commit b185b3e3d80aa3cdf59b12b51834a65d48ef7461
Author: Zara Grigoryan <zara.grigoryan@canonical.com>
Date: Wed Oct 21 17:34:40 2026 +0400
deblistparser: bound build-profile restriction parsing
Parse restriction groups and terms using string_view to avoid out-of-bounds accesses and invalid term ranges. Preserve AND/OR and negation semantics, reject empty groups and bare negation terms, and check for a missing architecture-list closing bracket before advancing.
Add regression coverage for whitespace handling and malformed input, including buffers without a terminating NUL.
Addresses the problems reported by Ramesh Adhikari in APT MR !604, following the bounded-view approach suggested by Julian.
See: https://salsa.debian.org/apt-team/apt/-/merge_requests/604
commit 8366f94e36647fc498bc3793cf508f106ef0f5ef
Merge: 8f66d6af 5c6be0ce
Author: Julian Andres Klode <jak@debian.org>
Date: Fri Oct 23 15:23:47 2026 +0000
Merge branch 'no-fingerprints' into 'main'
Deprecate fingerprints in Signed-By
See merge request apt-team/apt!633
commit 5c6be0cee6da645267b3bc154c19570a0055ce12
Author: Julian Andres Klode <jak@debian.org>
Date: Wed Oct 21 22:00:12 2026 +0200
Remove support for Signed-By specified inside a Release file
A Release file could carry a Signed-By field acting as a sort of public
key pinning: while the previous Release file was still valid, its value
became the default for the signed-by option of the sources.list entries
for this repository, restricting the keys the next Release file had to
be signed with. Remove this feature; a Signed-By field inside a Release
file is now ignored and triggers a warning during update.
apt-ftparchive no longer writes the field, and the documentation and
tests referencing it are adjusted accordingly.
commit 1213149c7cb9b707963ec6fc1fe9dfbd0c8283b3
Author: Julian Andres Klode <jak@debian.org>
Date: Wed Oct 21 21:42:14 2026 +0200
Deprecate fingerprints in Signed-By
Specifying fingerprints in the Signed-By option of sources.list entries
is deprecated; emit a warning during update for sources still using them
so users can migrate to keyring files or embedded keys.
Remove documentation for the feature as well.
Closes: #1151505
commit 8f66d6af826b0dbac03d19793c7d9adf95c100d2
Merge: e9e1eedb 88ed29ae
Author: Julian Andres Klode <jak@debian.org>
Date: Fri Oct 23 15:21:53 2026 +0000
Merge branch 'cmake-refactoring' into 'main'
Build Refactoring to enable unit testing of hidden visibility functions
See merge request apt-team/apt!634
commit 88ed29ae7a6a9fff7b66a6cac7a317bbf42ad2fb
Author: Julian Andres Klode <jak@debian.org>
Date: Fri Oct 23 09:29:32 2026 +0200
apt-pkg: Only replace generated tagfile-keys files if changed
commit f18a3bc0cbe1921ce32c900a98c4d5d85e4c8ae3
Author: Julian Andres Klode <jak@debian.org>
Date: Thu Oct 22 21:34:16 2026 +0200
test/libapt: Link against the apt-pkg/apt-private object libraries
This gives the tests access to hidden symbols; json_test.cc can now
use the JsonWriter header instead of compiling in .cc files.
commit 4e273b4ecf9ce2ebffb14f0fb8ecd6b04da014b7
Author: Julian Andres Klode <jak@debian.org>
Date: Thu Oct 22 21:31:23 2026 +0200
apt-private: Build sources in an apt-private-object OBJECT library
The object library has no dependency on apt-pkg-object; the shared
library keeps resolving apt-pkg symbols from libapt-pkg.
commit 457eea65521fd9716ab15872ae6b5e1167629cfa
Author: Julian Andres Klode <jak@debian.org>
Date: Thu Oct 22 21:30:38 2026 +0200
apt-pkg: Build sources in an apt-pkg-object OBJECT library
Compile the libapt-pkg sources once into an apt-pkg-object OBJECT
library and link the apt-pkg shared library from it, so the objects
can be reused directly by other targets (such as the unit tests).
The object library carries the compile-time settings (include paths,
hidden visibility, PIC) and the private link dependencies, which
propagate to consumers as link-only requirements. The translation
domain target is switched to apt-pkg-object, as the sources and hence
the APT_DOMAIN compile definition now live there.
commit ec380f2466a3c3c45f0953ec1500302732bd21c9
Author: Julian Andres Klode <jak@debian.org>
Date: Thu Oct 22 21:25:11 2026 +0200
apt-private: Move JsonWriter into private-json-writer.h
Extract the JsonWriter class from private-json-hooks.cc into its own
header so it can be reused without including the whole implementation
file. The class stays APT_HIDDEN, so the library's symbol surface is
unchanged.
commit 83e16fd759c13a17350bb9553ac84c96ff87034f
Author: Julian Andres Klode <jak@debian.org>
Date: Thu Oct 22 21:23:02 2026 +0200
Bump cmake_minimum_required to 4.2
commit e9e1eedb020d566a671391e4d3178a7d2f7e2d6f
Merge: 546e6358 5043f948
Author: Julian Andres Klode <jak@debian.org>
Date: Fri Oct 23 15:19:08 2026 +0000
Merge branch 'fix/sha3-cachedb-s390x' into 'main'
test: Skip the cachedb SHA3 migration test on big-endian hosts
See merge request apt-team/apt!635
commit 5043f948b22229e70b456451aa4163ab9be57472
Author: Gianpiero Carpinelli <gianpiero.carpinelli@canonical.com>
Date: Fri Oct 23 03:38:39 2026 +0100
test: Skip the cachedb SHA3 migration test on big-endian hosts
!626 added SHA3-256 and SHA3-512 to apt-ftparchive. To cache the new
digests, two fields were appended to the stat record that the cache
database stores for each file, in the same way that SHA2-512 was added.
test-apt-ftparchive-cachedb-sha3-migration makes sure a cache database
written by an apt from before that change, holding only SHA2 digests,
still works after upgrading: the SHA2 digests are reused instead of
recomputed, the SHA3 ones are added, and the record is written back in
the new layout. A cache that doesn't know about SHA3 can't be generated
at test time, because the current code always writes the new layout, so
one is checked into the repository (cachedb-sha2-cache.db, generated on
amd64).
The test failed on debci on s390x, Debian's only big-endian release
architecture. The generated Packages stanza had Size: 0, while every
other field was correct.
https://ci.debian.net/packages/a/apt/testing/s390x/76975166/
The problem isn't in the code !626 added, it is older. CacheDB::Finish()
in ftparchive/cachedb.cc writes the record's FileSize through htonl(),
which takes and returns a 32-bit value. That was correct while FileSize
was a uint32_t. 650faab01 changed it to a uint64_t and the htonl() call
was left as it was. Its 32-bit result is now stored into the 64-bit
field in the host's own byte order, so the size ends up in the first
four bytes of the field on little-endian hosts and in the last four on
big-endian ones, with the other four zero. A host whose byte order
differs from that of the host that wrote the cache reads the four zero
bytes instead, which is why a cache written on amd64 gives a size of 0
on s390x. The other fields are 32-bit integers or byte arrays and come
through fine. apt 3.3.3 gives the same Size: 0 when a cache written on
arm64 is read on s390x, and the reverse is also true.
Cache databases aren't moved between hosts of different byte order, so
this has gone unnoticed since 650faab01 in 2011, and this is the first
test to ship a cache with a 64-bit FileSize. As the case doesn't occur
in practice, skip the test on big-endian hosts.
commit 546e63582787c18eff77794217d28ac303fc286a
Merge: 2c3f5776 de45f31c
Author: Julian Andres Klode <jak@debian.org>
Date: Tue Oct 20 09:46:19 2026 +0000
Merge branch 'udev-mains' into 'main'
debian: Match AC adapters by type, not by name
See merge request apt-team/apt!630
commit de45f31c82e15fadda4043f82969712a493f3ea9
Author: Johan Walles <johan.walles@gmail.com>
Date: Tue Oct 20 07:01:10 2026 +0200
debian: Match AC adapters by type, not by name
The power supply name comes from the ACPI firmware, so KERNEL=="AC"
misses adapters named for example ADP1 (MacBookPro16,1), ACAD or ADP0,
and the rule never fires there. Match on ATTR{type}=="Mains" instead.
Tested on a MacBookPro16,1 with the charger plugged in:
"udevadm test --action=change /sys/class/power_supply/ADP1" sets
SYSTEMD_WANTS=apt-daily.service with the new rule, and nothing with
the old one.
Related: https://launchpad.net/bugs/2089151
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![[bug history graph]](https://qa.debian.org/data/bts/graphs/a/apt.png){kind=link}