apt/debian/control, branch main

Require sqv for builds on supported archs and !pkg.apt.nosqv

2026-05-01T16:37:50Z

This forces dependency solvers to install sqv, avoiding builds with gpgv instead (which we did intentionally before to hack Ubuntu buildd setup).

sqv: Warn about signatures that will be rejected by policy within a year

2025-04-25T21:07:07Z

This implements a simple check where we first run `sqv` with `--policy-as-of` 1 year in the future. If the file is validly signed one year in the future, it is validly signed now. If the file is not validly signed 1 year in the future, we check if it is validly signed now, and otherwise print an error message. The --policy-as-of feature was added in sqv 1.3.0, hence we add a version requirement to the dependency.

Bump ABI to 7.0

2025-02-14T18:45:12Z

Remove leftovers from ftp and rsh/ssh methods removal

2025-01-05T22:16:09Z

References: fd3684cdbc165ceaa635ed19fcbd231f509b0179

Move apt-extractexamples desc line from apt-utils to apt

2025-01-05T22:16:09Z

References: f4e0e9daf221e840e122b0ffa97007aa512020a6 Closes: #1091344

Remove leftovers of the apt-key removal

2025-01-05T22:16:09Z

References: a00fbbdb28cc31e78882301c2efe7218583ab4cb

debian: Plug sqv into the package build

2024-12-22T22:52:05Z

Our goal is for each platform to have one blessed OpenPGP verification system: Platforms that support sqv get sqv, platforms that don't get gpgv. To do so we hardcode the architecture list at build time. At build time we check if /usr/bin/sqv exists, which is the condition that apt uses to see if it should build with sqv support. We use a slight hack here to build with sqv on the official Debian buildds but use gpgv on Ubuntu by abusing the fact that Ubuntu resolves alternative build dependencies, and gpgv is installed in the buildd image.

hashes, methods: Add OpenSSL backends

2024-12-22T21:55:39Z

Introduce an OpenSSL::Crypto backend for the hashes library and an OpenSSL::SSL backend for the TLS support in our https method. Many thanks to curl for showing the way with how to handle a CRL file. There are some memory leaks here with the TlsFd itself as well as the proxy support; and we should reorganize the code to generate the ssl object as late as possible. A peculiar aspect of OpenSSL is that SSL_has_pending() returns 1 even if SSL_read() will fail to read anything and return the equivalent of EAGAIN. We work around this here by also peeking ahead 1 byte. I was running a very high RTT connection from Germany to Australia for testing, and with the peeking it's using negligible amounts of CPU; before that, it was busy looping at 100%. Bad OpenSSL!

Add an artificial Conflicts: against libnettle8

2024-03-22T10:10:24Z

to force upgrades in launchpad buildd chroots Gbp-Dch: full

Do not require versioned dpkg-dev on CI

2024-02-28T17:32:32Z

Annotate the Build-Depends with a profile and use that in prepare-release when doing build-dep.