summaryrefslogtreecommitdiff
path: root/debian/NEWS
Commit message (Collapse)AuthorAgeFilesLines
* Improve documentation for apt --cli-versionJulian Andres Klode2025-11-101-12/+4
| | | | Document options inside apt(8)
* Enable the new solver by default in 0.31, 1.21, 2.11, 3.1Julian Andres Klode2025-10-251-0/+2
| | | | | Enable the new solver by default and remove the vendor-specific configuration change in Ubuntu's drop-in.
* Record varying defaults based on cli-version, rather than binaryJulian Andres Klode2025-10-251-0/+17
| | | | | | The --cli-version argument can be used to request a specific CLI version. The default CLI version is the APT version for apt(8) and 0 for the other apt-get tools.
* debian/NEWS: Document new requirements on trusted.gpg.dJulian Andres Klode2025-04-291-0/+6
| | | | | | | | | | | | | | | | | | | | | | | All files in apt directories must follow the run-parts requirements, the only allowed characters are: a-z, A-Z, 0-9, _, -, : and '.' if an extension is required, due to the use of the general GetFilesInDirectory() function. Other characters were previously supported as the directory was not enumerated by apt, but by apt-key, an 850ish line shell script using find "$TRUSTEDPARTS" -mindepth 1 -maxdepth 1 \( -name '*.gpg' -o -name '*.asc' \) which obviously does not share the same requirements. Document the difference in debian/NEWS, as it seems ill-advised to introduce a flag-carrying version of GetFilesInDirectory() for the sole purpose of a deprecated signing mechanism. Closes: #1104320
* apt-secure manual page is in manual section 8Andreas Rönnquist2025-01-281-1/+1
|
* Release 2.9.242.9.24Julian Andres Klode2025-01-211-0/+12
|
* Release 2.9.192.9.19Julian Andres Klode2024-12-231-0/+19
|
* Release 2.9.152.9.15Julian Andres Klode2024-11-281-0/+7
|
* Apply messaging fixes from Robert KrátkýJulian Andres Klode2024-11-071-4/+4
|
* Remove ftp, rsh, ssh methods (disabled since 1.8)Julian Andres Klode2024-11-071-0/+12
| | | | | | | | | These methods have been unsupported and disabled since 1.8, remove them for the 3.0 cleanup. Please migrate to http instead. If you need ad-hoc access to a remote repository, you can run `python3 -m http.server` on that machine and use SSH port forwarding to run http over ssh.
* Add apt-patterns(7) to apt{,-cache,-get} SEE ALSO sectionsDavid Kalnischkies2023-07-261-1/+1
| | | | | | | While we are at it fix the mislabeling as (5) in some places and unfuzzy the translations. Reported-By: Enrico Zini on IRC
* Release 2.5.22.5.2Julian Andres Klode2022-07-241-1/+1
|
* Add NEWS entryJulian Andres Klode2022-07-241-0/+8
|
* Release 2.4.02.4.0Julian Andres Klode2022-02-221-2/+2
|
* Warn if the legacy trusted.gpg keyring is used for verificationJulian Andres Klode2022-02-221-0/+8
| | | | | With apt-key going away, people need to manage key files, rather than keys, so they need to know if any keys are in the legacy keyring.
* Release 2.3.12Julian Andres Klode2021-11-171-0/+15
|
* Release 2.1.16 - "Happy build-essential freeeze" release2.1.16Julian Andres Klode2021-01-081-4/+5
|
* Add support for Phased-Update-PercentageJulian Andres Klode2021-01-081-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | This adds support for Phased-Update-Percentage by pinning upgrades that are not to be installed down to 1. The output of policy has been changed to add the level of phasing, and documentation has been improved to document how phased updates work. The patch detects if it is running in a chroot, and if so, always includes phased updates, restoring classic apt behavior to avoid behavioral changes on buildd chroots. Various options are added to control this all: * APT::Get::{Always,Never}-Include-Phased-Updates and their legacy update-manager equivalents to always or never include phased updates * APT::Machine-ID can be set to a UUID string to have all machines in a fleet phase the same * Dir::Etc::Machine-ID is weird in that it's default is sort of like ../machine-id, but not really, as ../machine-id would look up $PWD/../machine-id and not relative to Dir::Etc; but it allows you to override the path to machine-id (as opposed to the value) * Dir::Bin::ischroot is the path to the ischroot(1) binary which is used to detect whether we are running in a chroot.
* Automatically remove unused kernels on dist-upgradeJulian Andres Klode2021-01-041-0/+7
| | | | | Kernels clutter /boot and /boot is small size, so we need to take extra care to remove kernels when possible.
* Release 1.9.111.9.11Julian Andres Klode2020-02-261-1/+1
|
* apt(8): Wait for frontend and cache lockJulian Andres Klode2020-02-261-0/+7
| | | | | | This is a rework of !6 with additional stuff for the frontend lock, so we can lock the frontend lock and then keep looping over dpkg lock.
* Release 1.9.61.9.6Julian Andres Klode2020-01-151-2/+2
|
* apt(8): Disable regular expressions and fnmatchJulian Andres Klode2020-01-151-0/+13
| | | | | This is the first step. Next step will be to add warnings to apt-get and then remove support there as well.
* Release 1.9.51.9.5Julian Andres Klode2019-12-021-1/+1
|
* netrc: Restrict auth.conf entries to https by defaultJulian Andres Klode2019-12-021-0/+10
| | | | | | | | | | | | This avoids downgrade attacks where an attacker could inject Location: http://private.example/ and then (having access to raw data to private.example, for example, by opening a port there, or sniffing network traffic) read the credentials for the private repository. Closes: #945911
* Flip /: in documented default value of DPkg::PathAlwin Henseler2019-04-051-1/+1
| | | | | | | The value as shown in the NEWS file (not in the code) has a typo in which just a "/" and ":" are swapped. Closes: #917986
* Release 1.8.0~alpha31.8.0_alpha3Julian Andres Klode2018-12-181-2/+4
|
* Set PATH=/usr/sbin:/usr/bin:/sbin:/bin when running dpkgJulian Andres Klode2018-12-101-0/+8
| | | | | | | | | This avoids a lot of problems from local installations of scripting languages and other stuff in /usr/local for which maintainer scripts are not prepared. [v3: Inherit PATH during tests, check overrides work] [v2: Add testing]
* Add verb 'be' to NEWS entry for 1.5~beta1annadane2018-05-181-1/+1
| | | | Closes: 892792
* Fix various typos reported by spellcheckersDavid Kalnischkies2018-05-051-1/+1
| | | | | Reported-By: codespell & spellintian Gbp-Dch: Ignore
* Release 1.6~rc11.6_rc1Julian Andres Klode2018-04-151-1/+1
|
* Turn off seccomp sandboxing by defaultJulian Andres Klode2018-04-061-0/+8
| | | | | | LP: #1732030 Closes: #890489 Fixes meefik/linuxdeploy#869
* Fix debian/NEWS entry for 1.6~beta1Julian Andres Klode2018-03-131-2/+2
|
* Check that Date of Release file is not in the futureJulian Andres Klode2018-02-191-0/+16
| | | | | | | | | | | | | By restricting the Date field to be in the past, an attacker cannot just create a repository from the future that would be accepted as a valid update for a repository. This check can be disabled by Acquire::Check-Date set to false. This will also disable Check-Valid-Until and any future date related checking, if any - the option means: "my computers date cannot be trusted." Modify the tests to allow repositories to be up to 10 hours in the future, so we can keep using hours there to simulate time changes.
* Release 1.6~alpha11.6_alpha1Julian Andres Klode2017-10-231-2/+4
|
* Sandbox methods with seccomp-BPF; except cdrom, gpgv, rshJulian Andres Klode2017-10-221-0/+13
| | | | | | | | | | | | This reduces the number of syscalls to about 140 from about 350 or so, significantly reducing security risks. Also change prepare-release to ignore the architecture lists in the build dependencies when generating the build-depends package for travis. We might want to clean up things a bit more and/or move it somewhere else.
* Release 1.5~beta11.5_beta1Julian Andres Klode2017-07-031-22/+11
|
* Upload 1.5~alpha4 to experimental1.5_alpha4Julian Andres Klode2017-06-301-3/+6
|
* Switch to 'http' as the default https methodJulian Andres Klode2017-06-301-0/+9
| | | | | The old curl based method is still available as 'curl', 'curl+http', and 'curl+https'.
* Upload 1.5~alpha1 to experimental1.5_alpha1Julian Andres Klode2017-06-281-2/+17
|
* fail instead of warn on insecure repositories in apt-getDavid Kalnischkies2017-06-281-0/+14
| | | | | | | | | The exception was made to give (script) users a one-release grace period to adapt their setup to deal with apt enforcing signing of repositories. As we are now at the start of a new release cycle its as good a time as any to lift it now. Removes-Exception: 952ee63b0af14a534c0aca00c11d1a99be6b22b2
* Release 1.4.31.4.3Julian Andres Klode2017-05-111-6/+5
|
* Release 1.4.21.4.2Julian Andres Klode2017-05-041-0/+11
|
* Release 1.4~beta11.4_beta1Julian Andres Klode2016-11-251-1/+1
|
* gpgv: Untrust SHA1, RIPE-MD/160, but allow downgrading to weakJulian Andres Klode2016-11-251-0/+18
| | | | | | | Change the trust level check to allow downgrading an Untrusted option to weak (APT::Hashes::SHA1::Weak "yes";), so it prints a warning instead of an error; and change the default values for SHA1 and RIPE-MD/160 from Weak to Untrusted.
* debian/NEWS: Get rid of 1.3~pre3+cmake1 entryJulian Andres Klode2016-08-111-14/+0
| | | | | | This was only needed temporarily Thanks: Axel Beckert for reporting
* releasing package apt version 1.3~pre3+cmake11.3_pre3+cmake1Julian Andres Klode2016-08-061-0/+14
|
* NEWS: Prefix the keep deb option with Binary::apt::Julian Andres Klode2016-02-041-3/+4
| | | | | | | I find the per-binary overrides a bit confusing in their current form, but let's tell the user the truth. Closes: #812111
* NEWS: Refer to apt(8) instead of apt(1)Julian Andres Klode2016-01-091-1/+1
| | | | | Reported-By: Mattia Rizzolo (on IRC) Gbp-Dch: ignore
* Release 1.2~exp11.2_exp1Julian Andres Klode2016-01-081-1/+1
|
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2026-10-18 14:11:45 +0000