The release of the APT package management tool 2.9.20 (Advanced Package Tool) has been published. The 2.9.x branch is experimental and is used for developing features for the future stable version APT 3.0, which, after stabilization, will be integrated into Debian Testing and included in the next significant release of Debian, and will also be added to the package repository of Ubuntu.
Changes since the last announcement:
- APT 2.9.16: A regression was fixed that occurred after changes to key storage handling methods in version 2.9.15, which caused dissatisfaction among dpkg maintainers due to issues with some repositories.
- APT 2.9.17:
- An abstract interface for handling hashes has been introduced, implemented as part of work to eliminate hard binding to a single cryptographic library.
- A problem in the version comparison algorithm has been fixed, which manifested when using the '--no-strict-pinning' option.
- Diagnostic message output now considers the debug level.
- References to the apt-key utility have been cleaned up.
A guide for secure source configuration has been added to the man page for apt-secure.
- The gpgv utility has returned to merging all keyring storage during operation. Since the file with a shared keyring is located in a tmpfs filesystem, the contents of which can be swapped to disk, this approach may lead to increased wear on flash-based SSDs. The author of the news recommends using an anonymous channel (fifo), the remote end of which can be passed to another process as a file '/proc//fd/' or as a memory page available similarly as a file.
- A small refactoring has been done: a separate function for checking file signatures has been created.
- APT 2.9.18:
- Automatic pagination for the output of the 'show', 'policy', 'list', 'search', and 'showsrc' commands has been implemented, working in a git-like style and enabled through the Binary::apt::Pager setting. The pager application is determined by the PAGER environment variable.
- The output of the command "apt show --full" has been updated to include information on package pinning, obtained from the APT-Pin, APT-Candidate, and APT-Release fields.
- A vulnerability that led to reading out of bounds memory when the 'apt show' command was called has been fixed.
- APT 2.9.19:
- A crypto backend for the OpenSSL library has been added, which replaces GnuTLS and Gcrypt.
- The ability to use the sqv utility from the Sequoia project for verifying digital signatures instead of calling gpgv has been added. In the wrapper code over sqv, the questionable use of temporary files continues when working with keys.
- The use of self-signed signatures based on the SHA-1 algorithm is permitted until 2026.
- APT 2.9.20: An official recommendation has been added to name files in /etc/apt/sources.list.d/ as "$(dpkg-vendor --query Vendor | tr A-Z a-z).sources" — using the current vendor's name in lowercase.
Source: opennet.ru
