A release of the APT 3.0.0 (Advanced Package Tool) management tool has been formed, incorporating changes accumulated in the experimental branch 2.9. The new release is accepted into the Debian Unstable branch and will soon be integrated into the Debian Testing repository, which is developing the Debian 13 release and already uses the experimental APT 2.9 branch, and will also be added to the package base of Ubuntu.
Among the most important changes:
- The user interface has been revamped to provide a clearer display of the list of dependencies required for download during package installation. Previously, package names with dependencies were displayed as a continuous list, but now they are split into columns in the style of the 'ls -C' utility, with different output blocks highlighted in their own colors (for example, removable packages are highlighted in red, while installable ones are in green). Duplicate mentions of additional and new packages have been removed from the output (the 'NEW packages' and 'additional packages' sections have been merged). For managing colors, settings 'APT::Color::*' and 'APT::Configuration::color' have been added, along with options '--color' and '--no-color'.
- Automatic pagination has been implemented for the output of the 'show', 'policy', 'list', 'search', and 'showsrc' commands. Pagination is enabled via the Binary::apt::Pager setting, and the application for pagination is defined through the PAGER environment variable.
- An improved dependency resolution engine Solver3 has been implemented (enabled through the '--solver 3.0' option), in which a backtracking algorithm is used to resolve conflicts between dependencies. The new engine also enhances version selection, supports multi-stage updates, significantly increases performance (apt-test now runs twice as fast), adds the '--no-strict-pinning' option for installing experimental versions, adds protection against manually removed packages, and increases the aggressiveness of automatic removal of unused dependencies. More user-friendly explanations for dependency-related errors have been added.
- The use of the apt-key utility for managing keys used to verify digital signatures of packages has been discontinued. The apt-key utility was declared deprecated several years ago due to the transition away from the old model of package integrity verification, which utilized a shared keyring (/etc/apt/trusted.gpg) and lacked key binding to repositories; that is, a key added for a third-party repository could be used to verify packages in all repositories. The method replacing apt-key involves separating keyrings for each repository (/etc/apt/trusted.gpg.d/ or /etc/apt/keyrings/).
- The ability to use the sqv utility from the Sequoia project for verifying digital signatures instead of calling gpgv has been added. The Rust-written gpg-sq utility, which takes the same arguments as the gpg utility but mimics its functionality through Sequoia, an OpenPGP implementation in Rust, has been added to the list of paths for calling gpg. Calling gpg-sq takes precedence over gpg, meaning that to use gpg-sq instead of gpg, you only need to install the appropriate package.
- A crypto backend for the OpenSSL library has been added, which replaces GnuTLS and Gcrypt.
- Key types have been bound to file extensions: the '.asc' extension is associated with ASCII-armored keys, '.gpg' is always associated with binary keys, and any other file extensions will result in an error. For example, if you are using a key file '/etc/apt/keyrings/winehq-archive.key', it needs to be renamed to '/etc/apt/keyrings/winehq-archive.gpg', and the path in the file must be corrected in '/etc/apt/sources.list.d/'. Support for self-verification of keyrings and performing the dearmor operation (converting ASCII-armored keys to binary format) without accessing apt-key has been implemented.
- Many functions have been transitioned to use the 'std::string' class instead of 'const char *' (the std::string_view class defined in the C++17 standard, which works more efficiently with strings by using references to existing data and avoiding unnecessary data copying until it is actually utilized in the code).
- An abstract interface for working with hashes has been proposed, implemented as part of the work to eliminate the hard binding to a single cryptographic library.
- The output of the command "apt show --full" has been updated to include information on package pinning, obtained from the APT-Pin, APT-Candidate, and APT-Release fields.
- It is officially recommended to name files in the directory /etc/apt/sources.list.d/ using the current vendor's name in lowercase ("$(dpkg-vendor --query Vendor | tr A-Z a-z).sources").
- Support for transactions and update counters has been added to pkgDepCache.
- A "--comment" option has been added to leave a comment that is saved in the history of executed operations.
- Support for the HTTP header Retry-After has been added to optimize the resumption of interrupted downloads.
- A "--target-release" option has been added to the "apt list" command.
- A new error level "audit" has been added, enabled through the "--audit" option.
Additionally, it is worth noting the changes that appeared in the experimental branch of APT 2.7 (the development of branch 2.7 has smoothly transitioned into the development of branch 2.9), which will be available in Debian 13 (Debian 12 uses the APT 2.6 release):
- Support for snapshots has been implemented, managed by the "--snapshot" ("-S") option, which allows you to access repository servers that support snapshots and select a specific state of the repository archive. For example, specifying "--snapshot 20250405T081400Z" allows you to work with a snapshot of the repository's state recorded on April 5, 2025, at 08:14:00. Snapshots are configured in the APT::Snapshot section of the sources-list files.
- The "--update" ("-U") option has been implemented, allowing the "apt update" operation to automatically run during package installation or upgrade commands (apt install or apt upgrade) to synchronize indices before opening the cache and processing sources.list.
- A 'dist-clean' command has been added for removing cached packages and lists of downloaded packages.
Source: opennet.ru
