The release of the APT package management tool 2.9.20 (Advanced Package Tool) has been published. The 2.9.x branch is experimental and is used for developing features for the future stable version APT 3.0, which, after stabilization, will be integrated into Debian Testing and included in the next significant release of Debian, and will also be added to the package repository of Ubuntu. <\/p>\n
Changes since the last announcement: <\/p>\n
\n
APT 2.9.16: A regression was fixed that occurred after changes to key storage handling methods in version 2.9.15, which caused dissatisfaction among dpkg maintainers due to issues with some repositories.\n
APT 2.9.17:\n
\n
An abstract interface for handling hashes has been introduced, implemented as part of work to eliminate hard binding to a single cryptographic library.\n
Fixed an issue in the version comparison algorithm that occurred when using the option \u2018--no-strict-pinning\u2019.\n
Diagnostic message output now considers the debug level.\n
References to the apt-key utility have been cleaned up.\n
A guide for secure source configuration has been added to the man page for apt-secure. <\/p>\n
In gpgv, a merge of all keyrings is now returned during operation. Since the file with shared keyring is placed in a tmpfs file system, the content of which may be swapped to the swap space, this approach can lead to increased wear on SSDs based on Flash memory. The author of the news recommends using an anonymous channel (fifo), the remote end of which can be passed to another process as the file \u2018\/proc\/\/fd\/\u2019, or as a memory page accessible in a similar way as a file.\n
A small refactoring has been done: a separate function for checking file signatures has been created. <\/ul>\n
APT 2.9.18:\n
\n
Automatic pagination has been implemented for the output of the commands \u2018show\u2019, \u2018policy\u2019, \u2018list\u2019, \u2018search\u2019, and \u2018showsrc\u2019, working in a git-like style and enabled through the configuration Binary::apt::Pager. The application for pagination is determined via the environment variable PAGER.\n
The output of the command \u2018apt show --full\u2019 now includes information about package pinning obtained from the fields APT-Pin, APT-Candidate, and APT-Release.\n
A vulnerability has been fixed that caused the \u2018apt show\u2019 command to read from memory outside of the allocated buffer. <\/ul>\n
APT 2.9.19:\n
\n
A crypto backend for the OpenSSL library has been added, which replaces GnuTLS and Gcrypt.\n
The ability to use the sqv utility from the Sequoia project for verifying digital signatures instead of calling gpgv has been added. In the wrapper code over sqv, the questionable use of temporary files continues when working with keys.\n
The use of self-signed signatures based on the SHA-1 algorithm is permitted until 2026. <\/ul>\n
APT 2.9.20: An official recommendation has been added to name files in \/etc\/apt\/sources.list.d\/ as \u2018$(dpkg-vendor --query Vendor | tr A-Z a-z).sources\u2019 \u2014 the current vendor name in lowercase. <\/ul>\n