vcswatch reports that
this package seems to have new commits in its VCS but has
not yet updated debian/changelog. You should consider updating
the Debian changelog and uploading this new version into the archive.
Here are the relevant commit logs:
commit 745fc126218c7cb3df48b22bbc7c7098fa2f7966
Merge: 95a76da7 a5e70a26
Author: Julian Andres Klode <jak@debian.org>
Date: Mon Oct 12 14:20:09 2026 +0000
Merge branch 'sha3-support' into 'main'
Add SHA3-256 and SHA3-512 support
See merge request apt-team/apt!626
commit a5e70a26c10cc48173ccf9a1da790b09a72ea81a
Author: Gianpiero Carpinelli <gianpiero.carpinelli@canonical.com>
Date: Mon Sep 28 12:30:16 2026 +0100
Test apt against repositories that publish SHA3
Build a real package, publish it with apt-ftparchive using only
SHA3-256 and then only SHA3-512, and run the client against it over
http. In each case apt update accepts the repository without a weak
security warning, and show, install, download and source all work.
A corrupted package or index file fails with a hash mismatch, and
marking the SHA3 type untrusted makes apt reject the repository.
With by-hash enabled, apt fetches from the SHA3 directory when that
is the only hash offered and also when SHA256 is offered next to it.
If such an archive has no SHA3 by-hash files, the update still
succeeds by fetching the plain path.
Finally, with both families published, corrupt only the SHA3-256
digests in Release. The update must fail although every SHA256
digest still matches.
commit 66bc6301d7ff5980568e421d81adebd7a20ca1fc
Author: Gianpiero Carpinelli <gianpiero.carpinelli@canonical.com>
Date: Mon Sep 28 12:01:15 2026 +0100
Write SHA3 checksums into Sources
The Sources writer copies each Checksums block from the .dsc, adds a
line for the .dsc itself, and computes blocks for algorithms the .dsc
lacks. Add SHA3-256 and SHA3-512 to each of those paths, so with SHA3
enabled a source package gets SHA3 checksums whether or not dpkg
wrote them, and so disabling either algorithm removes its block as
for the others. With SHA3 left off, which is the default, the blocks
are dropped even when the .dsc carries them.
Document the new checksum names in the apt-ftparchive manual page.
commit e0354c719925ed08683ce73dfbb80963ce28e1ee
Author: Gianpiero Carpinelli <gianpiero.carpinelli@canonical.com>
Date: Mon Sep 28 10:07:31 2026 +0100
Write SHA3 checksums into Packages via the cache
The Packages writer takes every digest from the cache database, so
SHA3 fields cannot appear in Packages until the cache record holds
them. Append the two digests to the on-disk record and recognise the
previous record size, migrating such records by copying their fields
and computing only the SHA3 digests, as was done when the file size
field grew to 64 bits.
The migration test starts from a cache written by the previous
record layout and checks that it is read, extended and rewritten.
The migration test skips on 32-bit hosts. The record struct holds a
uint64_t, which 64-bit ABIs align to 8 bytes, so the struct is padded
to 152 bytes there, while i386 aligns it to 4 and gets 148. The
checked-in cache holds 152-byte records.
commit 531ee101f4ee67a75fd60aebb5f6d8cca12b1102
Author: Gianpiero Carpinelli <gianpiero.carpinelli@canonical.com>
Date: Fri Sep 25 12:07:19 2026 +0100
Write SHA3 sections in Release files
apt-ftparchive gains the config switches and command-line options
for the two SHA3 algorithms added to the hash library, and its
Release writer prints a section for each one that is enabled.
Packages and Sources follow in later commits, as they depend on the
cache database record format.
Unlike the other hashes, SHA3 is off unless requested. Existing
users of apt-ftparchive see no change in their output and no extra
by-hash copies until they ask for it.
The option names are registered in configure-index so the
strict-config check used by the test suite accepts them, and the
new options and digests are documented in the manual page.
commit 8b4f0bbec353b39c8ad70ec72c1339afe0aa1e9d
Author: Gianpiero Carpinelli <gianpiero.carpinelli@canonical.com>
Date: Thu Sep 24 15:18:08 2026 +0100
Add SHA3-256 and SHA3-512 to the hash library
Archives that want to hedge against a SHA-2 break need clients that
already understand a different hash family. Update libapt-pkg to include
SHA3-256 and SHA3-512 so Release, Packages, and Sources entries using
them are parsed and verified, using the SHA3 digests OpenSSL provides
since 1.1.1.
The new types are first in the preference order. For archives that
publish both families, by-hash requests go to the SHA3 directory,
falling back to the plain path if it is missing.
The tagfile keys are appended after the ABI marker. The exported symbol
set of libapt-pkg is unchanged.
commit ab1b7a15398e99c718d767fb3ca440115db4dc94
Author: Gianpiero Carpinelli <gianpiero.carpinelli@canonical.com>
Date: Mon Sep 28 12:28:49 2026 +0100
Hand out only the requested hashes from the cache
CacheDB::GetHashes returned every digest its record held, whether or
not the writer had asked for it, so an algorithm disabled after it had
been cached kept appearing in Packages and Sources until the cache was
deleted. Check the requested set when building the list, as is already
done when deciding what to compute. The cache still keeps the digest,
so re-enabling the algorithm costs nothing.
Found while adding an end-to-end test for SHA3-only repositories.
commit cecfaf1e9273d4647ba56d52db205f57e081eae3
Author: Gianpiero Carpinelli <gianpiero.carpinelli@canonical.com>
Date: Mon Sep 28 12:22:36 2026 +0100
Fix Sources checksums when MD5 is disabled
When a .dsc lacks the checksum block for a requested algorithm, the
Sources writer computes one by hashing every file of the source
package. Previously it found those files by walking the Files field it
had just generated for MD5: the .dsc's own Files block with a line for
the .dsc itself prepended. With MD5 disabled that generated field is
empty, so the walk visited nothing, no missing block was ever computed,
and an archive publishing only SHA-2 or SHA-3 hashes ended up with a
Sources file against which apt-get source could verify nothing.
This commit changes the walk to build its own list, the .dsc itself
followed by the .dsc's Files block read straight from the parsed .dsc,
independent of which hashes are requested. Only the file names are
used, so the list carries a placeholder in the digest column.
Found while adding an end-to-end test for SHA3-only repositories.
commit 95a76da70011d9bfeb88e94676fd2483110f95f6
Merge: 98170694 4c4b59d5
Author: Julian Andres Klode <jak@debian.org>
Date: Thu Sep 24 13:41:59 2026 +0000
Merge branch 'named-option-groups' into 'main'
cmdline: name option groups in help output
See merge request apt-team/apt!623
commit 4c4b59d5061c93d39c6979875767878ee10156a1
Author: Zara Grigoryan <zara.grigoryan@canonical.com>
Date: Wed Sep 23 15:09:56 2026 +0000
cmdline: name option groups in help output
Preserve declarative option groups when rendering help and add translated section headings. Keep parser argument ordering and completion behaviour unchanged. Update help tests for named sections.
commit 981706948a59a239c0616c83d81d9661fc6a6f3b
Merge: 4bd592d7 ac676d8e
Author: Julian Andres Klode <jak@debian.org>
Date: Mon Aug 31 08:52:21 2026 +0000
Merge branch 'main' into 'main'
Updated Irish translation based on Release 3.3.3
See merge request apt-team/apt!617
commit ac676d8e8adce150ea0afb2b97d62e6afea84e57
Author: Aindriú Mac Giolla Eoin <aindriu80@gmail.com>
Date: Sun Aug 23 14:19:17 2026 +0100
Updated Irish translation based on Release 3.3.3
commit 4bd592d724a5b4db612557ff10eddc537991fb95
Merge: 1fcc31c0 7df2547f
Author: Julian Andres Klode <jak@debian.org>
Date: Mon Aug 31 08:52:07 2026 +0000
Merge branch 'bash-completions-from-parser' into 'main'
apt: Generate bash completions from declarative parser
See merge request apt-team/apt!613
commit 7df2547f49a51ba2a51920907db2409b16835432
Author: Zara Grigoryan <zara.grigoryan@canonical.com>
Date: Wed Aug 19 07:21:07 2026 +0000
apt: Generate bash completions from declarative parser
commit 1fcc31c09480126ec1195177e919f9d4eb1396b7
Merge: d8f548e0 732b6207
Author: Julian Andres Klode <jak@debian.org>
Date: Tue Aug 25 10:20:17 2026 +0000
Merge branch 'security-md' into 'main'
Add a SECURITY.md
See merge request apt-team/apt!616
commit 732b62072a6e92e13168dc2d2ddc120c70aef673
Author: Julian Andres Klode <jak@debian.org>
Date: Fri Aug 21 22:42:28 2026 +0200
Add a SECURITY.md
commit d8f548e00ca4d16829de13a62fa8fafa9d5cd97b
Merge: d0598642 13dac318
Author: Julian Andres Klode <jak@debian.org>
Date: Mon Aug 17 12:38:27 2026 +0000
Merge branch 'cmdline-add-remaining-help' into 'main'
cmdline: add help for remaining apt commands
See merge request apt-team/apt!611
commit 13dac3188143a5a9a0ba55908de5d3cf766c7c8f
Author: Zara Grigoryan <zara.grigoryan@canonical.com>
Date: Fri Aug 14 05:14:17 2026 +0000
cmdline: add help for remaining apt commands
Add concise usage and description text for history and compatibility commands that previously showed only declarative option help.
Reuse canonical cleanup help for legacy aliases and extend integration coverage for the new prose, aliases, and inherited options.
commit d059864253d7a77fe4378700aa72fec146aa5dff
Author: Américo Monteiro <a_monteiro@gmx.com>
Date: Mon Aug 17 11:07:54 2026 +0000
Portuguese manpages translation update
Closes: #1144491