Aptly 1.6.3 Release Preparation Update

[neolynx]

Aptly 1.6.3 Release Preparation Update

Dear Aptly community,

We're excited to announce that Aptly 1.6.3 is in preparation and will be released soon! Here's an overview of what's coming.

🆕 New Features

This release brings several exciting new capabilities:

• AppStream (DEP-11) mirror support (#1543)
  Support AppStream metadata through mirrors, snapshots, and publish endpoints.
• Multiple GPG keys support (#1479)
  Supports multiple signing keys via CLI and REST API.
• GPG key list & delete API (#1558)
  New API endpoints to list and delete GPG keys.
• Edit mirror API endpoint (#1535)
  New REST API endpoint to edit mirror configuration.
• NumPackages in list responses (#1559)
  Mirrors, repos, and snapshots list API responses now include a NumPackages field.
• Mirror latest packages (#1513)
  Allow mirroring only latest package versions.
• Reproducible builds / SOURCE_DATE_EPOCH support (#1537, #1542)
  GPG signers now respect SOURCE_DATE_EPOCH for reproducible publish timestamps.
• Release file Version field support (#1533)
  Parses and exposes the Version field from Debian Release files.
• InRelease file Signed-By field support (#1518, #1519)
  Honor the Signed-By field in InRelease files.
• GCP / Google Artifact Registry authentication (#1505)
  Support for mirroring from Google Artifact Registry using the ar+https:// scheme with GCP auth.
• Update publish label & origin (#1484)
  Support updating the Label and Origin fields.
• Ubuntu 26.04 / resolute builds (#1571)
  CI pipeline for buildingUbuntu 26.04.

🐛 Bug Fixes

Numerous bugs have been resolved, including:

• Fix crash in aptly db recover (#1565)
• Fix deadlocks in task list (#1529)
• Fix S3 re-upload issue (#1480)
• Fix aptly repo edit API (#1493)
• Fix out-of-disk-space error handling (#1504)
• Fix aptly mirror update removing unrelated params (#1466)
• Fix concurrent pool linking race condition (#1481)
• Fix dpkg-compliant version comparison (#1509)
• Fix Swagger property casing and spec errors (#1510, #1498)
• Remove useless nil check (#1482)
• Format Go code with gofmt (#1483)

🧪 CI & Test Improvements

• Various fixes for system-test and docker integration (#1492)
• Fix errors and coverage (#1531, #1552)
• Remove Launchpad test dependency (#1568)

📝 Documentation

• Update docs (#1472, #1524, #1561, #1567)

🔧 Dependency Updates

Key dependency upgrades for security and compatibility:

• golang.org/x/crypto → v0.45.0 (#1506)
• google.golang.org/grpc → v1.79.3 (#1546)
• github.com/aws/aws-sdk-go-v2/service/s3 → v1.97.3 (#1554)
• github.com/cloudflare/circl → v1.6.3 (#1461, #1541)
• requests (Python, system tests) → 2.33.0 (#1460, #1547)
• github.com/ProtonMail/go-crypto → v1.4.0
• golang.org/x/net → v0.48.0

🚧 Work in Progress

• Race condition & concurrency fixes for the REST API ([#1574, #1511)
  A comprehensive audit of the async task system is underway, addressing potential data corruption and stale reads under concurrent API usage.
• Google Cloud Storage (GCS) support (#1550)
  Adding GCS as a storage backend for publishing (brings in new dependencies).
• JFrog Artifactory support (#1553)
  Adding JFrog Artifactory as a storage backend (brings in new dependencies).
• Add API endpoint suitable for dput (#1436)
  Support dput-ng package uploads

Once those are in, we are ready for 1.6.3 !

In the meantime, feel free to test the pre-releases available in the CI builds and provide feedback!

🗃 Testing the upcoming release

To try the latest development versions built on master, use the following APT source to install Aptly CI builds:

deb [signed-by=/etc/apt/keyrings/aptly.asc] http://repo.aptly.info/ci DIST main

where DIST may be one of: bullseye, bookworm, trixie, focal, jammy, noble, resolute

Repo Key

The repo key can be obtained as follows:

sudo wget http://repo.aptly.info/pubkey.txt -O /etc/apt/keyrings/aptly.asc

Or download a binary from a latest master pipeline.

🙏 Special Thanks!

Thank you to all the contributors through code, bug reports, testing, and documentation improvements!

If you're able, you can support Aptly through GitHub Sponsorships to help cover maintenance and hosting costs.

[neolynx]

Aptly 1.6.3 Release Preparation — Update 2

Dear Aptly community,

Here's a progress update on what has landed in master since the last update.

✅ Features

• Google Cloud Storage (GCS) publish backend (#1550)
  GCS is now a fully supported storage backend for publish endpoints, with config, API, documentation, and an integration test suite using fake-gcs-server.
• dput-compatible file upload API (#1436)
  New PUT /api/files/:dir/:file endpoint allowing dput/dput-ng to push packages directly to Aptly, with path-traversal validation, proper io.Copy streaming, and ENOSPC surface handling.
• JFrog Artifactory publish backend (#1553)
  JFrog Artifactory is now supported as a publish storage backend. Authentication can be configured via YAML config or via environment variable.

🐛 Bug Fixes

• Race condition & concurrency fixes for the REST API (#1574)
  Properly lock: publish, repos, snapshots, mirrors, and tasks. Also support enabling/disabling multi-distribution publishing on existing endpoints.
• Fix empty line in Package-List for source packages (#1588)
  Source package .dsc files with an empty Package-List field no longer produce a spurious blank line, fixing compatibility with strict parsers.
• Publish: check storage exists before publishing (#1587)
  Check if storage backend exists or providing an error message of crashing.
• S3 publish race condition (#1594)
  Make sure pathCache is properly locked for concurrent access.
• Repo edit name optionally (#1593)
  Make Repo Edit parameter Name optional.

🔧 Dependency Updates

• go.opentelemetry.io/otel → v1.41.0 (#1586)
• go.opentelemetry.io/otel/sdk → v1.43.0 (#1584)
• github.com/go-jose/go-jose/v4 → v4.1.4 (#1585)
• github.com/go-git/go-git/v5 → v5.19.1 (#1590)
• github.com/ulikunitz/xz → v0.5.15 (fixes 32-bit build failures)
• Go toolchain → 1.25.0

🗃 CI Builds APT Repository

To try the latest development version built on master, use the following APT source to install Aptly CI builds:

deb [signed-by=/etc/apt/keyrings/aptly.asc] http://repo.aptly.info/ci DIST main

where DIST may be one of: bullseye, bookworm, trixie, focal, jammy, noble, resolute

Repo Key

The repo key can be obtained as follows:

sudo wget http://repo.aptly.info/pubkey.txt -O /etc/apt/keyrings/aptly.asc

Or download a binary from a latest master pipeline.

🙏 Special Thanks!

Thank you to all the contributors who helped bring these features and fixes across the line: @benallard, @cchazalet, @lesaux, @linuxdataflow, and everyone who tested and provided feedback!

If you're able, you can support Aptly through GitHub Sponsorships to help cover maintenance and hosting costs.

📅 Next Steps

With all previously-listed work-in-progress items now merged, we are very close to cutting the 1.6.3 release. Final testing and polish are underway — stay tuned!