diff --git a/AUTHORS b/AUTHORS
index 69d479c3..d62f1573 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -67,4 +67,4 @@ List of contributors, in chronological order:
 * Christoph Fiehe (https://github.com/cfiehe)
 * Blake Kostner (https://github.com/btkostner)
 * Leigh London (https://github.com/leighlondon)
-* Gordian Schönherr (https://github.com/schoenherrg)
+* Gordian Schoenherr (https://github.com/schoenherrg)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 780dbf5d..762cf8a4 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -91,6 +91,12 @@ Install the following on your development machine:
 - make
 - git
 
+##### Docker installation on macOS
+1. Install [Docker Desktop on Mac](https://docs.docker.com/desktop/setup/install/mac-install/) (or via [Homebrew](https://brew.sh/))
+2. Allow directory sharing
+   - Open Docker Desktop
+   - Go to `Settings → Resources → File Sharing → Virtual File Shares`
+   - Add the aptly git repository path to the shared list (eg. /home/Users/john/aptly)
 
 #### Create docker container
 
diff --git a/Makefile b/Makefile
index 1794a6b2..d6a81da4 100644
--- a/Makefile
+++ b/Makefile
@@ -216,4 +216,4 @@ clean:  ## remove local build and module cache
 	rm -f unit.out aptly.test VERSION docs/docs.go docs/swagger.json docs/swagger.yaml docs/swagger.conf
 	find system/ -type d -name __pycache__ -exec rm -rf {} \; 2>/dev/null || true
 
-.PHONY: help man prepare swagger version binaries docker-release docker-system-test docker-unit-test docker-lint docker-build docker-image build docker-shell clean releasetype dpkg serve docker-serve flake8
+.PHONY: help man prepare swagger version binaries build docker-release docker-system-test docker-unit-test docker-lint docker-build docker-image docker-man docker-shell docker-serve clean releasetype dpkg serve flake8
diff --git a/api/repos.go b/api/repos.go
index 43a19cc9..4cc04f69 100644
--- a/api/repos.go
+++ b/api/repos.go
@@ -94,7 +94,7 @@ type repoCreateParams struct {
 	// Default component when publishing from this local repo
 	DefaultComponent string `        json:"DefaultComponent"     example:"main"`
 	// Snapshot name to create repoitory from (optional)
-	FromSnapshot string `            json:"FromSnapshot"         example:"snapshot1"`
+	FromSnapshot string `            json:"FromSnapshot"         example:""`
 }
 
 // @Summary Create Repository
diff --git a/cmd/mirror_create.go b/cmd/mirror_create.go
index 022a5cf2..049dd2eb 100644
--- a/cmd/mirror_create.go
+++ b/cmd/mirror_create.go
@@ -46,7 +46,7 @@ func aptlyMirrorCreate(cmd *commander.Command, args []string) error {
 		return fmt.Errorf("unable to create mirror: %s", err)
 	}
 
-	repo.Filter = context.Flags().Lookup("filter").Value.String()
+	repo.Filter = context.Flags().Lookup("filter").Value.String() // allows file/stdin with @
 	repo.FilterWithDeps = context.Flags().Lookup("filter-with-deps").Value.Get().(bool)
 	repo.SkipComponentCheck = context.Flags().Lookup("force-components").Value.Get().(bool)
 	repo.SkipArchitectureCheck = context.Flags().Lookup("force-architectures").Value.Get().(bool)
@@ -103,7 +103,7 @@ Example:
 	cmd.Flag.Bool("with-installer", false, "download additional not packaged installer files")
 	cmd.Flag.Bool("with-sources", false, "download source packages in addition to binary packages")
 	cmd.Flag.Bool("with-udebs", false, "download .udeb packages (Debian installer support)")
-	cmd.Flag.String("filter", "", "filter packages in mirror")
+	AddStringOrFileFlag(&cmd.Flag, "filter", "", "filter packages in mirror, use '@file' to read filter from file or '@-' for stdin")
 	cmd.Flag.Bool("filter-with-deps", false, "when filtering, include dependencies of matching packages as well")
 	cmd.Flag.Bool("force-components", false, "(only with component list) skip check that requested components are listed in Release file")
 	cmd.Flag.Bool("force-architectures", false, "(only with architecture list) skip check that requested architectures are listed in Release file")
diff --git a/cmd/mirror_edit.go b/cmd/mirror_edit.go
index 5adf504b..f95d9736 100644
--- a/cmd/mirror_edit.go
+++ b/cmd/mirror_edit.go
@@ -32,7 +32,7 @@ func aptlyMirrorEdit(cmd *commander.Command, args []string) error {
 	context.Flags().Visit(func(flag *flag.Flag) {
 		switch flag.Name {
 		case "filter":
-			repo.Filter = flag.Value.String()
+			repo.Filter = flag.Value.String() // allows file/stdin with @
 		case "filter-with-deps":
 			repo.FilterWithDeps = flag.Value.Get().(bool)
 		case "with-installer":
@@ -104,7 +104,7 @@ Example:
 	}
 
 	cmd.Flag.String("archive-url", "", "archive url is the root of archive")
-	cmd.Flag.String("filter", "", "filter packages in mirror")
+	AddStringOrFileFlag(&cmd.Flag, "filter", "", "filter packages in mirror, use '@file' to read filter from file or '@-' for stdin")
 	cmd.Flag.Bool("filter-with-deps", false, "when filtering, include dependencies of matching packages as well")
 	cmd.Flag.Bool("ignore-signatures", false, "disable verification of Release file signatures")
 	cmd.Flag.Bool("with-installer", false, "download additional not packaged installer files")
diff --git a/cmd/package_search.go b/cmd/package_search.go
index 2105a1f3..54290c21 100644
--- a/cmd/package_search.go
+++ b/cmd/package_search.go
@@ -21,7 +21,11 @@ func aptlyPackageSearch(cmd *commander.Command, args []string) error {
 	}
 
 	if len(args) == 1 {
-		q, err = query.Parse(args[0])
+		value, err := GetStringOrFileContent(args[0])
+		if err != nil {
+			return fmt.Errorf("unable to read package query from file %s: %w", args[0], err)
+		}
+		q, err = query.Parse(value)
 		if err != nil {
 			return fmt.Errorf("unable to search: %s", err)
 		}
@@ -49,6 +53,7 @@ func makeCmdPackageSearch() *commander.Command {
 		Long: `
 Command search displays list of packages in whole DB that match package query.
 
+Use '@file' to read query from file or '@-' for stdin.
 If query is not specified, all the packages are displayed.
 
 Example:
diff --git a/cmd/package_show.go b/cmd/package_show.go
index 37f07e9b..1715b52a 100644
--- a/cmd/package_show.go
+++ b/cmd/package_show.go
@@ -66,7 +66,11 @@ func aptlyPackageShow(cmd *commander.Command, args []string) error {
 		return commander.ErrCommandError
 	}
 
-	q, err := query.Parse(args[0])
+	value, err := GetStringOrFileContent(args[0])
+	if err != nil {
+		return fmt.Errorf("unable to read package query from file %s: %w", args[0], err)
+	}
+	q, err := query.Parse(value)
 	if err != nil {
 		return fmt.Errorf("unable to show: %s", err)
 	}
@@ -130,6 +134,8 @@ matching query. Information from Debian control file is displayed.
 Optionally information about package files and
 inclusion into mirrors/snapshots/local repos is shown.
 
+Use '@file' to read query from file or '@-' for stdin.
+
 Example:
 
     $ aptly package show 'nginx-light_1.2.1-2.2+wheezy2_i386'
diff --git a/cmd/repo_include.go b/cmd/repo_include.go
index cba3fb30..4aa26d41 100644
--- a/cmd/repo_include.go
+++ b/cmd/repo_include.go
@@ -93,7 +93,7 @@ Command include looks for .changes files in list of arguments or specified direc
 .changes file is verified, parsed, referenced files are put into separate temporary directory
 and added into local repository. Successfully imported files are removed by default.
 
-Additionally uploads could be restricted with <uploaders.json> file. Rules in this file control
+Additionally uploads could be restricted with 'uploaders.json' file. Rules in this file control
 uploads based on GPG key ID of .changes file signature and queries on .changes file fields.
 
 Example:
diff --git a/cmd/repo_move.go b/cmd/repo_move.go
index e53c3a7c..bd1447ce 100644
--- a/cmd/repo_move.go
+++ b/cmd/repo_move.go
@@ -110,7 +110,11 @@ func aptlyRepoMoveCopyImport(cmd *commander.Command, args []string) error {
 
 	queries := make([]deb.PackageQuery, len(args)-2)
 	for i := 0; i < len(args)-2; i++ {
-		queries[i], err = query.Parse(args[i+2])
+		value, err := GetStringOrFileContent(args[i+2])
+		if err != nil {
+			return fmt.Errorf("unable to read package query from file %s: %w", args[i+2], err)
+		}
+		queries[i], err = query.Parse(value)
 		if err != nil {
 			return fmt.Errorf("unable to %s: %s", command, err)
 		}
@@ -186,6 +190,8 @@ func makeCmdRepoMove() *commander.Command {
 Command move moves packages matching <package-query> from local repo
 <src-name> to local repo <dst-name>.
 
+Use '@file' to read package queries from file or '@-' for stdin.
+
 Example:
 
   $ aptly repo move testing stable 'myapp (=0.1.12)'
diff --git a/cmd/repo_remove.go b/cmd/repo_remove.go
index 287a42d5..5341a4c3 100644
--- a/cmd/repo_remove.go
+++ b/cmd/repo_remove.go
@@ -38,7 +38,11 @@ func aptlyRepoRemove(cmd *commander.Command, args []string) error {
 
 	queries := make([]deb.PackageQuery, len(args)-1)
 	for i := 0; i < len(args)-1; i++ {
-		queries[i], err = query.Parse(args[i+1])
+		value, err := GetStringOrFileContent(args[i+1])
+		if err != nil {
+			return fmt.Errorf("unable to read package query from file %s: %w", args[i+1], err)
+		}
+		queries[i], err = query.Parse(value)
 		if err != nil {
 			return fmt.Errorf("unable to remove: %s", err)
 		}
@@ -81,6 +85,8 @@ Commands removes packages matching <package-query> from local repository
 snapshots, they can be removed completely (including files) by running
 'aptly db cleanup'.
 
+Use '@file' to read package queries from file or '@-' for stdin.
+
 Example:
 
   $ aptly repo remove testing 'myapp (=0.1.12)'
diff --git a/cmd/snapshot_filter.go b/cmd/snapshot_filter.go
index c712ae67..d4e71dc4 100644
--- a/cmd/snapshot_filter.go
+++ b/cmd/snapshot_filter.go
@@ -60,7 +60,11 @@ func aptlySnapshotFilter(cmd *commander.Command, args []string) error {
 	// Initial queries out of arguments
 	queries := make([]deb.PackageQuery, len(args)-2)
 	for i, arg := range args[2:] {
-		queries[i], err = query.Parse(arg)
+		value, err := GetStringOrFileContent(arg)
+		if err != nil {
+			return fmt.Errorf("unable to read package query from file %s: %w", arg, err)
+		}
+		queries[i], err = query.Parse(value)
 		if err != nil {
 			return fmt.Errorf("unable to parse query: %s", err)
 		}
@@ -103,6 +107,8 @@ Command filter does filtering in snapshot <source>, producing another
 snapshot <destination>. Packages could be specified simply
 as 'package-name' or as package queries.
 
+Use '@file' syntax to read package queries from file and '@-' to read from stdin.
+
 Example:
 
     $ aptly snapshot filter wheezy-main wheezy-required 'Priority (required)'
diff --git a/cmd/snapshot_pull.go b/cmd/snapshot_pull.go
index 27593b77..f73afab7 100644
--- a/cmd/snapshot_pull.go
+++ b/cmd/snapshot_pull.go
@@ -88,7 +88,11 @@ func aptlySnapshotPull(cmd *commander.Command, args []string) error {
 	// Initial queries out of arguments
 	queries := make([]deb.PackageQuery, len(args)-3)
 	for i, arg := range args[3:] {
-		queries[i], err = query.Parse(arg)
+		value, err := GetStringOrFileContent(arg)
+		if err != nil {
+			return fmt.Errorf("unable to read package query from file %s: %w", arg, err)
+		}
+		queries[i], err = query.Parse(value)
 		if err != nil {
 			return fmt.Errorf("unable to parse query: %s", err)
 		}
@@ -167,6 +171,8 @@ versions from <source> following dependencies. New snapshot <destination>
 is created as a result of this process. Packages could be specified simply
 as 'package-name' or as package queries.
 
+Use '@file' syntax to read package queries from file and '@-' to read from stdin.
+
 Example:
 
     $ aptly snapshot pull wheezy-main wheezy-backports wheezy-new-xorg xorg-server-server
diff --git a/cmd/snapshot_search.go b/cmd/snapshot_search.go
index 7af78e1e..24da005d 100644
--- a/cmd/snapshot_search.go
+++ b/cmd/snapshot_search.go
@@ -78,7 +78,11 @@ func aptlySnapshotMirrorRepoSearch(cmd *commander.Command, args []string) error
 	list.PrepareIndex()
 
 	if len(args) == 2 {
-		q, err = query.Parse(args[1])
+		value, err := GetStringOrFileContent(args[1])
+		if err != nil {
+			return fmt.Errorf("unable to read package query from file %s: %w", args[1], err)
+		}
+		q, err = query.Parse(value)
 		if err != nil {
 			return fmt.Errorf("unable to search: %s", err)
 		}
@@ -134,6 +138,8 @@ Command search displays list of packages in snapshot that match package query
 
 If query is not specified, all the packages are displayed.
 
+Use '@file' syntax to read package query from file and '@-' to read from stdin.
+
 Example:
 
     $ aptly snapshot search wheezy-main '$Architecture (i386), Name (% *-dev)'
diff --git a/cmd/string_or_file_flag.go b/cmd/string_or_file_flag.go
new file mode 100644
index 00000000..aee234f3
--- /dev/null
+++ b/cmd/string_or_file_flag.go
@@ -0,0 +1,55 @@
+package cmd
+
+import (
+	"io"
+	"os"
+	"strings"
+
+	"github.com/smira/flag"
+)
+
+// StringOrFileFlag is a custom flag type that can handle both string input and file input.
+// If the input starts with '@', it is treated as a filename and the contents are read from the file.
+// If the input is '@-', the contents are read from stdin.
+type StringOrFileFlag struct {
+	value string
+}
+
+func (s *StringOrFileFlag) String() string {
+	return s.value
+}
+
+func (s *StringOrFileFlag) Set(value string) error {
+	var err error
+	s.value, err = GetStringOrFileContent(value)
+	return err
+}
+
+func (s *StringOrFileFlag) Get() any {
+	return s.value
+}
+
+func AddStringOrFileFlag(flagSet *flag.FlagSet, name string, value string, usage string) *StringOrFileFlag {
+	result := &StringOrFileFlag{value: value}
+	flagSet.Var(result, name, usage)
+	return result
+}
+
+func GetStringOrFileContent(value string) (string, error) {
+	if !strings.HasPrefix(value, "@") {
+		return value, nil
+	}
+
+	filename := strings.TrimPrefix(value, "@")
+	var data []byte
+	var err error
+	if filename == "-" { // Read from stdin
+		data, err = io.ReadAll(os.Stdin)
+	} else {
+		data, err = os.ReadFile(filename)
+	}
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
diff --git a/go.mod b/go.mod
index 35786ebe..b2bb72bc 100644
--- a/go.mod
+++ b/go.mod
@@ -33,9 +33,9 @@ require (
 	github.com/syndtr/goleveldb v1.0.1-0.20200815110645-5c35d600f0ca
 	github.com/ugorji/go/codec v1.2.11
 	github.com/wsxiaoys/terminal v0.0.0-20160513160801-0940f3fc43a0
-	golang.org/x/crypto v0.26.0 // indirect
-	golang.org/x/sys v0.23.0
-	golang.org/x/term v0.23.0
+	golang.org/x/crypto v0.31.0 // indirect
+	golang.org/x/sys v0.28.0
+	golang.org/x/term v0.27.0
 	golang.org/x/time v0.5.0
 	google.golang.org/protobuf v1.34.2 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
@@ -105,8 +105,8 @@ require (
 	go.uber.org/zap v1.26.0 // indirect
 	golang.org/x/arch v0.0.0-20210923205945-b76863e36670 // indirect
 	golang.org/x/net v0.28.0 // indirect
-	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/text v0.17.0 // indirect
+	golang.org/x/sync v0.10.0 // indirect
+	golang.org/x/text v0.21.0 // indirect
 	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240318140521-94a12d6c2237 // indirect
diff --git a/go.sum b/go.sum
index 4425614a..22430504 100644
--- a/go.sum
+++ b/go.sum
@@ -304,8 +304,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
-golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
+golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -335,8 +335,8 @@ golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -359,15 +359,15 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
-golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU=
-golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk=
+golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -376,8 +376,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
-golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
diff --git a/man/aptly.1 b/man/aptly.1
index 523440f8..bd6ad223 100644
--- a/man/aptly.1
+++ b/man/aptly.1
@@ -31,7 +31,7 @@ aptly looks for configuration file first in \fB~/\.aptly\.conf\fR then in \fB/us
 With aptly version 1\.6\.0, yaml configuration with inline documentation is supported and recommended (see \fBdebian/aptly\.conf\fR)\.
 .
 .P
-The legacy json configuration is still supported:
+The legacy json configuration is still supported (and also supports comments):
 .
 .IP "" 4
 .
@@ -588,7 +588,7 @@ Options:
 .
 .TP
 \-\fBfilter\fR=
-filter packages in mirror
+filter packages in mirror, use \(cq@file\(cq to read filter from file or \(cq@\-\(cq for stdin
 .
 .TP
 \-\fBfilter\-with\-deps\fR
@@ -771,7 +771,7 @@ archive url is the root of archive
 .
 .TP
 \-\fBfilter\fR=
-filter packages in mirror
+filter packages in mirror, use \(cq@file\(cq to read filter from file or \(cq@\-\(cq for stdin
 .
 .TP
 \-\fBfilter\-with\-deps\fR
@@ -1016,6 +1016,9 @@ display list in machine\-readable format
 Command move moves packages matching \fIpackage\-query\fR from local repo \fIsrc\-name\fR to local repo \fIdst\-name\fR\.
 .
 .P
+Use \(cq@file\(cq to read package queries from file or \(cq@\-\(cq for stdin\.
+.
+.P
 Example:
 .
 .P
@@ -1039,6 +1042,9 @@ follow dependencies when processing package\-spec
 Commands removes packages matching \fIpackage\-query\fR from local repository \fIname\fR\. If removed packages are not referenced by other repos or snapshots, they can be removed completely (including files) by running \(cqaptly db cleanup\(cq\.
 .
 .P
+Use \(cq@file\(cq to read package queries from file or \(cq@\-\(cq for stdin\.
+.
+.P
 Example:
 .
 .P
@@ -1123,7 +1129,7 @@ include dependencies into search results
 Command include looks for \.changes files in list of arguments or specified directories\. Each \.changes file is verified, parsed, referenced files are put into separate temporary directory and added into local repository\. Successfully imported files are removed by default\.
 .
 .P
-Additionally uploads could be restricted with
+Additionally uploads could be restricted with \(cquploaders\.json\(cq file\. Rules in this file control uploads based on GPG key ID of \.changes file signature and queries on \.changes file fields\.
 .
 .P
 Example:
@@ -1263,6 +1269,9 @@ $ aptly snapshot verify wheezy\-main wheezy\-contrib wheezy\-non\-free
 Command pull pulls new packages along with its\(cq dependencies to snapshot \fIname\fR from snapshot \fIsource\fR\. Pull can upgrade package version in \fIname\fR with versions from \fIsource\fR following dependencies\. New snapshot \fIdestination\fR is created as a result of this process\. Packages could be specified simply as \(cqpackage\-name\(cq or as package queries\.
 .
 .P
+Use \(cq@file\(cq syntax to read package queries from file and \(cq@\-\(cq to read from stdin\.
+.
+.P
 Example:
 .
 .IP "" 4
@@ -1398,6 +1407,9 @@ Command search displays list of packages in snapshot that match package query
 If query is not specified, all the packages are displayed\.
 .
 .P
+Use \(cq@file\(cq syntax to read package query from file and \(cq@\-\(cq to read from stdin\.
+.
+.P
 Example:
 .
 .IP "" 4
@@ -1428,6 +1440,9 @@ include dependencies into search results
 Command filter does filtering in snapshot \fIsource\fR, producing another snapshot \fIdestination\fR\. Packages could be specified simply as \(cqpackage\-name\(cq or as package queries\.
 .
 .P
+Use \(cq@file\(cq syntax to read package queries from file and \(cq@\-\(cq to read from stdin\.
+.
+.P
 Example:
 .
 .IP "" 4
@@ -2206,7 +2221,7 @@ don\(cqt sign Release files with GPG
 Command search displays list of packages in whole DB that match package query\.
 .
 .P
-If query is not specified, all the packages are displayed\.
+Use \(cq@file\(cq to read query from file or \(cq@\-\(cq for stdin\. If query is not specified, all the packages are displayed\.
 .
 .P
 Example:
@@ -2235,6 +2250,9 @@ custom format for result printing
 Command shows displays detailed meta\-information about packages matching query\. Information from Debian control file is displayed\. Optionally information about package files and inclusion into mirrors/snapshots/local repos is shown\.
 .
 .P
+Use \(cq@file\(cq to read query from file or \(cq@\-\(cq for stdin\.
+.
+.P
 Example:
 .
 .IP "" 4
@@ -2653,5 +2671,8 @@ Blake Kostner (https://github\.com/btkostner)
 .IP "\[ci]" 4
 Leigh London (https://github\.com/leighlondon)
 .
+.IP "\[ci]" 4
+Gordian Schoenherr (https://github\.com/schoenherrg)
+.
 .IP "" 0
 
diff --git a/man/aptly.1.ronn.tmpl b/man/aptly.1.ronn.tmpl
index b948aaf4..203cc7fe 100644
--- a/man/aptly.1.ronn.tmpl
+++ b/man/aptly.1.ronn.tmpl
@@ -21,9 +21,10 @@ aptly has integrated help that matches contents of this manual page, to get help
 aptly looks for configuration file first in `~/.aptly.conf` then in `/usr/local/etc/aptly.conf` and `/etc/aptly.conf`. If no config file found (or they are not readable), a new one is created in the
 home directory. If `-config=` flag is specified, aptly would use config file at specified location. Also aptly needs root directory for database, package and published repository storage.  If not specified, directory defaults to `~/.aptly/`, it will be created if missing.
 
-With aptly version 1.6.0, yaml configuration with inline documentation is supported and recommended (see `debian/aptly.conf`).
+With aptly version 1.6.0, yaml configuration with inline documentation is
+supported and recommended (see `debian/aptly.conf`).
 
-The legacy json configuration is still supported:
+The legacy json configuration is still supported (and also supports comments):
 
     // vim: : filetype=json
     // json configuration file with comments
diff --git a/system/t03_help/MirrorCreateHelpTest_gold b/system/t03_help/MirrorCreateHelpTest_gold
index 1816e6d3..c0cc3886 100644
--- a/system/t03_help/MirrorCreateHelpTest_gold
+++ b/system/t03_help/MirrorCreateHelpTest_gold
@@ -21,7 +21,7 @@ Options:
   -dep-follow-source: when processing dependencies, follow from binary to Source packages
   -dep-follow-suggests: when processing dependencies, follow Suggests
   -dep-verbose-resolve: when processing dependencies, print detailed logs
-  -filter="": filter packages in mirror
+  -filter=: filter packages in mirror, use '@file' to read filter from file or '@-' for stdin
   -filter-with-deps: when filtering, include dependencies of matching packages as well
   -force-architectures: (only with architecture list) skip check that requested architectures are listed in Release file
   -force-components: (only with component list) skip check that requested components are listed in Release file
diff --git a/system/t03_help/MirrorCreateTest_gold b/system/t03_help/MirrorCreateTest_gold
index 74502216..30bcfd86 100644
--- a/system/t03_help/MirrorCreateTest_gold
+++ b/system/t03_help/MirrorCreateTest_gold
@@ -12,7 +12,7 @@ Options:
   -dep-follow-source: when processing dependencies, follow from binary to Source packages
   -dep-follow-suggests: when processing dependencies, follow Suggests
   -dep-verbose-resolve: when processing dependencies, print detailed logs
-  -filter="": filter packages in mirror
+  -filter=: filter packages in mirror, use '@file' to read filter from file or '@-' for stdin
   -filter-with-deps: when filtering, include dependencies of matching packages as well
   -force-architectures: (only with architecture list) skip check that requested architectures are listed in Release file
   -force-components: (only with component list) skip check that requested components are listed in Release file
diff --git a/system/t03_help/WrongFlagTest_gold b/system/t03_help/WrongFlagTest_gold
index 4dc0cb19..fb928b1e 100644
--- a/system/t03_help/WrongFlagTest_gold
+++ b/system/t03_help/WrongFlagTest_gold
@@ -13,7 +13,7 @@ Options:
   -dep-follow-source: when processing dependencies, follow from binary to Source packages
   -dep-follow-suggests: when processing dependencies, follow Suggests
   -dep-verbose-resolve: when processing dependencies, print detailed logs
-  -filter="": filter packages in mirror
+  -filter=: filter packages in mirror, use '@file' to read filter from file or '@-' for stdin
   -filter-with-deps: when filtering, include dependencies of matching packages as well
   -force-architectures: (only with architecture list) skip check that requested architectures are listed in Release file
   -force-components: (only with component list) skip check that requested components are listed in Release file
diff --git a/system/t04_mirror/CreateMirror36Test_gold b/system/t04_mirror/CreateMirror36Test_gold
new file mode 100644
index 00000000..eb089d7e
--- /dev/null
+++ b/system/t04_mirror/CreateMirror36Test_gold
@@ -0,0 +1,4 @@
+Downloading: http://repo.aptly.info/system-tests/archive.debian.org/debian-security/dists/stretch/updates/Release
+
+Mirror [mirror36]: http://repo.aptly.info/system-tests/archive.debian.org/debian-security/ stretch/updates successfully added.
+You can run 'aptly mirror update mirror36' to download repository contents.
diff --git a/system/t04_mirror/CreateMirror36Test_mirror_show b/system/t04_mirror/CreateMirror36Test_mirror_show
new file mode 100644
index 00000000..c6188417
--- /dev/null
+++ b/system/t04_mirror/CreateMirror36Test_mirror_show
@@ -0,0 +1,22 @@
+Name: mirror36
+Archive Root URL: http://repo.aptly.info/system-tests/archive.debian.org/debian-security/
+Distribution: stretch/updates
+Components: main
+Architectures: amd64, arm64, armel, armhf, i386
+Download Sources: no
+Download .udebs: no
+Filter: nginx | Priority (required)
+Filter With Deps: no
+Last update: never
+
+Information from release file:
+Acquire-By-Hash: yes
+Architectures: amd64 arm64 armel armhf i386
+Codename: stretch
+Components: updates/main updates/contrib updates/non-free
+Description:  Debian 9 Security Updates
+
+Label: Debian-Security
+Origin: Debian
+Suite: oldoldstable
+Version: 9
diff --git a/system/t04_mirror/CreateMirror37Test_gold b/system/t04_mirror/CreateMirror37Test_gold
new file mode 100644
index 00000000..ef68aabc
--- /dev/null
+++ b/system/t04_mirror/CreateMirror37Test_gold
@@ -0,0 +1,4 @@
+Downloading: http://repo.aptly.info/system-tests/archive.debian.org/debian-security/dists/stretch/updates/Release
+
+Mirror [mirror37]: http://repo.aptly.info/system-tests/archive.debian.org/debian-security/ stretch/updates successfully added.
+You can run 'aptly mirror update mirror37' to download repository contents.
diff --git a/system/t04_mirror/CreateMirror37Test_mirror_show b/system/t04_mirror/CreateMirror37Test_mirror_show
new file mode 100644
index 00000000..aa2750a2
--- /dev/null
+++ b/system/t04_mirror/CreateMirror37Test_mirror_show
@@ -0,0 +1,22 @@
+Name: mirror37
+Archive Root URL: http://repo.aptly.info/system-tests/archive.debian.org/debian-security/
+Distribution: stretch/updates
+Components: main
+Architectures: amd64, arm64, armel, armhf, i386
+Download Sources: no
+Download .udebs: no
+Filter: nginx | Priority (required)
+Filter With Deps: no
+Last update: never
+
+Information from release file:
+Acquire-By-Hash: yes
+Architectures: amd64 arm64 armel armhf i386
+Codename: stretch
+Components: updates/main updates/contrib updates/non-free
+Description:  Debian 9 Security Updates
+
+Label: Debian-Security
+Origin: Debian
+Suite: oldoldstable
+Version: 9
diff --git a/system/t04_mirror/create.py b/system/t04_mirror/create.py
index ecf3b6d4..a2cdbf74 100644
--- a/system/t04_mirror/create.py
+++ b/system/t04_mirror/create.py
@@ -1,3 +1,4 @@
+from pathlib import Path
 import re
 import os
 
@@ -489,3 +490,45 @@ class CreateMirror35Test(BaseTest):
     def check(self):
         self.check_output()
         self.check_cmd_output("aptly mirror show mirror35", "mirror_show")
+
+
+class CreateMirror36Test(BaseTest):
+    """
+    create mirror: mirror with filter read from file
+    """
+    filterFilePath = os.path.join(os.environ["HOME"], ".aptly-filter.tmp")
+    fixtureCmds = [f"bash -c \"echo -n 'nginx | Priority (required)' > {filterFilePath}\""]
+    runCmd = f"aptly mirror create -ignore-signatures -filter='@{filterFilePath}' mirror36 http://repo.aptly.info/system-tests/archive.debian.org/debian-security/ stretch/updates main"
+
+    def check(self):
+        def removeDates(s):
+            return re.sub(r"(Date|Valid-Until): [,0-9:+A-Za-z -]+\n", "", s)
+
+        self.check_output()
+        self.check_cmd_output("aptly mirror show mirror36",
+                              "mirror_show", match_prepare=removeDates)
+
+
+class CreateMirror37Test(BaseTest):
+    """
+    create mirror: mirror with filter read from stdin
+    """
+    aptly_testing_bin = Path(__file__).parent.parent.parent / "aptly.test"
+    # Hack: Normally the test system detects if runCmd is an aptly command and then
+    # substitutes the aptly_testing_bin path and deletes the last three lines of output.
+    # However, I need to run it in bash to control stdin, so I have to do it manually.
+    runCmd = [
+        "bash",
+        "-c",
+        f"echo -n 'nginx | Priority (required)' | {aptly_testing_bin} mirror create " +
+        "-ignore-signatures -filter='@-' mirror37 http://repo.aptly.info/system-tests/archive.debian.org/debian-security/ stretch/updates main " +
+        "| grep -vE '^(EXIT|PASS|coverage:)'"
+    ]
+
+    def check(self):
+        def removeDates(s):
+            return re.sub(r"(Date|Valid-Until): [,0-9:+A-Za-z -]+\n", "", s)
+
+        self.check_output()
+        self.check_cmd_output("aptly mirror show mirror37",
+                              "mirror_show", match_prepare=removeDates)