vincent/aptly
1
0 Fork 0
mirror of https://github.com/aptly-dev/aptly.git synced 2026-11-13 14:37:18 +00:00
Code Issues Projects Releases Wiki Activity
2,841 Commits 9 Branches 28 Tags
0d23d3284027eeb28dab50ebca8ebaa384404a62
Commit Graph
2841 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Luan Dang 0d23d32840 test: handle HEAD metrics response cleanup 2026-11-03 11:42:38 +01:00
Luan DangandCopilot Autofix powered by AI 198c801f00 Refactor TestHeadMetrics for improved testing 
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-11-03 11:42:38 +01:00
Luan Dang 328120f80a api: add metrics-only listener 2026-11-03 11:42:38 +01:00
André Roth 431f75c109 Merge pull request #1646 from twaik/fix-version-split-last-hyphen 
deb: split Debian revision at the last hyphen
 2026-11-03 10:38:54 +01:00
André Roth 70f423adaa Merge pull request #1603 from jmunson/jmunson/enable-pprof 
Expose net/http/pprof handlers
 2026-11-02 20:01:01 +01:00
James Munson 2d72d1f0d5 Expose net/http/pprof handlers under /api/debug/pprof/* when the new 
enablePprofEndpoint (JSON) / enable_pprof_endpoint (YAML) config option
is true. The endpoint is disabled by default.
 2026-11-02 15:14:35 +01:00
André Roth 81d119f421 deb: rebase changes 2026-11-02 14:59:52 +01:00
Twaik Yont 242a0d4010 deb: split Debian revision at the last hyphen 
Per Debian Policy, the version is split at the last hyphen:
https://www.debian.org/doc/debian-policy/ch-controlfields.html#version

Add tests for the ordering of '+', which is a regular non-letter sorted by its ASCII value (see Comparing version numbers on the same page).
 2026-11-02 14:48:41 +01:00
André Roth eaf9453897 Merge pull request #1601 from jaymzh/debian-version 
Fix version parsing, validate debian package version
 2026-11-02 10:11:20 +01:00
Phil Dibowitz 21487d4b5d Fix version parsing, validate debian package version 
This patch adds validation to the version pasing logic (parseVersion) to
not allow packages to be registered which apt wouldn't accept anyway.

It then propogates validation errors through CompareVersions, the way
in which parseVersion gets called, so that appropriate decisions can be
made.

New packages with invalid versions are not accepted.

For any pre-exisiting packages with invalid versions, as much care is
taken as possible to log warnings, and not use those packages.

This PR is loosely bnased on one by by Aaron Foster
<afoster@cloudflare.com> though it has largely been written at this
point.

Signed off with internal and external emails for clarity, but commit
is under personal email where we typically do open source contributions
from.

Signed-off-by: Phil Dibowitz <pdibowitz@cloudflare.com>
Signed-off-by: Phil Dibowitz <pdibowitz@ipom.com>
 2026-11-01 14:25:17 -08:00
André Roth 0b55b09eb2 Merge pull request #1659 from aptly-dev/fix/tmp-suffix 
publish s3: remove tmp suffix for testing
 2026-11-01 17:03:11 +01:00
André Roth 10e748a097 publish s3: remove tmp suffix for testing 2026-11-01 16:14:10 +01:00
André Roth 28609a918e Merge pull request #1629 from daniel-pinder/pgp-accept-multisigned-releases 2026-11-01 14:45:00 +01:00
André Roth 29db8333c5 recreate test keys with faketime 2026-11-01 13:26:36 +01:00
Daniel Pinder 59ff63de62 pgp: accept multi-signed releases when the keyring holds only some signers 
Debian co-signs each suite's InRelease with more than one archive key, so
gpgv reports a good signature from the key you trust and NO_PUBKEY for the
others, exiting 2. Both verifiers treat that as failure, which means
mirroring Debian requires importing every key Debian happens to sign with.
apt does not require this: it is fatal only when there is no good signature
or a BADSIG.

Adopt that rule for unknown signers. When gpgv exits non-zero the status
stream is parsed per NEWSIG block and the result is a success only when the
process exited, at least one block is a good signature from a held key, at
least one block is an unknown issuer (ERRSIG reason 9 with NO_PUBKEY), and
nothing else appears. BADSIG, EXPSIG, EXPKEYSIG and REVKEYSIG from a held
key still fail, as does any unexplained failure. The exit-zero path is
unchanged.

KEYEXPIRED and KEYREVOKED are deliberately not disqualifiers: doc/DETAILS
notes KEYEXPIRED is emitted for an expired subkey even when that subkey was
not used, so treating it as a verdict rejects valid signatures.

checkDetachedSignature gets the equivalent change for the internal verifier.
 2026-11-01 13:26:36 +01:00
André Roth a65c2cd850 Merge pull request #1602 from andrewshadura/deb-tmp-uniq 
deb publish: Create unique temporary files each time
 2026-11-01 12:45:23 +01:00
André Roth 5775d2e31c Merge pull request #1656 from aptly-dev/fix/mirror-rename 
mirror: fix rename
 2026-11-01 10:36:13 +01:00
André Roth f668b1016f Merge pull request #1647 from aptly-dev/fix/swagger-validation 
Documentation cleanup: fix validation error and config file headings
 2026-11-01 10:35:50 +01:00
André Roth bddfed27e5 swagger: fix validation error 2026-11-01 02:30:33 +01:00
André Roth cd22f09fc1 doc: fix comment order in aptly.conf 2026-11-01 02:30:33 +01:00
André Roth cd365b2899 mirror: fix rename 2026-11-01 02:30:11 +01:00
André Roth add8d82b44 Merge pull request #1658 from aptly-dev/dependabot/go_modules/github.com/klauspost/compress-1.18.7 
build(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.7
 2026-11-01 01:27:03 +01:00
André Roth ffe77f7b1e Merge pull request #1657 from aptly-dev/dependabot/go_modules/github.com/go-jose/go-jose/v4-4.1.6 
build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6
 2026-11-01 01:24:13 +01:00
André Roth 65a8237574 Merge pull request #1642 from filbranden/fix-download-url-opaque 
Show the full URL in download error messages
 2026-11-01 00:50:52 +01:00
dependabot[bot] fba40f12bd build(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.7 
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.18.2 to 1.18.7.
- [Release notes](https://github.com/klauspost/compress/releases)
- [Commits](https://github.com/klauspost/compress/compare/v1.18.2...v1.18.7)

---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
  dependency-version: 1.18.7
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-31 23:50:33 +00:00
dependabot[bot] 9c37e279dd build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 
Bumps [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from 4.1.4 to 4.1.6.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](https://github.com/go-jose/go-jose/compare/v4.1.4...v4.1.6)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-version: 4.1.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-31 23:50:18 +00:00
André Roth 3c46f7976b Merge pull request #1624 from chipflake/api-codename 
api/publish: allow setting custom Codename on the Release file
 2026-11-01 00:36:28 +01:00
Filipe Brandenburger 4e671cc366 Show the full URL in download error messages 
Downloads set req.URL.Opaque to keep "+" percent-encoded in the path.
URL.String() prints "scheme:opaque" and drops the host, so every error
from the http client showed a URL such as "https:/repos/debian/...",
lacking a host name. The request itself was correct, but the message
sent me to look for a malformed URL.

Set req.URL.RawPath instead. The escaping still reaches the wire through
EscapedPath(), and String() keeps the scheme and the host.

The proxy special case is no longer necessary. Requests through a proxy
now get the same "+" escaping as direct requests.
 2026-11-01 00:14:42 +01:00
André Roth bf06c688ed Merge pull request #1611 from tbe/api-pull-fix 
api: fix snasphot-pull
 2026-10-31 23:35:07 +01:00
André Roth 2f102086b7 Merge pull request #1640 from aptly-dev/dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.45.0 
build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0
 2026-10-31 22:54:51 +01:00
dependabot[bot] 3812982982 build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 
Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.44.0 to 1.45.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.44.0...v1.45.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.45.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-31 21:21:17 +00:00
André Roth 17d0899e72 Merge pull request #1628 from aptly-dev/dependabot/go_modules/google.golang.org/grpc-1.83.1 
build(deps): bump google.golang.org/grpc from 1.79.3 to 1.83.2
 2026-10-31 21:41:38 +01:00
André Roth 103e4c2810 Merge pull request #1621 from KereMath/fix/skel-appstream-publish 
publish: fix duplicated skel/AppStream files and missing by-hash entries
 2026-10-31 21:17:31 +01:00
dependabot[bot] 76bd237954 build(deps): bump google.golang.org/grpc from 1.79.3 to 1.83.2 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.79.3 to 1.83.2.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.79.3...v1.83.2)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-31 20:17:16 +00:00
André Roth a10f3bcc0e Merge pull request #1618 from aptly-dev/dependabot/go_modules/github.com/go-git/go-git/v5-5.19.2 
build(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2
 2026-10-31 21:14:00 +01:00
André Roth c54e3f31a2 Merge pull request #1625 from barnumbirr/fix-readlink-metadata-case 
s3: match the SymLink metadata key case-insensitively in ReadLink
 2026-10-31 20:45:29 +01:00
dependabot[bot] 24adc1790c build(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.19.1 to 5.19.2.
- [Release notes](https://github.com/go-git/go-git/releases)
- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md)
- [Commits](https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.19.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-31 19:45:23 +00:00
André Roth 0eee5c02d8 Merge pull request #1605 from aptly-dev/dependabot/go_modules/golang.org/x/crypto-0.52.0 
build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0
 2026-10-31 20:43:00 +01:00
dependabot[bot] 585db213ec build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.51.0 to 0.52.0.
- [Commits](https://github.com/golang/crypto/compare/v0.51.0...v0.52.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.52.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-31 19:09:19 +00:00
André Roth 57529f53ef Merge pull request #1600 from aptly-dev/dependabot/go_modules/golang.org/x/net-0.55.0 
build(deps): bump golang.org/x/net from 0.53.0 to 0.55.0
 2026-10-31 20:07:37 +01:00
André Roth bc0fe9c0b7 Merge pull request #1648 from AdamMagued/fix/issue-1619-snapshots-async-lock 
fix(api): handle concurrent snapshot deletion during list endpoint
 2026-10-31 20:06:28 +01:00
dependabot[bot] d6066de308 build(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.53.0 to 0.55.0.
- [Commits](https://github.com/golang/net/compare/v0.53.0...v0.55.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.55.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-31 17:02:45 +00:00
adam magued f525d653a5 test(api): add regression test for concurrent snapshot deletion 2026-10-14 15:55:55 +03:00
adam magued 74c13f73f2 fix(api): handle concurrent snapshot deletion during list endpoint 2026-10-14 15:55:53 +03:00
André Roth 516fcc6bfd Merge pull request #1636 from mmayabi/add-aptlypilot-integration 
Add AptlyPilot to integrations
 2026-10-12 16:12:56 +02:00
André Roth 1c5db5f5b3 Merge pull request #1639 from voegelas/update-workflows 
Update GitHub workflows
 2026-10-12 16:09:33 +02:00
Andreas Vögele f51224958b Remove Debian 11 from ci-debian-build 
Debian 11 reached its end-of-life on 31 August 2026.
 2026-09-15 13:40:57 +02:00
Andreas Vögele fef55f81e5 Update the versions of the GitHub actions 2026-09-15 12:29:24 +02:00
mmayabi 16691aad83 add Integrations aptlyPilot 2026-09-10 19:41:13 +03:30
mmayabi e4c3399ae5 add Integrations AptlyPilot 2026-09-10 19:40:20 +03:30