Update changelog for 1.6.2-3 release

d/control: bump-up Standards-Version
tests: disable t12_api/gpg/GPGAPITestAddKey (Closes: #1135672 )
2026-06-16 07:10:54 +00:00 · 2026-05-05 18:24:43 +02:00 · 2026-05-05 18:24:17 +02:00 · 2026-05-05 18:14:15 +02:00 · 2026-05-05 18:11:47 +02:00 · 2025-11-21 15:47:30 +01:00
194 changed files with 2182 additions and 5548 deletions
@@ -4,10 +4,6 @@ Fixes #

 All new code should be covered with tests, documentation should be updated. CI should pass.

-Also, to speed up things, if you could kindly "Allow edits and access to secrets by maintainers" in the
-PR settings, as this allows us to rebase the PR on master, fix conflicts, run coverage and help with
-implementing code and tests.
-
 ## Description of the Change

 <!--
@@ -18,7 +14,6 @@ Why this change is important?

 ## Checklist

- [ ] allow Maintainers to edit PR (rebase, run coverage, help with tests, ...)
 - [ ] unit-test added (if change is algorithm)
 - [ ] functional test added/updated (if change is functional)
 - [ ] man page updated (if applicable)
@@ -17,32 +17,8 @@ env:
  DEBIAN_FRONTEND: noninteractive

 jobs:
-  unit-test:
-    name: "Unit Tests"
-    runs-on: ubuntu-22.04
-    continue-on-error: false
-    timeout-minutes: 30
-    steps:
-      - name: "Checkout Repository"
-        uses: actions/checkout@v4
-        with:
-          # fetch the whole repo for `git describe` to work
-          fetch-depth: 0
-      - name: "Docker Image"
-        run: |
-          make docker-image
-      - name: "Unit Tests"
-        run: |
-          make docker-unit-tests
-          mkdir -p out/coverage
-          mv unit.out out/coverage/
-      - uses: actions/upload-artifact@v4
-        with:
-          name: unit-tests-coverage
-          path: out/
-
  test:
-    name: "System Test"
+    name: "Test (Ubuntu 22.04)"
    runs-on: ubuntu-22.04
    continue-on-error: false
    timeout-minutes: 30
@@ -87,10 +63,21 @@ jobs:
        with:
          directory: ${{ runner.temp }}

+      - name: "Run Unit Tests"
+        env:
+          RUN_LONG_TESTS: 'yes'
+          AZURE_STORAGE_ENDPOINT: "http://127.0.0.1:10000/devstoreaccount1"
+          AZURE_STORAGE_ACCOUNT: "devstoreaccount1"
+          AZURE_STORAGE_ACCESS_KEY: "Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw=="
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        run: |
+          sudo mkdir -p /srv ; sudo chown runner /srv
+          COVERAGE_DIR=${{ runner.temp }} make test
+
      - name: "Run Benchmark"
        run: |
-          mkdir -p out/coverage
-          COVERAGE_DIR=$PWD/out/coverage make bench
+          COVERAGE_DIR=${{ runner.temp }} make bench

      - name: "Run System Tests"
        env:
@@ -102,63 +89,30 @@ jobs:
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        run: |
          sudo mkdir -p /srv ; sudo chown runner /srv
-          mkdir -p out/coverage
-          COVERAGE_DIR=$PWD/out/coverage make system-test
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: system-tests-coverage
-          path: out/
-
-  coverage:
-    name: "Upload Coverage"
-    runs-on: ubuntu-22.04
-    continue-on-error: false
-    timeout-minutes: 30
-    needs:
-      - unit-test
-      - test
-    steps:
-      - name: "Checkout Repository"
-        uses: actions/checkout@v4
-
-      - name: "Download Unit Test Coverage"
-        uses: actions/download-artifact@v4
-        with:
-          name: unit-tests-coverage
-
-      - name: "Download System Test Coverage"
-        uses: actions/download-artifact@v4
-        with:
-          name: system-tests-coverage
+          COVERAGE_DIR=${{ runner.temp }} make system-test

      - name: "Merge Code Coverage"
        run: |
-          # go install github.com/wadey/gocovmerge@v0.0.0-20160331181800-b5bfa59ec0ad
-          # ~/go/bin/gocovmerge coverage/*.out > coverage.txt
-          awk 'FNR==1 && NR!=1 {next} {print}' coverage/*.out > coverage.txt
+          go install github.com/wadey/gocovmerge@v0.0.0-20160331181800-b5bfa59ec0ad
+          ~/go/bin/gocovmerge unit.out ${{ runner.temp }}/*.out > coverage.txt

      - name: "Upload Code Coverage"
-        if: github.actor != 'dependabot[bot]'
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v2
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: coverage.txt
-          fail_ci_if_error: true
-

  ci-debian-build:
    name: "Build"
-    needs:
-      - coverage
+    needs: test
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
-        name: ["Debian 13/trixie", "Debian 12/bookworm", "Debian 11/bullseye", "Ubuntu 24.04", "Ubuntu 22.04", "Ubuntu 20.04"]
+        name: ["Debian 13/testing", "Debian 12/bookworm", "Debian 11/bullseye", "Debian 10/buster", "Ubuntu 24.04", "Ubuntu 22.04", "Ubuntu 20.04"]
        arch: ["amd64", "i386" , "arm64" , "armhf"]
        include:
-          - name: "Debian 13/trixie"
+          - name: "Debian 13/testing"
            suite: trixie
            image: debian:trixie-slim
          - name: "Debian 12/bookworm"
@@ -167,6 +121,9 @@ jobs:
          - name: "Debian 11/bullseye"
            suite: bullseye
            image: debian:bullseye-slim
+          - name: "Debian 10/buster"
+            suite: buster
+            image: debian:buster-slim
          - name: "Ubuntu 24.04"
            suite: noble
            image: ubuntu:24.04
@@ -178,7 +135,6 @@ jobs:
            image: ubuntu:20.04
    container:
      image: ${{ matrix.image }}
-      options: --user root
      env:
        APT_LISTCHANGES_FRONTEND: none
        DEBIAN_FRONTEND: noninteractive
@@ -270,8 +226,7 @@ jobs:

  ci-binary-build:
    name: "Build"
-    needs:
-      - coverage
+    needs: test
    runs-on: ubuntu-latest
    strategy:
      matrix:
@@ -35,7 +35,7 @@ jobs:
      - name: Install and initialize swagger
        run: |
          go install github.com/swaggo/swag/cmd/swag@latest
-          swag init -q --propertyStrategy pascalcase --markdownFiles docs
+          swag init -q --markdownFiles docs
        shell: sh

      - name: golangci-lint
@@ -26,8 +26,6 @@ _testmain.go
 *.test

 coverage.txt
-coverage.out
-coverage.html

 *.pyc

@@ -69,18 +69,3 @@ List of contributors, in chronological order:
 * Leigh London (https://github.com/leighlondon)
 * Gordian Schoenherr (https://github.com/schoenherrg)
 * Silke Hofstra (https://github.com/silkeh)
-* Itay Porezky (https://github.com/itayporezky)
-* Alejandro Guijarro Monerris (https://github.com/alguimodd)
-* JupiterRider (https://github.com/JupiterRider)
-* Agustin Henze (https://github.com/agustinhenze)
-* Tobias Assarsson (https://github.com/daedaluz)
-* Yaksh Bariya (https://github.com/thunder-coding)
-* Juan Calderon-Perez (https://github.com/gaby)
-* Ato Araki (https://github.com/atotto)
-* Roman Lebedev (https://github.com/LebedevRI)
-* Brian Witt (https://github.com/bwitt)
-* Ales Bregar (https://github.com/abregar)
-* Tim Foerster (https://github.com/tonobo)
-* Zhang Xiao (https://github.com/xzhang1)
-* Tom Nguyen (https://github.com/lecafard)
-* Philip Cramer (https://github.com/PhilipCramer)
@@ -7,23 +7,9 @@ COVERAGE_DIR?=$(shell mktemp -d)
 GOOS=$(shell go env GOHOSTOS)
 GOARCH=$(shell go env GOHOSTARCH)

-export PODMAN_USERNS = keep-id
-DOCKER_RUN = docker run --security-opt label=disable --user 0:0 --rm -v ${PWD}:/work/src
-
-# Setting TZ for certificates
-export TZ=UTC
 # Unit Tests and some sysmte tests rely on expired certificates, turn back the time
 export TEST_FAKETIME := 2025-01-02 03:04:05

-# run with 'COVERAGE_SKIP=1' to skip coverage checks during system tests
-ifeq ($(COVERAGE_SKIP),1)
-COVERAGE_ARG_BUILD :=
-COVERAGE_ARG_TEST := --coverage-skip
-else
-COVERAGE_ARG_BUILD := -coverpkg="./..."
-COVERAGE_ARG_TEST := --coverage-dir $(COVERAGE_DIR)
-endif
-
 # export CAPUTRE=1 for regenrating test gold files
 ifeq ($(CAPTURE),1)
 CAPTURE_ARG := --capture
@@ -77,7 +63,7 @@ azurite-stop:

 swagger: swagger-install
 	# Generate swagger docs
-	@PATH=$(BINPATH)/:$(PATH) swag init --propertyStrategy pascalcase --parseDependency --parseInternal --markdownFiles docs --generalInfo docs/swagger.conf
+	@PATH=$(BINPATH)/:$(PATH) swag init --parseDependency --parseInternal --markdownFiles docs --generalInfo docs/swagger.conf

 etcd-install:
 	# Install etcd
@@ -115,13 +101,13 @@ test: prepare swagger etcd-install  ## Run unit tests (add TEST=regex to specify

 system-test: prepare swagger etcd-install  ## Run system tests
 	# build coverage binary
-	go test -v $(COVERAGE_ARG_BUILD) -c -tags testruncli
+	go test -v -coverpkg="./..." -c -tags testruncli
 	# Download fixture-db, fixture-pool, etcd.db
 	if [ ! -e ~/aptly-fixture-db ]; then git clone https://github.com/aptly-dev/aptly-fixture-db.git ~/aptly-fixture-db/; fi
 	if [ ! -e ~/aptly-fixture-pool ]; then git clone https://github.com/aptly-dev/aptly-fixture-pool.git ~/aptly-fixture-pool/; fi
 	test -f ~/etcd.db || (curl -o ~/etcd.db.xz http://repo.aptly.info/system-tests/etcd.db.xz && xz -d ~/etcd.db.xz)
 	# Run system tests
-	PATH=$(BINPATH)/:$(PATH) FORCE_COLOR=1 $(PYTHON) system/run.py --long $(COVERAGE_ARG_TEST) $(CAPTURE_ARG) $(TEST)
+	PATH=$(BINPATH)/:$(PATH) FORCE_COLOR=1 $(PYTHON) system/run.py --long --coverage-dir $(COVERAGE_DIR) $(CAPTURE_ARG) $(TEST)

 bench:
 	@echo "\e[33m\e[1mRunning benchmark ...\e[0m"
@@ -131,8 +117,7 @@ serve: prepare swagger-install  ## Run development server (auto recompiling)
 	test -f $(BINPATH)/air || go install github.com/air-verse/air@v1.52.3
 	cp debian/aptly.conf ~/.aptly.conf
 	sed -i /enable_swagger_endpoint/s/false/true/ ~/.aptly.conf
-	sed -i /enable_metrics_endpoint/s/false/true/ ~/.aptly.conf
-	PATH=$(BINPATH):$$PATH air -build.pre_cmd 'swag init -q --propertyStrategy pascalcase --markdownFiles docs --generalInfo docs/swagger.conf' -build.exclude_dir docs,system,debian,pgp/keyrings,pgp/test-bins,completion.d,man,deb/testdata,console,_man,systemd,obj-x86_64-linux-gnu -- api serve -listen 0.0.0.0:3142
+	PATH=$(BINPATH):$$PATH air -build.pre_cmd 'swag init -q --markdownFiles docs --generalInfo docs/swagger.conf' -build.exclude_dir docs,system,debian,pgp/keyrings,pgp/test-bins,completion.d,man,deb/testdata,console,_man,systemd,obj-x86_64-linux-gnu -- api serve -listen 0.0.0.0:3142

 dpkg: prepare swagger  ## Build debian packages
 	@test -n "$(DEBARCH)" || (echo "please define DEBARCH"; exit 1)
@@ -186,16 +171,16 @@ docker-image-no-cache:  ## Build aptly-dev docker image (no cache)
 	@docker build --no-cache -f system/Dockerfile . -t aptly-dev

 docker-build:  ## Build aptly in docker container
-	@$(DOCKER_RUN) -t aptly-dev /work/src/system/docker-wrapper build
+	@docker run -it --rm -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper build

 docker-shell:  ## Run aptly and other commands in docker container
-	@$(DOCKER_RUN) -it -p 3142:3142 aptly-dev /work/src/system/docker-wrapper || true
+	@docker run -it --rm -p 3142:3142 -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper || true

 docker-deb:  ## Build debian packages in docker container
-	@$(DOCKER_RUN) -t aptly-dev /work/src/system/docker-wrapper dpkg DEBARCH=amd64
+	@docker run -it --rm -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper dpkg DEBARCH=amd64

-docker-unit-tests:  ## Run unit tests in docker container (add TEST=regex to specify which tests to run)
-	$(DOCKER_RUN) -t --tmpfs /smallfs:rw,size=1m aptly-dev /work/src/system/docker-wrapper \
+docker-unit-test:  ## Run unit tests in docker container (add TEST=regex to specify which tests to run)
+	@docker run -it --rm -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper \
 		azurite-start \
 		AZURE_STORAGE_ENDPOINT=http://127.0.0.1:10000/devstoreaccount1 \
 		AZURE_STORAGE_ACCOUNT=devstoreaccount1 \
@@ -204,27 +189,27 @@ docker-unit-tests:  ## Run unit tests in docker container (add TEST=regex to spe
 		azurite-stop

 docker-system-test:  ## Run system tests in docker container (add TEST=t04_mirror or TEST=UpdateMirror26Test to run only specific tests)
-	@$(DOCKER_RUN) -t aptly-dev /work/src/system/docker-wrapper \
+	@docker run -it --rm -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper \
 		azurite-start \
 		AZURE_STORAGE_ENDPOINT=http://127.0.0.1:10000/devstoreaccount1 \
 		AZURE_STORAGE_ACCOUNT=devstoreaccount1 \
 		AZURE_STORAGE_ACCESS_KEY="Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==" \
 		AWS_ACCESS_KEY_ID=$(AWS_ACCESS_KEY_ID) \
 		AWS_SECRET_ACCESS_KEY=$(AWS_SECRET_ACCESS_KEY) \
-		system-test TEST=$(TEST) CAPTURE=$(CAPTURE) COVERAGE_SKIP=$(COVERAGE_SKIP) \
+		system-test TEST=$(TEST) \
 		azurite-stop

 docker-serve:  ## Run development server (auto recompiling) on http://localhost:3142
-	@$(DOCKER_RUN) -it -p 3142:3142 -v /tmp/cache-go-aptly:/var/lib/aptly/.cache/go-build aptly-dev /work/src/system/docker-wrapper serve || true
+	@docker run -it --rm -p 3142:3142 -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper serve || true

 docker-lint:  ## Run golangci-lint in docker container
-	@$(DOCKER_RUN) -t aptly-dev /work/src/system/docker-wrapper lint
+	@docker run -it --rm -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper lint

 docker-binaries:  ## Build binary releases (FreeBSD, macOS, Linux generic) in docker container
-	@$(DOCKER_RUN) -t aptly-dev /work/src/system/docker-wrapper binaries
+	@docker run -it --rm -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper binaries

 docker-man:  ## Create man page in docker container
-	@$(DOCKER_RUN) -t aptly-dev /work/src/system/docker-wrapper man
+	@docker run -it --rm -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper man

 mem.png: mem.dat mem.gp
 	gnuplot mem.gp
@@ -241,4 +226,4 @@ clean:  ## remove local build and module cache
 	rm -f unit.out aptly.test VERSION docs/docs.go docs/swagger.json docs/swagger.yaml docs/swagger.conf
 	find system/ -type d -name __pycache__ -exec rm -rf {} \; 2>/dev/null || true

-.PHONY: help man prepare swagger version binaries build docker-release docker-system-tests docker-unit-test docker-lint docker-build docker-image docker-man docker-shell docker-serve clean releasetype dpkg serve flake8
+.PHONY: help man prepare swagger version binaries build docker-release docker-system-test docker-unit-test docker-lint docker-build docker-image docker-man docker-shell docker-serve clean releasetype dpkg serve flake8
@@ -63,7 +63,7 @@ Define Release APT sources in ``/etc/apt/sources.list.d/aptly.list``::

    deb [signed-by=/etc/apt/keyrings/aptly.asc] http://repo.aptly.info/release DIST main

-Where DIST is one of: ``bullseye``, ``bookworm``, ``trixie``, ``focal``, ``jammy``, ``noble``
+Where DIST is one of: ``buster``, ``bullseye``, ``bookworm``, ``focal``, ``jammy``, ``noble``

 Install aptly packages::

@@ -80,7 +80,7 @@ Define CI APT sources in ``/etc/apt/sources.list.d/aptly-ci.list``::

    deb [signed-by=/etc/apt/keyrings/aptly.asc] http://repo.aptly.info/ci DIST main

-Where DIST is one of: ``bullseye``, ``bookworm``, ``trixie``, ``focal``, ``jammy``, ``noble``
+Where DIST is one of: ``buster``, ``bullseye``, ``bookworm``, ``focal``, ``jammy``, ``noble``

 Note: same gpg key is used as for the Upstream Debian Packages.

@@ -111,8 +111,10 @@ With configuration management systems:

 -   `Chef cookbook <https://github.com/hw-cookbooks/aptly>`_ by Aaron Baer
    (Heavy Water Operations, LLC)
-   `Puppet module <https://github.com/voxpupuli/puppet-aptly>`_ by
-    Vox Pupuli
+-   `Puppet module <https://github.com/alphagov/puppet-aptly>`_ by
+    Government Digital Services
+-   `Puppet module <https://github.com/tubemogul/puppet-aptly>`_ by
+    TubeMogul
 -   `SaltStack Formula <https://github.com/saltstack-formulas/aptly-formula>`_ by
    Forrest Alvarez and Brian Jackson
 -   `Ansible role <https://github.com/aioue/ansible-role-aptly>`_ by Tom Paine
@@ -13,6 +13,5 @@ git push origin v$version master
 - run swagger locally (`make docker-serve`)
 - copy generated docs/swagger.json to https://github.com/aptly-dev/www.aptly.info/tree/master/static/swagger/aptly_1.x.y.json
 - add new version to select tag in content/doc/api/swagger.md line 48
- update version in content/download.md
 - push commit to master
 - create release announcement on https://github.com/aptly-dev/aptly/discussions
@@ -70,7 +70,7 @@ func apiReady(isReady *atomic.Value) func(*gin.Context) {
 			return
 		}

-		status := aptlyStatus{Status: "Aptly is ready"}
+                status := aptlyStatus{Status: "Aptly is ready"}
 		c.JSON(200, status)
 	}
 }
@@ -178,7 +178,7 @@ func truthy(value interface{}) bool {
 	if value == nil {
 		return false
 	}
-	switch v := value.(type) {
+        switch v := value.(type) {
 	case string:
 		switch strings.ToLower(v) {
 		case "n", "no", "f", "false", "0", "off":
@@ -13,10 +13,6 @@ import (
 	"github.com/saracen/walker"
 )

-// syncFile is a seam to allow tests to force fsync failures (e.g. ENOSPC).
-// In production it calls (*os.File).Sync().
-var syncFile = func(f *os.File) error { return f.Sync() }
-
 func verifyPath(path string) bool {
 	path = filepath.Clean(path)
 	for _, part := range strings.Split(path, string(filepath.Separator)) {
@@ -118,69 +114,34 @@ func apiFilesUpload(c *gin.Context) {
 	}

 	stored := []string{}
-	openFiles := []*os.File{}

-	// Write all files first
 	for _, files := range c.Request.MultipartForm.File {
 		for _, file := range files {
 			src, err := file.Open()
 			if err != nil {
-				// Close any files we've opened
-				for _, f := range openFiles {
-					_ = f.Close()
-				}
 				AbortWithJSONError(c, 500, err)
 				return
 			}
+			defer func() { _ = src.Close() }()

 			destPath := filepath.Join(path, filepath.Base(file.Filename))
 			dst, err := os.Create(destPath)
 			if err != nil {
-				_ = src.Close()
-				// Close any files we've opened
-				for _, f := range openFiles {
-					_ = f.Close()
-				}
 				AbortWithJSONError(c, 500, err)
 				return
 			}
+			defer func() { _ = dst.Close() }()

 			_, err = io.Copy(dst, src)
-			_ = src.Close()
 			if err != nil {
-				_ = dst.Close()
-				// Close any files we've opened
-				for _, f := range openFiles {
-					_ = f.Close()
-				}
 				AbortWithJSONError(c, 500, err)
 				return
 			}

-			// Keep file open for batch sync
-			openFiles = append(openFiles, dst)
 			stored = append(stored, filepath.Join(c.Params.ByName("dir"), filepath.Base(file.Filename)))
 		}
 	}

-	// Sync all files at once to catch ENOSPC errors
-	for i, dst := range openFiles {
-		err := syncFile(dst)
-		if err != nil {
-			// Close all files
-			for _, f := range openFiles {
-				_ = f.Close()
-			}
-			AbortWithJSONError(c, 500, fmt.Errorf("error syncing file %s: %s", stored[i], err))
-			return
-		}
-	}
-
-	// Close all files
-	for _, dst := range openFiles {
-		_ = dst.Close()
-	}
-
 	apiFilesUploadedCounter.WithLabelValues(c.Params.ByName("dir")).Inc()
 	c.JSON(200, stored)
 }
@@ -1,476 +0,0 @@
-package api
-
-import (
-	"bytes"
-	"encoding/json"
-	"io"
-	"mime/multipart"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-
-	"github.com/aptly-dev/aptly/aptly"
-	ctx "github.com/aptly-dev/aptly/context"
-	"github.com/gin-gonic/gin"
-	"github.com/smira/flag"
-
-	. "gopkg.in/check.v1"
-)
-
-type FilesUploadDiskFullSuite struct {
-	aptlyContext *ctx.AptlyContext
-	flags        *flag.FlagSet
-	configFile   *os.File
-	router       http.Handler
-}
-
-var _ = Suite(&FilesUploadDiskFullSuite{})
-
-func (s *FilesUploadDiskFullSuite) SetUpTest(c *C) {
-	aptly.Version = "testVersion"
-
-	file, err := os.CreateTemp("", "aptly")
-	c.Assert(err, IsNil)
-	s.configFile = file
-
-	jsonString, err := json.Marshal(gin.H{
-		"architectures": []string{},
-		"rootDir":       c.MkDir(),
-	})
-	c.Assert(err, IsNil)
-	_, err = file.Write(jsonString)
-	c.Assert(err, IsNil)
-	_ = file.Close()
-
-	flags := flag.NewFlagSet("fakeFlags", flag.ContinueOnError)
-	flags.Bool("no-lock", false, "dummy")
-	flags.Int("db-open-attempts", 3, "dummy")
-	flags.String("config", s.configFile.Name(), "dummy")
-	flags.String("architectures", "", "dummy")
-	s.flags = flags
-
-	aptlyContext, err := ctx.NewContext(s.flags)
-	c.Assert(err, IsNil)
-
-	s.aptlyContext = aptlyContext
-	s.router = Router(aptlyContext)
-	context = aptlyContext
-}
-
-func (s *FilesUploadDiskFullSuite) TearDownTest(c *C) {
-	if s.configFile != nil {
-		_ = os.Remove(s.configFile.Name())
-	}
-	if s.aptlyContext != nil {
-		s.aptlyContext.Shutdown()
-	}
-}
-
-func (s *FilesUploadDiskFullSuite) TestUploadSuccessWithSync(c *C) {
-	testContent := []byte("test file content for upload")
-
-	body := &bytes.Buffer{}
-	writer := multipart.NewWriter(body)
-
-	part, err := writer.CreateFormFile("file", "testfile.txt")
-	c.Assert(err, IsNil)
-
-	_, err = part.Write(testContent)
-	c.Assert(err, IsNil)
-
-	err = writer.Close()
-	c.Assert(err, IsNil)
-
-	req, err := http.NewRequest("POST", "/api/files/testdir", body)
-	c.Assert(err, IsNil)
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-	c.Assert(w.Code, Equals, 200)
-
-	uploadedFile := filepath.Join(s.aptlyContext.Config().GetRootDir(), "upload", "testdir", "testfile.txt")
-	content, err := os.ReadFile(uploadedFile)
-	c.Assert(err, IsNil)
-	c.Check(content, DeepEquals, testContent)
-}
-
-func (s *FilesUploadDiskFullSuite) TestUploadVerifiesFileIntegrity(c *C) {
-	testContent := bytes.Repeat([]byte("A"), 10000)
-
-	body := &bytes.Buffer{}
-	writer := multipart.NewWriter(body)
-
-	part, err := writer.CreateFormFile("file", "largefile.bin")
-	c.Assert(err, IsNil)
-
-	_, err = io.Copy(part, bytes.NewReader(testContent))
-	c.Assert(err, IsNil)
-
-	err = writer.Close()
-	c.Assert(err, IsNil)
-
-	req, err := http.NewRequest("POST", "/api/files/testdir2", body)
-	c.Assert(err, IsNil)
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-
-	c.Assert(w.Code, Equals, 200)
-
-	uploadedFile := filepath.Join(s.aptlyContext.Config().GetRootDir(), "upload", "testdir2", "largefile.bin")
-	content, err := os.ReadFile(uploadedFile)
-	c.Assert(err, IsNil)
-	c.Check(len(content), Equals, len(testContent))
-	c.Check(content, DeepEquals, testContent)
-}
-
-func (s *FilesUploadDiskFullSuite) TestUploadMultipleFilesWithBatchSync(c *C) {
-	testFiles := map[string][]byte{
-		"file1.txt": []byte("content of file 1"),
-		"file2.txt": bytes.Repeat([]byte("B"), 5000),
-		"file3.deb": []byte("debian package content"),
-	}
-
-	body := &bytes.Buffer{}
-	writer := multipart.NewWriter(body)
-
-	for filename, content := range testFiles {
-		part, err := writer.CreateFormFile("file", filename)
-		c.Assert(err, IsNil)
-		_, err = part.Write(content)
-		c.Assert(err, IsNil)
-	}
-
-	err := writer.Close()
-	c.Assert(err, IsNil)
-
-	req, err := http.NewRequest("POST", "/api/files/multitest", body)
-	c.Assert(err, IsNil)
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-
-	c.Assert(w.Code, Equals, 200)
-
-	uploadDir := filepath.Join(s.aptlyContext.Config().GetRootDir(), "upload", "multitest")
-	for filename, expectedContent := range testFiles {
-		uploadedFile := filepath.Join(uploadDir, filename)
-		content, err := os.ReadFile(uploadedFile)
-		c.Assert(err, IsNil, Commentf("Failed to read %s", filename))
-		c.Check(content, DeepEquals, expectedContent, Commentf("Content mismatch for %s", filename))
-	}
-}
-
-func (s *FilesUploadDiskFullSuite) TestUploadReturnsErrorOnSyncFailure(c *C) {
-	oldSyncFile := syncFile
-	syncFile = func(f *os.File) error {
-		if filepath.Base(f.Name()) == "syncfail.txt" {
-			return syscall.ENOSPC
-		}
-		return nil
-	}
-	defer func() { syncFile = oldSyncFile }()
-
-	body := &bytes.Buffer{}
-	writer := multipart.NewWriter(body)
-
-	part1, err := writer.CreateFormFile("file", "ok.txt")
-	c.Assert(err, IsNil)
-	_, err = part1.Write([]byte("ok"))
-	c.Assert(err, IsNil)
-
-	part2, err := writer.CreateFormFile("file", "syncfail.txt")
-	c.Assert(err, IsNil)
-	_, err = part2.Write([]byte("will fail on sync"))
-	c.Assert(err, IsNil)
-
-	err = writer.Close()
-	c.Assert(err, IsNil)
-
-	req, err := http.NewRequest("POST", "/api/files/syncfaildir", body)
-	c.Assert(err, IsNil)
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-
-	c.Assert(w.Code, Equals, 500)
-	c.Check(bytes.Contains(w.Body.Bytes(), []byte("error syncing file")), Equals, true)
-}
-
-func (s *FilesUploadDiskFullSuite) TestVerifyPath(c *C) {
-	c.Check(verifyPath("a/b/c"), Equals, true)
-	c.Check(verifyPath("../x"), Equals, false)
-	c.Check(verifyPath("./x"), Equals, true)
-	c.Check(verifyPath(".."), Equals, false)
-	c.Check(verifyPath("."), Equals, false)
-}
-
-func (s *FilesUploadDiskFullSuite) TestListDirsEmptyWhenUploadMissing(c *C) {
-	_ = os.RemoveAll(s.aptlyContext.UploadPath())
-
-	req, err := http.NewRequest("GET", "/api/files", nil)
-	c.Assert(err, IsNil)
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-
-	c.Assert(w.Code, Equals, 200)
-	c.Check(strings.TrimSpace(w.Body.String()), Equals, "[]")
-}
-
-func (s *FilesUploadDiskFullSuite) TestListDirsReturnsDirectories(c *C) {
-	uploadRoot := s.aptlyContext.UploadPath()
-	c.Assert(os.MkdirAll(filepath.Join(uploadRoot, "d1"), 0777), IsNil)
-	c.Assert(os.MkdirAll(filepath.Join(uploadRoot, "d2"), 0777), IsNil)
-	c.Assert(os.WriteFile(filepath.Join(uploadRoot, "rootfile"), []byte("x"), 0644), IsNil)
-
-	req, err := http.NewRequest("GET", "/api/files", nil)
-	c.Assert(err, IsNil)
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-
-	c.Assert(w.Code, Equals, 200)
-	body := w.Body.String()
-	c.Check(strings.Contains(body, "d1"), Equals, true)
-	c.Check(strings.Contains(body, "d2"), Equals, true)
-}
-
-func (s *FilesUploadDiskFullSuite) TestListFilesNotFound(c *C) {
-	req, err := http.NewRequest("GET", "/api/files/does-not-exist", nil)
-	c.Assert(err, IsNil)
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-	c.Assert(w.Code, Equals, 404)
-}
-
-func (s *FilesUploadDiskFullSuite) TestListFilesReturnsFiles(c *C) {
-	base := filepath.Join(s.aptlyContext.UploadPath(), "dir")
-	c.Assert(os.MkdirAll(base, 0777), IsNil)
-	c.Assert(os.WriteFile(filepath.Join(base, "a.txt"), []byte("a"), 0644), IsNil)
-	c.Assert(os.WriteFile(filepath.Join(base, "b.txt"), []byte("b"), 0644), IsNil)
-
-	req, err := http.NewRequest("GET", "/api/files/dir", nil)
-	c.Assert(err, IsNil)
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-
-	c.Assert(w.Code, Equals, 200)
-	body := w.Body.String()
-	c.Check(strings.Contains(body, "a.txt"), Equals, true)
-	c.Check(strings.Contains(body, "b.txt"), Equals, true)
-}
-
-func (s *FilesUploadDiskFullSuite) TestDeleteDirRemovesDirectory(c *C) {
-	base := filepath.Join(s.aptlyContext.UploadPath(), "todel")
-	c.Assert(os.MkdirAll(base, 0777), IsNil)
-	c.Assert(os.WriteFile(filepath.Join(base, "a.txt"), []byte("a"), 0644), IsNil)
-
-	req, err := http.NewRequest("DELETE", "/api/files/todel", nil)
-	c.Assert(err, IsNil)
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-	c.Assert(w.Code, Equals, 200)
-
-	_, statErr := os.Stat(base)
-	c.Check(os.IsNotExist(statErr), Equals, true)
-}
-
-func (s *FilesUploadDiskFullSuite) TestDeleteFileRemovesFile(c *C) {
-	base := filepath.Join(s.aptlyContext.UploadPath(), "todel2")
-	c.Assert(os.MkdirAll(base, 0777), IsNil)
-	c.Assert(os.WriteFile(filepath.Join(base, "a.txt"), []byte("a"), 0644), IsNil)
-
-	req, err := http.NewRequest("DELETE", "/api/files/todel2/a.txt", nil)
-	c.Assert(err, IsNil)
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-	c.Assert(w.Code, Equals, 200)
-
-	_, statErr := os.Stat(filepath.Join(base, "a.txt"))
-	c.Check(os.IsNotExist(statErr), Equals, true)
-}
-
-func (s *FilesUploadDiskFullSuite) TestDeleteFileNotFoundStillOk(c *C) {
-	base := filepath.Join(s.aptlyContext.UploadPath(), "todel3")
-	c.Assert(os.MkdirAll(base, 0777), IsNil)
-
-	req, err := http.NewRequest("DELETE", "/api/files/todel3/nope.txt", nil)
-	c.Assert(err, IsNil)
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-	c.Assert(w.Code, Equals, 200)
-}
-
-func (s *FilesUploadDiskFullSuite) TestRejectsInvalidDir(c *C) {
-	req, err := http.NewRequest("DELETE", "/api/files/..", nil)
-	c.Assert(err, IsNil)
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-	c.Assert(w.Code, Equals, 400)
-}
-
-func (s *FilesUploadDiskFullSuite) TestRejectsInvalidFileName(c *C) {
-	base := filepath.Join(s.aptlyContext.UploadPath(), "dirx")
-	c.Assert(os.MkdirAll(base, 0777), IsNil)
-
-	req, err := http.NewRequest("DELETE", "/api/files/dirx/..", nil)
-	c.Assert(err, IsNil)
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-	c.Assert(w.Code, Equals, 400)
-}
-
-func (s *FilesUploadDiskFullSuite) TestListDirsEmptyIfUploadPathIsNotDir(c *C) {
-	_ = os.RemoveAll(s.aptlyContext.UploadPath())
-	c.Assert(os.WriteFile(s.aptlyContext.UploadPath(), []byte("not a dir"), 0644), IsNil)
-
-	req, err := http.NewRequest("GET", "/api/files", nil)
-	c.Assert(err, IsNil)
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-
-	c.Assert(w.Code, Equals, 200)
-	c.Check(strings.TrimSpace(w.Body.String()), Equals, "[]")
-}
-
-func (s *FilesUploadDiskFullSuite) TestListFilesReturns500OnPermissionError(c *C) {
-	base := filepath.Join(s.aptlyContext.UploadPath(), "noperms")
-	c.Assert(os.MkdirAll(base, 0777), IsNil)
-	c.Assert(os.WriteFile(filepath.Join(base, "a.txt"), []byte("a"), 0644), IsNil)
-	c.Assert(os.Chmod(base, 0), IsNil)
-	defer func() { _ = os.Chmod(base, 0777) }()
-
-	req, err := http.NewRequest("GET", "/api/files/noperms", nil)
-	c.Assert(err, IsNil)
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-
-	c.Assert(w.Code, Equals, 500)
-}
-
-func (s *FilesUploadDiskFullSuite) TestDeleteFileReturns500OnNonNotExistError(c *C) {
-	base := filepath.Join(s.aptlyContext.UploadPath(), "dirisfile")
-	c.Assert(os.MkdirAll(base, 0777), IsNil)
-	subdir := filepath.Join(base, "subdir")
-	c.Assert(os.MkdirAll(subdir, 0777), IsNil)
-	c.Assert(os.WriteFile(filepath.Join(subdir, "x"), []byte("x"), 0644), IsNil)
-
-	req, err := http.NewRequest("DELETE", "/api/files/dirisfile/subdir", nil)
-	c.Assert(err, IsNil)
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-
-	c.Assert(w.Code, Equals, 500)
-}
-
-func (s *FilesUploadDiskFullSuite) TestUploadBadMultipartReturns400(c *C) {
-	req, err := http.NewRequest("POST", "/api/files/badmultipart", bytes.NewBufferString("not multipart"))
-	c.Assert(err, IsNil)
-	req.Header.Set("Content-Type", "multipart/form-data; boundary=missing")
-
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-
-	c.Assert(w.Code, Equals, 400)
-}
-
-func (s *FilesUploadDiskFullSuite) TestUploadRejectsInvalidDir(c *C) {
-	body := &bytes.Buffer{}
-	writer := multipart.NewWriter(body)
-	part, err := writer.CreateFormFile("file", "a.txt")
-	c.Assert(err, IsNil)
-	_, err = part.Write([]byte("x"))
-	c.Assert(err, IsNil)
-	c.Assert(writer.Close(), IsNil)
-
-	req, err := http.NewRequest("POST", "/api/files/..", body)
-	c.Assert(err, IsNil)
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-	c.Assert(w.Code, Equals, 400)
-}
-
-func (s *FilesUploadDiskFullSuite) TestUploadReturns500IfUploadRootIsNotDir(c *C) {
-	_ = os.RemoveAll(s.aptlyContext.UploadPath())
-	c.Assert(os.WriteFile(s.aptlyContext.UploadPath(), []byte("not a dir"), 0644), IsNil)
-
-	body := &bytes.Buffer{}
-	writer := multipart.NewWriter(body)
-	part, err := writer.CreateFormFile("file", "a.txt")
-	c.Assert(err, IsNil)
-	_, err = part.Write([]byte("x"))
-	c.Assert(err, IsNil)
-	c.Assert(writer.Close(), IsNil)
-
-	req, err := http.NewRequest("POST", "/api/files/testdir", body)
-	c.Assert(err, IsNil)
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-	c.Assert(w.Code, Equals, 500)
-}
-
-func (s *FilesUploadDiskFullSuite) TestUploadReturns500OnFileOpenFailure(c *C) {
-	// Pre-populate MultipartForm to inject a FileHeader that fails on Open().
-	form := &multipart.Form{
-		File: map[string][]*multipart.FileHeader{
-			"file": {{Filename: "broken.bin"}},
-		},
-	}
-
-	req, err := http.NewRequest("POST", "/api/files/openfaildir", nil)
-	c.Assert(err, IsNil)
-	req.MultipartForm = form
-
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-	c.Assert(w.Code, Equals, 500)
-}
-
-func (s *FilesUploadDiskFullSuite) TestUploadReturns500OnCreateFailure(c *C) {
-	base := filepath.Join(s.aptlyContext.UploadPath(), "readonly")
-	c.Assert(os.MkdirAll(base, 0777), IsNil)
-	c.Assert(os.Chmod(base, 0555), IsNil)
-	defer func() { _ = os.Chmod(base, 0777) }()
-
-	body := &bytes.Buffer{}
-	writer := multipart.NewWriter(body)
-	part, err := writer.CreateFormFile("file", "a.txt")
-	c.Assert(err, IsNil)
-	_, err = part.Write([]byte("x"))
-	c.Assert(err, IsNil)
-	c.Assert(writer.Close(), IsNil)
-
-	req, err := http.NewRequest("POST", "/api/files/readonly", body)
-	c.Assert(err, IsNil)
-	req.Header.Set("Content-Type", writer.FormDataContentType())
-
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-	c.Assert(w.Code, Equals, 500)
-}
-
-func (s *FilesUploadDiskFullSuite) TestDeleteDirReturns500OnRemoveFailure(c *C) {
-	parent := s.aptlyContext.UploadPath()
-	base := filepath.Join(parent, "cantremove")
-	c.Assert(os.MkdirAll(base, 0777), IsNil)
-	c.Assert(os.WriteFile(filepath.Join(base, "a.txt"), []byte("a"), 0644), IsNil)
-
-	c.Assert(os.Chmod(parent, 0555), IsNil)
-	defer func() { _ = os.Chmod(parent, 0777) }()
-
-	req, err := http.NewRequest("DELETE", "/api/files/cantremove", nil)
-	c.Assert(err, IsNil)
-	w := httptest.NewRecorder()
-	s.router.ServeHTTP(w, req)
-	c.Assert(w.Code, Equals, 500)
-}
@@ -1,7 +1,6 @@
 package api

 import (
-	"bufio"
 	"fmt"
 	"os"
 	"os/exec"
@@ -13,23 +12,6 @@ import (
 	"github.com/gin-gonic/gin"
 )

-type gpgKeyInfo struct {
-	// 16-character key ID (short form)
-	KeyID string `json:"KeyID"         example:"8B48AD6246925553"`
-	// Full fingerprint
-	Fingerprint string `json:"Fingerprint"   example:"D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0"`
-	// Key validity (u=unknown, f=fulltrust, m=marginal, n=never)
-	Validity string `json:"Validity"      example:"u"`
-	// User ID(s) associated with this key
-	UserIDs []string `json:"UserIDs"       example:"John Doe <john@example.com>"`
-	// Creation date (Unix timestamp format from gpg)
-	CreatedAt string `json:"CreatedAt"     example:"2023-01-15"`
-}
-
-type gpgKeyListResponse struct {
-	Keys []gpgKeyInfo `json:"Keys"`
-}
-
 type gpgAddKeyParams struct {
 	// Keyring for adding the keys (default: trustedkeys.gpg)
 	Keyring string `json:"Keyring"         example:"trustedkeys.gpg"`
@@ -43,14 +25,6 @@ type gpgAddKeyParams struct {
 	GpgKeyID string `json:"GpgKeyID"        example:"EF0F382A1A7B6500 8B48AD6246925553"`
 }

-type gpgDeleteKeyParams struct {
-	// Keyring to delete keys from (default: trustedkeys.gpg)
-	Keyring string `json:"Keyring"         example:"trustedkeys.gpg"`
-
-	// Key ID or fingerprint to delete
-	GpgKeyID string `json:"GpgKeyID"        example:"8B48AD6246925553"`
-}
-
 // @Summary Add GPG Keys
 // @Description **Adds GPG keys to aptly keyring**
 // @Description
@@ -134,178 +108,3 @@ func apiGPGAddKey(c *gin.Context) {

 	c.JSON(200, string(out))
 }
-
-// @Summary List GPG Keys
-// @Description **Lists all GPG keys in aptly keyring**
-// @Description
-// @Description Returns all public keys currently installed in the aptly GPG keyring.
-// @Description
-// @Tags Mirrors
-// @Param keyring query string false "Keyring file to list keys from (default: trustedkeys.gpg)" example(trustedkeys.gpg)
-// @Produce json
-// @Success 200 {object} gpgKeyListResponse "OK"
-// @Failure 400 {object} Error "Bad Request"
-// @Router /api/gpg/keys [get]
-func apiGPGListKeys(c *gin.Context) {
-	keyring := c.DefaultQuery("keyring", "trustedkeys.gpg")
-	keyring = utils.SanitizePath(keyring)
-
-	finder := pgp.GPGDefaultFinder()
-	gpg, _, err := finder.FindGPG()
-	if err != nil {
-		AbortWithJSONError(c, 400, err)
-		return
-	}
-
-	args := []string{
-		"--no-default-keyring",
-		"--with-colons",
-		"--keyring", keyring,
-		"--list-keys",
-	}
-
-	cmd := exec.Command(gpg, args...)
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		AbortWithJSONError(c, 400, fmt.Errorf("failed to list keys: %s", string(out)))
-		return
-	}
-
-	keys := parseGPGOutput(string(out))
-	c.JSON(200, gpgKeyListResponse{Keys: keys})
-}
-
-// @Summary Delete GPG Key
-// @Description **Deletes a GPG key from aptly keyring**
-// @Description
-// @Description Removes a public key from the aptly GPG keyring. This is useful for removing
-// @Description compromised keys or cleaning up obsolete keys.
-// @Description
-// @Tags Mirrors
-// @Consume  json
-// @Param request body gpgDeleteKeyParams true "Parameters"
-// @Produce json
-// @Success 200 {object} string "OK"
-// @Failure 400 {object} Error "Bad Request"
-// @Router /api/gpg/key [delete]
-func apiGPGDeleteKey(c *gin.Context) {
-	b := gpgDeleteKeyParams{}
-	if c.Bind(&b) != nil {
-		AbortWithJSONError(c, 400, fmt.Errorf("invalid request body"))
-		return
-	}
-
-	if len(strings.TrimSpace(b.GpgKeyID)) == 0 {
-		AbortWithJSONError(c, 400, fmt.Errorf("GpgKeyID is required"))
-		return
-	}
-
-	b.GpgKeyID = utils.SanitizePath(b.GpgKeyID)
-	// b.Keyring can be an absolute path
-
-	finder := pgp.GPGDefaultFinder()
-	gpg, _, err := finder.FindGPG()
-	if err != nil {
-		AbortWithJSONError(c, 400, err)
-		return
-	}
-
-	args := []string{
-		"--no-default-keyring",
-		"--allow-non-selfsigned-uid",
-		"--batch",
-		"--yes",
-	}
-
-	keyring := "trustedkeys.gpg"
-	if len(b.Keyring) > 0 {
-		keyring = b.Keyring
-	}
-
-	args = append(args, "--keyring", keyring)
-	args = append(args, "--delete-keys", b.GpgKeyID)
-
-	cmd := exec.Command(gpg, args...)
-	fmt.Printf("running %s %s\n", gpg, strings.Join(args, " "))
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		AbortWithJSONError(c, 400, fmt.Errorf("failed to delete key: %s", string(out)))
-		return
-	}
-
-	c.JSON(200, string(out))
-}
-
-// parseGPGOutput parses the output of `gpg --with-colons --list-keys`
-// and returns a structured list of keys
-func parseGPGOutput(output string) []gpgKeyInfo {
-	var keys []gpgKeyInfo
-	var currentKey *gpgKeyInfo
-
-	scanner := bufio.NewScanner(strings.NewReader(output))
-	for scanner.Scan() {
-		line := scanner.Text()
-		if line == "" {
-			continue
-		}
-
-		parts := strings.Split(line, ":")
-		if len(parts) < 10 {
-			continue
-		}
-
-		recordType := parts[0]
-
-		// pub: public key record
-		if recordType == "pub" {
-			// Save previous key if it exists
-			if currentKey != nil && currentKey.KeyID != "" {
-				keys = append(keys, *currentKey)
-			}
-
-			// Create new key entry
-			// Format: pub:trust:length:algo:keyid:created:expires:uidhash:...
-			keyID := parts[4]
-			if len(keyID) >= 16 {
-				keyID = keyID[len(keyID)-16:] // Last 16 chars = short key ID
-			}
-			validity := parts[1]
-			createdAt := parts[5]
-
-			currentKey = &gpgKeyInfo{
-				KeyID:      keyID,
-				Validity:   validity,
-				CreatedAt:  createdAt,
-				UserIDs:    []string{},
-				Fingerprint: "",
-			}
-		}
-
-		// uid: user ID record
-		if recordType == "uid" && currentKey != nil {
-			// Format: uid:trust:created:expires:keyid:uidhash:uidtype:validity:userID:...
-			if len(parts) >= 10 {
-				userID := parts[9]
-				if userID != "" {
-					currentKey.UserIDs = append(currentKey.UserIDs, userID)
-				}
-			}
-		}
-
-		// fpr: fingerprint record
-		if recordType == "fpr" && currentKey != nil {
-			// Format: fpr:::::::::fingerprint:
-			if len(parts) >= 10 {
-				fingerprint := parts[9]
-				currentKey.Fingerprint = fingerprint
-			}
-		}
-	}
-
-	// Don't forget the last key
-	if currentKey != nil && currentKey.KeyID != "" {
-		keys = append(keys, *currentKey)
-	}
-
-	return keys
-}
@@ -1,451 +0,0 @@
-package api
-
-import (
-	"bytes"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-
-	. "gopkg.in/check.v1"
-)
-
-type GPGSuite struct {
-	APISuite
-}
-
-var _ = Suite(&GPGSuite{})
-
-func (s *GPGSuite) withFakeGPG(c *C, scriptBody string, test func(scriptPath string)) {
-	tempDir, err := os.MkdirTemp("", "aptly-fake-gpg")
-	c.Assert(err, IsNil)
-	defer func() { _ = os.RemoveAll(tempDir) }()
-
-	scriptPath := filepath.Join(tempDir, "gpg")
-	err = os.WriteFile(scriptPath, []byte(scriptBody), 0o755)
-	c.Assert(err, IsNil)
-
-	oldPath := os.Getenv("PATH")
-	err = os.Setenv("PATH", tempDir+string(os.PathListSeparator)+oldPath)
-	c.Assert(err, IsNil)
-	defer func() { _ = os.Setenv("PATH", oldPath) }()
-
-	test(scriptPath)
-}
-
-func (s *GPGSuite) fakeGPGScript(c *C, listOutput string, deleteOutput string, deleteError string) string {
-	return "#!/bin/sh\n" +
-		"if [ \"$1\" = \"--version\" ]; then\n" +
-		"  echo 'gpg (GnuPG) 2.2.27'\n" +
-		"  exit 0\n" +
-		"fi\n" +
-		"args=\"$*\"\n" +
-		"if printf '%s' \"$args\" | grep -q -- '--list-keys'; then\n" +
-		"  cat <<'EOF'\n" + listOutput + "\nEOF\n" +
-		"  exit 0\n" +
-		"fi\n" +
-		"if printf '%s' \"$args\" | grep -q -- '--delete-keys'; then\n" +
-		"  if [ -n \"" + strings.ReplaceAll(deleteError, "\n", "") + "\" ]; then\n" +
-		"    echo '" + strings.ReplaceAll(deleteError, "'", "'\\''") + "'\n" +
-		"    exit 1\n" +
-		"  fi\n" +
-		"  cat <<'EOF'\n" + deleteOutput + "\nEOF\n" +
-		"  exit 0\n" +
-		"fi\n" +
-		"echo 'unexpected invocation' >&2\n" +
-		"exit 1\n"
-}
-
-// TestParseGPGOutputEmpty tests parsing of empty GPG output
-func (s *GPGSuite) TestParseGPGOutputEmpty(c *C) {
-	output := ""
-	keys := parseGPGOutput(output)
-	c.Check(keys, HasLen, 0)
-}
-
-// TestParseGPGOutputSingleKeyMinimal tests parsing a single key with minimal fields
-func (s *GPGSuite) TestParseGPGOutputSingleKeyMinimal(c *C) {
-	// Minimal valid GPG output with one key
-	output := `pub:u:4096:1:8B48AD6246925553:1611864000:1643400000:uidhash:::scESC:::::::23::0:
-uid:u::::1611864000::1234567890::John Doe <john@example.com>::::::::::0:
-fpr:::::::::D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0:`
-
-	keys := parseGPGOutput(output)
-	c.Check(keys, HasLen, 1)
-
-	key := keys[0]
-	c.Check(key.KeyID, Equals, "8B48AD6246925553")
-	c.Check(key.Validity, Equals, "u")
-	c.Check(key.CreatedAt, Equals, "1611864000")
-	c.Check(key.Fingerprint, Equals, "D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0")
-	c.Check(key.UserIDs, DeepEquals, []string{"John Doe <john@example.com>"})
-}
-
-// TestParseGPGOutputMultipleKeys tests parsing multiple keys
-func (s *GPGSuite) TestParseGPGOutputMultipleKeys(c *C) {
-	output := `pub:u:4096:1:8B48AD6246925553:1611864000:1643400000:uidhash:::scESC:::::::23::0:
-uid:u::::1611864000::1234567890::John Doe <john@example.com>::::::::::0:
-fpr:::::::::D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0:
-pub:f:2048:1:A1B2C3D4E5F67890:1580592000:1612128000:uidhash:::scESC:::::::23::0:
-uid:f::::1580592000::0987654321::Jane Smith <jane@example.com>::::::::::0:
-fpr:::::::::E9F0A1B2C3D4E5F6A7B8C9D0E1F2A3B4:`
-
-	keys := parseGPGOutput(output)
-	c.Check(keys, HasLen, 2)
-
-	// First key
-	c.Check(keys[0].KeyID, Equals, "8B48AD6246925553")
-	c.Check(keys[0].Validity, Equals, "u")
-	c.Check(keys[0].UserIDs, DeepEquals, []string{"John Doe <john@example.com>"})
-
-	// Second key
-	c.Check(keys[1].KeyID, Equals, "A1B2C3D4E5F67890")
-	c.Check(keys[1].Validity, Equals, "f")
-	c.Check(keys[1].UserIDs, DeepEquals, []string{"Jane Smith <jane@example.com>"})
-}
-
-// TestParseGPGOutputMultipleUIDs tests a key with multiple user IDs
-func (s *GPGSuite) TestParseGPGOutputMultipleUIDs(c *C) {
-	output := `pub:u:4096:1:8B48AD6246925553:1611864000:1643400000:uidhash:::scESC:::::::23::0:
-uid:u::::1611864000::1234567890::John Doe <john@example.com>::::::::::0:
-uid:u::::1611864000::1234567891::John Doe <john.doe@company.com>::::::::::0:
-fpr:::::::::D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0:`
-
-	keys := parseGPGOutput(output)
-	c.Check(keys, HasLen, 1)
-
-	key := keys[0]
-	c.Check(key.UserIDs, HasLen, 2)
-	c.Check(key.UserIDs, DeepEquals, []string{
-		"John Doe <john@example.com>",
-		"John Doe <john.doe@company.com>",
-	})
-}
-
-// TestParseGPGOutputMalformedLines tests that malformed lines are skipped
-func (s *GPGSuite) TestParseGPGOutputMalformedLines(c *C) {
-	// Mix of valid and invalid lines (too few fields)
-	output := `pub:u:4096:1:8B48AD6246925553:1611864000:1643400000:uidhash:::scESC:::::::23::0:
-invalid:line:with:only:three:fields
-uid:u::::1611864000::1234567890::John Doe <john@example.com>::::::::::0:
-fpr:::::::::D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0:`
-
-	keys := parseGPGOutput(output)
-	c.Check(keys, HasLen, 1)
-	c.Check(keys[0].KeyID, Equals, "8B48AD6246925553")
-}
-
-// TestParseGPGOutputEmptyLines tests that empty lines are skipped
-func (s *GPGSuite) TestParseGPGOutputEmptyLines(c *C) {
-	output := `pub:u:4096:1:8B48AD6246925553:1611864000:1643400000:uidhash:::scESC:::::::23::0:
-
-uid:u::::1611864000::1234567890::John Doe <john@example.com>::::::::::0:
-
-fpr:::::::::D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0:`
-
-	keys := parseGPGOutput(output)
-	c.Check(keys, HasLen, 1)
-	c.Check(keys[0].KeyID, Equals, "8B48AD6246925553")
-}
-
-// TestParseGPGOutputKeyWithoutUID tests a public key without user ID
-func (s *GPGSuite) TestParseGPGOutputKeyWithoutUID(c *C) {
-	// Key without uid record (should still be included)
-	output := `pub:u:4096:1:8B48AD6246925553:1611864000:1643400000:uidhash:::scESC:::::::23::0:
-fpr:::::::::D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0:`
-
-	keys := parseGPGOutput(output)
-	c.Check(keys, HasLen, 1)
-
-	key := keys[0]
-	c.Check(key.KeyID, Equals, "8B48AD6246925553")
-	c.Check(key.UserIDs, HasLen, 0)
-	c.Check(key.Fingerprint, Equals, "D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0")
-}
-
-// TestParseGPGOutputVariousValidity tests different validity values
-func (s *GPGSuite) TestParseGPGOutputVariousValidity(c *C) {
-	output := `pub:u:4096:1:KEY1111111111111:1611864000:1643400000:uidhash:::scESC:::::::23::0:
-uid:u::::1611864000::1234567890::Key1::::::::::0:
-fpr:::::::::1111111111111111111111111111111111111111:
-pub:f:4096:1:KEY2222222222222:1611864000:1643400000:uidhash:::scESC:::::::23::0:
-uid:f::::1611864000::1234567891::Key2::::::::::0:
-fpr:::::::::2222222222222222222222222222222222222222:
-pub:m:4096:1:KEY3333333333333:1611864000:1643400000:uidhash:::scESC:::::::23::0:
-uid:m::::1611864000::1234567892::Key3::::::::::0:
-fpr:::::::::3333333333333333333333333333333333333333:
-pub:n:4096:1:KEY4444444444444:1611864000:1643400000:uidhash:::scESC:::::::23::0:
-uid:n::::1611864000::1234567893::Key4::::::::::0:
-fpr:::::::::4444444444444444444444444444444444444444:`
-
-	keys := parseGPGOutput(output)
-	c.Check(keys, HasLen, 4)
-
-	validities := []string{"u", "f", "m", "n"}
-	for i, validity := range validities {
-		c.Check(keys[i].Validity, Equals, validity)
-	}
-}
-
-// TestParseGPGOutputShortKeyID tests that key IDs are shortened to 16 chars
-func (s *GPGSuite) TestParseGPGOutputShortKeyID(c *C) {
-	// 40-character key ID that should be shortened to last 16 chars
-	longKeyID := "0123456789ABCDEF0123456789ABCDEF8B48AD62"
-	output := `pub:u:4096:1:` + longKeyID + `:1611864000:1643400000:uidhash:::scESC:::::::23::0:
-uid:u::::1611864000::1234567890::John Doe <john@example.com>::::::::::0:
-fpr:::::::::D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0:`
-
-	keys := parseGPGOutput(output)
-	c.Check(keys, HasLen, 1)
-	// Should extract the last 16 characters: 89ABCDEF8B48AD62
-	c.Check(keys[0].KeyID, Equals, "89ABCDEF8B48AD62")
-}
-
-// TestParseGPGOutputSpecialCharactersInUID tests user IDs with special characters
-func (s *GPGSuite) TestParseGPGOutputSpecialCharactersInUID(c *C) {
-	// UID with Unicode characters and special formatting
-	output := `pub:u:4096:1:8B48AD6246925553:1611864000:1643400000:uidhash:::scESC:::::::23::0:
-uid:u::::1611864000::1234567890::J\xc3\xb6hn D\xc3\xb6\xc3\xa9 (D\xc3\xbcss) <john@example.com>::::::::::0:
-fpr:::::::::D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0:`
-
-	keys := parseGPGOutput(output)
-	c.Check(keys, HasLen, 1)
-	// Should preserve the encoded special characters
-	c.Check(keys[0].UserIDs, HasLen, 1)
-}
-
-// TestAPIGPGListKeysDefaultKeyring tests the HTTP endpoint with default keyring
-func (s *GPGSuite) TestAPIGPGListKeysDefaultKeyring(c *C) {
-	s.withFakeGPG(c, s.fakeGPGScript(c, `pub:u:4096:1:8B48AD6246925553:1611864000:::::
-uid:u::::1611864000::1234567890::John Doe <john@example.com>::::::::::0:
-fpr:::::::::D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0:`, "", ""), func(_ string) {
-		response, err := s.HTTPRequest("GET", "/api/gpg/keys", nil)
-		c.Assert(err, IsNil)
-		c.Check(response.Code, Equals, 200)
-
-		var result gpgKeyListResponse
-		err = json.NewDecoder(response.Body).Decode(&result)
-		c.Assert(err, IsNil)
-		c.Check(result.Keys, HasLen, 1)
-		c.Check(result.Keys[0].KeyID, Equals, "8B48AD6246925553")
-	})
-}
-
-// TestAPIGPGListKeysWithKeyringParam tests the HTTP endpoint with custom keyring parameter
-func (s *GPGSuite) TestAPIGPGListKeysWithKeyringParam(c *C) {
-	argFile, err := os.CreateTemp("", "aptly-gpg-args")
-	c.Assert(err, IsNil)
-	_ = argFile.Close()
-	defer func() { _ = os.Remove(argFile.Name()) }()
-
-	script := "#!/bin/sh\n" +
-		"if [ \"$1\" = \"--version\" ]; then echo 'gpg (GnuPG) 2.2.27'; exit 0; fi\n" +
-		"printf '%s\n' \"$@\" > '" + argFile.Name() + "'\n" +
-		"if printf '%s' \"$*\" | grep -q -- '--list-keys'; then\n" +
-		"cat <<'EOF'\n" +
-		"pub:u:4096:1:8B48AD6246925553:1611864000:::::\n" +
-		"fpr:::::::::D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0:\n" +
-		"EOF\n" +
-		"exit 0\n" +
-		"fi\n" +
-		"exit 1\n"
-
-	s.withFakeGPG(c, script, func(_ string) {
-		response, reqErr := s.HTTPRequest("GET", "/api/gpg/keys?keyring=/custom.gpg", nil)
-		c.Assert(reqErr, IsNil)
-		c.Check(response.Code, Equals, 200)
-
-		argBytes, readErr := os.ReadFile(argFile.Name())
-		c.Assert(readErr, IsNil)
-		c.Check(string(argBytes), Matches, `(?s).*--keyring\ncustom\.gpg\n.*`)
-	})
-}
-
-// TestAPIGPGListKeysResponseFormat tests that the response has the correct structure
-func (s *GPGSuite) TestAPIGPGListKeysResponseFormat(c *C) {
-	s.withFakeGPG(c, s.fakeGPGScript(c, `pub:f:4096:1:A1B2C3D4E5F67890:1611864000:::::
-uid:f::::1611864000::1234567890::Jane Smith <jane@example.com>::::::::::0:
-fpr:::::::::E9F0A1B2C3D4E5F6A7B8C9D0E1F2A3B4:`, "", ""), func(_ string) {
-		response, err := s.HTTPRequest("GET", "/api/gpg/keys", nil)
-		c.Assert(err, IsNil)
-		c.Check(response.Code, Equals, 200)
-
-		var result gpgKeyListResponse
-		err = json.NewDecoder(response.Body).Decode(&result)
-		c.Assert(err, IsNil)
-		c.Assert(result.Keys, HasLen, 1)
-		c.Check(result.Keys[0].KeyID, Equals, "A1B2C3D4E5F67890")
-		c.Check(result.Keys[0].Validity, Equals, "f")
-		c.Check(result.Keys[0].CreatedAt, Equals, "1611864000")
-	})
-}
-
-// TestParseGPGOutputEdgeCaseUIDWithoutFields tests UID record with missing fields
-func (s *GPGSuite) TestParseGPGOutputEdgeCaseUIDWithoutFields(c *C) {
-	// UID record with fewer than 10 fields
-	output := `pub:u:4096:1:8B48AD6246925553:1611864000:1643400000:uidhash:::scESC:::::::23::0:
-uid:u::::1611864000::1234567890:
-fpr:::::::::D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0:`
-
-	keys := parseGPGOutput(output)
-	c.Check(keys, HasLen, 1)
-	// Should not have user ID since it's in field 9 and this record is too short
-	c.Check(keys[0].UserIDs, HasLen, 0)
-}
-
-// TestParseGPGOutputFingerprintWithoutCurrentKey tests FPR record appearing before any PUB
-func (s *GPGSuite) TestParseGPGOutputFingerprintWithoutCurrentKey(c *C) {
-	// FPR record without a preceding PUB (should be ignored)
-	output := `fpr:::::::::D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0:
-pub:u:4096:1:8B48AD6246925553:1611864000:1643400000:uidhash:::scESC:::::::23::0:
-uid:u::::1611864000::1234567890::John Doe <john@example.com>::::::::::0:
-fpr:::::::::D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0:`
-
-	keys := parseGPGOutput(output)
-	c.Check(keys, HasLen, 1)
-	// Should only have one key with the correct fingerprint
-	c.Check(keys[0].Fingerprint, Equals, "D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0")
-}
-
-// TestParseGPGOutputComplexRealWorldExample tests real-world-like GPG output
-func (s *GPGSuite) TestParseGPGOutputComplexRealWorldExample(c *C) {
-	// Real-world GPG output with multiple keys, UIDs, and other record types (sig, sub)
-	// Note: sub and sig records are skipped as we only care about pub/uid/fpr
-	realWorldOutput := `tru::1:1611864000:0:3:1:5
-pub:u:4096:1:8B48AD6246925553:1611864000:2023-01-15T00:00:00:::::scESC:::::::23::0:
-fpr:::::::::D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0:
-uid:u::::1611864000::1234567890::John Doe <john@example.com>::::::::::0:
-uid:u::::1611864100::1234567891::John Doe <john@work.com>::::::::::0:
-pub:f:2048:1:1234567890123456:1580592000:2022-12-31T00:00:00::u:::scESC:::::::23::0:
-fpr:::::::::F4E3D2C1B0A9F8E7D6C5B4A3F2E1D0C9:
-uid:f::::1580592000::0987654321::Maintainer Key <maint@example.com>::::::::::0:`
-
-	keys := parseGPGOutput(realWorldOutput)
-	c.Check(keys, HasLen, 2)
-
-	// First key should have 2 UIDs
-	c.Check(keys[0].KeyID, Equals, "8B48AD6246925553")
-	c.Check(keys[0].UserIDs, HasLen, 2)
-	c.Check(keys[0].Fingerprint, Equals, "D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0")
-
-	// Second key should have 1 UID
-	c.Check(keys[1].KeyID, Equals, "1234567890123456")
-	c.Check(keys[1].UserIDs, HasLen, 1)
-	c.Check(keys[1].Fingerprint, Equals, "F4E3D2C1B0A9F8E7D6C5B4A3F2E1D0C9")
-}
-
-// TestParseGPGOutputConsecutiveEmptyUIDs tests handling of consecutive empty user ID fields
-func (s *GPGSuite) TestParseGPGOutputConsecutiveEmptyUIDs(c *C) {
-	output := `pub:u:4096:1:8B48AD6246925553:1611864000:1643400000:uidhash:::scESC:::::::23::0:
-uid:u::::1611864000::1234567890:::::::::::0:
-uid:u::::1611864000::1234567891::John Doe <john@example.com>::::::::::0:
-fpr:::::::::D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0:`
-
-	keys := parseGPGOutput(output)
-	c.Check(keys, HasLen, 1)
-	// Should skip empty UID but include the non-empty one
-	c.Check(keys[0].UserIDs, HasLen, 1)
-	c.Check(keys[0].UserIDs[0], Equals, "John Doe <john@example.com>")
-}
-
-// TestGPGDeleteKeyParamsValidation tests gpgDeleteKeyParams validation
-func (s *GPGSuite) TestGPGDeleteKeyParamsValidation(c *C) {
-	// This is a unit test that validates parameter structure (no HTTP needed)
-	params := gpgDeleteKeyParams{
-		Keyring: "custom.gpg",
-		GpgKeyID: "8B48AD6246925553",
-	}
-	c.Check(params.Keyring, Equals, "custom.gpg")
-	c.Check(params.GpgKeyID, Equals, "8B48AD6246925553")
-}
-
-// TestAPIGPGDeleteKeyMissingKeyID tests delete with missing key ID parameter
-func (s *GPGSuite) TestAPIGPGDeleteKeyMissingKeyID(c *C) {
-	body, err := json.Marshal(map[string]string{
-		"Keyring": "trustedkeys.gpg",
-		// GpgKeyID is missing
-	})
-	c.Assert(err, IsNil)
-
-	response, err := s.HTTPRequest("DELETE", "/api/gpg/key", bytes.NewReader(body))
-	c.Assert(err, IsNil)
-	c.Check(response.Code, Equals, 400)
-}
-
-// TestAPIGPGDeleteKeyInvalidJSON tests delete with invalid JSON request
-func (s *GPGSuite) TestAPIGPGDeleteKeyInvalidJSON(c *C) {
-	response, err := s.HTTPRequest("DELETE", "/api/gpg/key", bytes.NewReader([]byte("invalid json")))
-	c.Assert(err, IsNil)
-	c.Check(response.Code, Equals, 400)
-}
-
-// TestAPIGPGDeleteKeySuccess tests successful key deletion
-func (s *GPGSuite) TestAPIGPGDeleteKeySuccess(c *C) {
-	argFile, err := os.CreateTemp("", "aptly-gpg-delete-args")
-	c.Assert(err, IsNil)
-	_ = argFile.Close()
-	defer func() { _ = os.Remove(argFile.Name()) }()
-
-	script := "#!/bin/sh\n" +
-		"if [ \"$1\" = \"--version\" ]; then echo 'gpg (GnuPG) 2.2.27'; exit 0; fi\n" +
-		"printf '%s\n' \"$@\" > '" + argFile.Name() + "'\n" +
-		"if printf '%s' \"$*\" | grep -q -- '--delete-keys'; then\n" +
-		"echo 'deleted'\n" +
-		"exit 0\n" +
-		"fi\n" +
-		"exit 1\n"
-
-	s.withFakeGPG(c, script, func(_ string) {
-		body, marshalErr := json.Marshal(gpgDeleteKeyParams{
-			Keyring: "/trustedkeys.gpg",
-			GpgKeyID: "8B48AD6246925553",
-		})
-		c.Assert(marshalErr, IsNil)
-
-		response, reqErr := s.HTTPRequest("DELETE", "/api/gpg/key", bytes.NewReader(body))
-		c.Assert(reqErr, IsNil)
-		c.Check(response.Code, Equals, 200)
-		c.Check(response.Body.String(), Matches, `"deleted\\n"`)
-
-		argBytes, readErr := os.ReadFile(argFile.Name())
-		c.Assert(readErr, IsNil)
-		argText := string(argBytes)
-		c.Check(argText, Matches, `(?s).*--batch\n--yes\n.*`)
-		c.Check(argText, Matches, `(?s).*--keyring\n/trustedkeys\.gpg\n.*`)
-		c.Check(argText, Matches, `(?s).*--delete-keys\n8B48AD6246925553\n.*`)
-	})
-}
-
-// TestAPIGPGListKeysCommandFailure tests list error propagation from gpg
-func (s *GPGSuite) TestAPIGPGListKeysCommandFailure(c *C) {
-	script := "#!/bin/sh\n" +
-		"if [ \"$1\" = \"--version\" ]; then echo 'gpg (GnuPG) 2.2.27'; exit 0; fi\n" +
-		"if printf '%s' \"$*\" | grep -q -- '--list-keys'; then\n" +
-		"echo 'keyring missing'\n" +
-		"exit 1\n" +
-		"fi\n" +
-		"exit 1\n"
-
-	s.withFakeGPG(c, script, func(_ string) {
-		response, err := s.HTTPRequest("GET", "/api/gpg/keys", nil)
-		c.Assert(err, IsNil)
-		c.Check(response.Code, Equals, 400)
-		c.Check(response.Body.String(), Matches, `(?s).*failed to list keys: keyring missing.*`)
-	})
-}
-
-// TestAPIGPGDeleteKeyCommandFailure tests delete error propagation from gpg
-func (s *GPGSuite) TestAPIGPGDeleteKeyCommandFailure(c *C) {
-	s.withFakeGPG(c, s.fakeGPGScript(c, "", "", "delete failed"), func(_ string) {
-		body, err := json.Marshal(gpgDeleteKeyParams{
-			Keyring: "trustedkeys.gpg",
-			GpgKeyID: "8B48AD6246925553",
-		})
-		c.Assert(err, IsNil)
-
-		response, reqErr := s.HTTPRequest("DELETE", "/api/gpg/key", bytes.NewReader(body))
-		c.Assert(reqErr, IsNil)
-		c.Check(response.Code, Equals, 400)
-		c.Check(response.Body.String(), Matches, `(?s).*failed to delete key: delete failed.*`)
-	})
-}
@@ -31,61 +31,22 @@ func getVerifier(keyRings []string) (pgp.Verifier, error) {
 	return verifier, nil
 }

-// stringSlicesEqual compares two string slices for equality (order matters)
-func stringSlicesEqual(a, b []string) bool {
-	if len(a) != len(b) {
-		return false
-	}
-	for i := range a {
-		if a[i] != b[i] {
-			return false
-		}
-	}
-	return true
-}
-
-// uniqueStrings returns a new slice with only unique strings from the input, sorted
-func uniqueStrings(input []string) []string {
-	if len(input) == 0 {
-		return input
-	}
-	seen := make(map[string]struct{}, len(input))
-	result := make([]string, 0, len(input))
-	for _, s := range input {
-		if _, ok := seen[s]; !ok {
-			seen[s] = struct{}{}
-			result = append(result, s)
-		}
-	}
-	sort.Strings(result)
-	return result
-}
-
 // @Summary List Mirrors
 // @Description **Show list of currently available mirrors**
 // @Description Each mirror is returned as in “show” API.
 // @Tags Mirrors
 // @Produce json
-// @Success 200 {array} remoteRepoResponse
+// @Success 200 {array} deb.RemoteRepo
 // @Router /api/mirrors [get]
 func apiMirrorsList(c *gin.Context) {
 	collectionFactory := context.NewCollectionFactory()
 	collection := collectionFactory.RemoteRepoCollection()

-	result := []remoteRepoResponse{}
-	err := collection.ForEach(func(repo *deb.RemoteRepo) error {
-		err := collection.LoadComplete(repo)
-		if err != nil {
-			return err
-		}
-
-		result = append(result, newRemoteRepoResponse(repo))
+	result := []*deb.RemoteRepo{}
+	_ = collection.ForEach(func(repo *deb.RemoteRepo) error {
+		result = append(result, repo)
 		return nil
 	})
-	if err != nil {
-		AbortWithJSONError(c, 500, fmt.Errorf("unable to show: %s", err))
-		return
-	}

 	c.JSON(200, result)
 }
@@ -111,8 +72,6 @@ type mirrorCreateParams struct {
 	DownloadUdebs bool `                     json:"DownloadUdebs"`
 	// Set "true" to mirror installer files
 	DownloadInstaller bool `                 json:"DownloadInstaller"`
-	// Set "true" to mirror AppStream (DEP-11) metadata
-	DownloadAppStream bool `                 json:"DownloadAppStream"`
 	// Set "true" to include dependencies of matching packages when filtering
 	FilterWithDeps bool `                    json:"FilterWithDeps"`
 	// Set "true" to skip if the given components are in the Release file
@@ -164,7 +123,7 @@ func apiMirrorsCreate(c *gin.Context) {
 	}

 	repo, err := deb.NewRemoteRepo(b.Name, b.ArchiveURL, b.Distribution, b.Components, b.Architectures,
-		b.DownloadSources, b.DownloadUdebs, b.DownloadInstaller, b.DownloadAppStream)
+		b.DownloadSources, b.DownloadUdebs, b.DownloadInstaller)

 	if err != nil {
 		AbortWithJSONError(c, 400, fmt.Errorf("unable to create mirror: %s", err))
@@ -273,7 +232,6 @@ func apiMirrorsShow(c *gin.Context) {
 	err = collection.LoadComplete(repo)
 	if err != nil {
 		AbortWithJSONError(c, 500, fmt.Errorf("unable to show: %s", err))
-		return
 	}

 	c.JSON(200, repo)
@@ -372,133 +330,29 @@ func apiMirrorsPackages(c *gin.Context) {
 	}
 }

-type mirrorEditParams struct {
-	// Package query that is applied to mirror packages
-	Filter *string `         json:"Filter" example:"xserver-xorg"`
-	// Set "true" to include dependencies of matching packages when filtering
-	FilterWithDeps *bool `   json:"FilterWithDeps"`
-	// Set "true" to mirror installer files
-	DownloadInstaller *bool `json:"DownloadInstaller"`
-	// Set "true" to mirror source packages
-	DownloadSources *bool `  json:"DownloadSources"`
-	// Set "true" to mirror udeb files
-	DownloadUdebs *bool `    json:"DownloadUdebs"`
-	// URL of the archive to mirror
-	ArchiveURL *string `     json:"ArchiveURL"     example:"http://deb.debian.org/debian"`
-	// Comma separated list of architectures
-	Architectures *[]string `json:"Architectures"  example:"amd64"`
-	// Gpg keyring(s) for verifying Release file if a mirror update is required.
-	Keyrings []string `      json:"Keyrings"       example:"trustedkeys.gpg"`
-	// Set "true" to skip the verification of Release file signatures
-	IgnoreSignatures *bool ` json:"IgnoreSignatures"`
-}
-
-// @Summary Edit Mirror
-// @Description **Edit mirror config**
-// @Tags Mirrors
-// @Param name path string true "mirror name to edit"
-// @Consume json
-// @Param request body mirrorEditParams true "Parameters"
-// @Produce json
-// @Success 200 {object} deb.RemoteRepo "Mirror was edited successfully"
-// @Failure 400 {object} Error "Bad Request"
-// @Failure 404 {object} Error "Mirror not found"
-// @Failure 409 {object} Error "Aptly db locked"
-// @Failure 500 {object} Error "Internal Error"
-// @Router /api/mirrors/{name} [post]
-func apiMirrorsEdit(c *gin.Context) {
-	var (
-		err  error
-		b    mirrorEditParams
-		repo *deb.RemoteRepo
-	)
-
-	collectionFactory := context.NewCollectionFactory()
-	collection := collectionFactory.RemoteRepoCollection()
-
-	name := c.Params.ByName("name")
-	repo, err = collection.ByName(name)
-	if err != nil {
-		AbortWithJSONError(c, 404, fmt.Errorf("unable to edit: %s", err))
-		return
-	}
-
-	err = repo.CheckLock()
-	if err != nil {
-		AbortWithJSONError(c, 409, fmt.Errorf("unable to edit: %s", err))
-		return
-	}
-
-	if c.Bind(&b) != nil {
-		return
-	}
-
-	fetchMirror := false
-	ignoreSignatures := context.Config().GpgDisableVerify
-
-	if b.Filter != nil {
-		repo.Filter = *b.Filter
-	}
-	if b.FilterWithDeps != nil {
-		repo.FilterWithDeps = *b.FilterWithDeps
-	}
-	if b.DownloadInstaller != nil {
-		repo.DownloadInstaller = *b.DownloadInstaller
-	}
-	if b.DownloadSources != nil {
-		repo.DownloadSources = *b.DownloadSources
-	}
-	if b.DownloadUdebs != nil {
-		repo.DownloadUdebs = *b.DownloadUdebs
-	}
-	if b.ArchiveURL != nil && *b.ArchiveURL != repo.ArchiveRoot {
-		repo.SetArchiveRoot(*b.ArchiveURL)
-		fetchMirror = true
-	}
-	if b.Architectures != nil {
-		uniqueArchitectures := uniqueStrings(*b.Architectures)
-		if !stringSlicesEqual(uniqueArchitectures, uniqueStrings(repo.Architectures)) {
-			repo.Architectures = uniqueArchitectures
-			fetchMirror = true
-		}
-	}
-	if b.IgnoreSignatures != nil {
-		ignoreSignatures = *b.IgnoreSignatures
-	}
-
-	if repo.IsFlat() && repo.DownloadUdebs {
-		AbortWithJSONError(c, 400, fmt.Errorf("unable to edit: flat mirrors don't support udebs"))
-		return
-	}
-
-	if fetchMirror {
-		verifier, err := getVerifier(b.Keyrings)
-		if err != nil {
-			AbortWithJSONError(c, 500, fmt.Errorf("unable to initialize GPG verifier: %s", err))
-			return
-		}
-
-		err = repo.Fetch(context.Downloader(), verifier, ignoreSignatures)
-		if err != nil {
-			AbortWithJSONError(c, 500, fmt.Errorf("unable to edit: %s", err))
-			return
-		}
-	}
-
-	err = collection.Update(repo)
-	if err != nil {
-		AbortWithJSONError(c, 500, fmt.Errorf("unable to edit: %s", err))
-		return
-	}
-
-	c.JSON(200, repo)
-}
-
 type mirrorUpdateParams struct {
 	// Change mirror name to `Name`
 	Name string `                 json:"Name"                   example:"mirror1"`
+	// Url of the archive to mirror
+	ArchiveURL string `           json:"ArchiveURL"             example:"http://deb.debian.org/debian"`
+	// Package query that is applied to mirror packages
+	Filter string `               json:"Filter"                 example:"xserver-xorg"`
+	// Limit mirror to those architectures, if not specified aptly would fetch all architectures
+	Architectures []string `      json:"Architectures"          example:"amd64"`
+	// Components to mirror, if not specified aptly would fetch all components
+	Components []string `         json:"Components"             example:"main"`
 	// Gpg keyring(s) for verifing Release file
 	Keyrings []string `           json:"Keyrings"               example:"trustedkeys.gpg"`
+	// Set "true" to include dependencies of matching packages when filtering
+	FilterWithDeps bool `         json:"FilterWithDeps"`
+	// Set "true" to mirror source packages
+	DownloadSources bool `        json:"DownloadSources"`
+	// Set "true" to mirror udeb files
+	DownloadUdebs bool `          json:"DownloadUdebs"`
+	// Set "true" to skip checking if the given components are in the Release file
+	SkipComponentCheck bool `     json:"SkipComponentCheck"`
+	// Set "true" to skip checking if the given architectures are in the Release file
+	SkipArchitectureCheck bool `  json:"SkipArchitectureCheck"`
 	// Set "true" to ignore checksum errors
 	IgnoreChecksums bool `        json:"IgnoreChecksums"`
 	// Set "true" to skip the verification of Release file signatures
@@ -507,8 +361,6 @@ type mirrorUpdateParams struct {
 	ForceUpdate bool `            json:"ForceUpdate"`
 	// Set "true" to skip downloading already downloaded packages
 	SkipExistingPackages bool `   json:"SkipExistingPackages"`
-	// Set "true" to download only the latest version per package/architecture
-	LatestOnly bool `             json:"LatestOnly"`
 }

 // @Summary Update Mirror
@@ -542,6 +394,14 @@ func apiMirrorsUpdate(c *gin.Context) {
 	}

 	b.Name = remote.Name
+	b.DownloadUdebs = remote.DownloadUdebs
+	b.DownloadSources = remote.DownloadSources
+	b.SkipComponentCheck = remote.SkipComponentCheck
+	b.SkipArchitectureCheck = remote.SkipArchitectureCheck
+	b.FilterWithDeps = remote.FilterWithDeps
+	b.Filter = remote.Filter
+	b.Architectures = remote.Architectures
+	b.Components = remote.Components
 	b.IgnoreSignatures = context.Config().GpgDisableVerify

 	log.Info().Msgf("%s: Starting mirror update", b.Name)
@@ -558,6 +418,27 @@ func apiMirrorsUpdate(c *gin.Context) {
 		}
 	}

+	if b.DownloadUdebs != remote.DownloadUdebs {
+		if remote.IsFlat() && b.DownloadUdebs {
+			AbortWithJSONError(c, 400, fmt.Errorf("unable to update: flat mirrors don't support udebs"))
+			return
+		}
+	}
+
+	if b.ArchiveURL != "" {
+		remote.SetArchiveRoot(b.ArchiveURL)
+	}
+
+	remote.Name = b.Name
+	remote.DownloadUdebs = b.DownloadUdebs
+	remote.DownloadSources = b.DownloadSources
+	remote.SkipComponentCheck = b.SkipComponentCheck
+	remote.SkipArchitectureCheck = b.SkipArchitectureCheck
+	remote.FilterWithDeps = b.FilterWithDeps
+	remote.Filter = b.Filter
+	remote.Architectures = b.Architectures
+	remote.Components = b.Components
+
 	verifier, err := getVerifier(b.Keyrings)
 	if err != nil {
 		AbortWithJSONError(c, 400, fmt.Errorf("unable to initialize GPG verifier: %s", err))
@@ -580,19 +461,11 @@ func apiMirrorsUpdate(c *gin.Context) {
 			}
 		}

-		err = remote.DownloadPackageIndexes(out, downloader, verifier, collectionFactory, b.IgnoreSignatures, remote.SkipComponentCheck)
+		err = remote.DownloadPackageIndexes(out, downloader, verifier, collectionFactory, b.IgnoreSignatures, b.SkipComponentCheck)
 		if err != nil {
 			return &task.ProcessReturnValue{Code: http.StatusInternalServerError, Value: nil}, fmt.Errorf("unable to update: %s", err)
 		}

-		if remote.DownloadAppStream && !remote.IsFlat() {
-			err = remote.DownloadAppStreamFiles(out, downloader,
-				context.PackagePool(), collectionFactory.ChecksumCollection(nil), b.IgnoreChecksums)
-			if err != nil {
-				return &task.ProcessReturnValue{Code: http.StatusInternalServerError, Value: nil}, fmt.Errorf("unable to update: %s", err)
-			}
-		}
-
 		if remote.Filter != "" {
 			var filterQuery deb.PackageQuery

@@ -608,7 +481,7 @@ func apiMirrorsUpdate(c *gin.Context) {
 		}

 		queue, downloadSize, err := remote.BuildDownloadQueue(context.PackagePool(), collectionFactory.PackageCollection(),
-			collectionFactory.ChecksumCollection(nil), b.SkipExistingPackages, b.LatestOnly)
+			collectionFactory.ChecksumCollection(nil), b.SkipExistingPackages)
 		if err != nil {
 			return &task.ProcessReturnValue{Code: http.StatusInternalServerError, Value: nil}, fmt.Errorf("unable to update: %s", err)
 		}
@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"encoding/json"

-	"github.com/aptly-dev/aptly/deb"
 	"github.com/gin-gonic/gin"
 	. "gopkg.in/check.v1"
 )
@@ -18,10 +17,7 @@ var _ = Suite(&MirrorSuite{})
 func (s *MirrorSuite) TestGetMirrors(c *C) {
 	response, _ := s.HTTPRequest("GET", "/api/mirrors", nil)
 	c.Check(response.Code, Equals, 200)
-
-	var mirrors []map[string]interface{}
-	err := json.Unmarshal(response.Body.Bytes(), &mirrors)
-	c.Assert(err, IsNil)
+	c.Check(response.Body.String(), Equals, "[]")
 }

 func (s *MirrorSuite) TestDeleteMirrorNonExisting(c *C) {
@@ -30,21 +26,6 @@ func (s *MirrorSuite) TestDeleteMirrorNonExisting(c *C) {
 	c.Check(response.Body.String(), Equals, "{\"error\":\"unable to drop: mirror with name does-not-exist not found\"}")
 }

-func (s *MirrorSuite) TestCreateMirrorFlatWithAppStream(c *C) {
-	body, err := json.Marshal(gin.H{
-		"Name":              "test-flat-appstream",
-		"ArchiveURL":        "http://example.com/repo/",
-		"Distribution":      "./",
-		"DownloadAppStream":  true,
-	})
-	c.Assert(err, IsNil)
-
-	response, err := s.HTTPRequest("POST", "/api/mirrors", bytes.NewReader(body))
-	c.Assert(err, IsNil)
-	c.Check(response.Code, Equals, 400)
-	c.Check(response.Body.String(), Matches, ".*AppStream.*flat.*")
-}
-
 func (s *MirrorSuite) TestCreateMirror(c *C) {
 	c.ExpectFailure("Need to mock downloads")
 	body, err := json.Marshal(gin.H{
@@ -57,49 +38,3 @@ func (s *MirrorSuite) TestCreateMirror(c *C) {
 	c.Check(response.Code, Equals, 400)
 	c.Check(response.Body.String(), Equals, "")
 }
-
-func (s *MirrorSuite) TestGetMirrorsIncludesNumPackages(c *C) {
-	collection := s.context.NewCollectionFactory().RemoteRepoCollection()
-
-	repo, err := deb.NewRemoteRepo("count-mirror", "http://example.com/debian", "stable", []string{"main"}, []string{}, false, false, false, false)
-	c.Assert(err, IsNil)
-
-	err = collection.Add(repo)
-	c.Assert(err, IsNil)
-	putRawDBValue(c, &s.APISuite, repo.RefKey(), makePackageRefList(c).Encode())
-
-	response, err := s.HTTPRequest("GET", "/api/mirrors", nil)
-	c.Assert(err, IsNil)
-	c.Assert(response.Code, Equals, 200)
-
-	var mirrors []map[string]interface{}
-	err = json.Unmarshal(response.Body.Bytes(), &mirrors)
-	c.Assert(err, IsNil)
-
-	found := false
-	for _, mirror := range mirrors {
-		if mirror["Name"] == "count-mirror" {
-			found = true
-			value, ok := mirror["NumPackages"]
-			c.Assert(ok, Equals, true)
-			c.Assert(value, Equals, float64(2))
-			break
-		}
-	}
-
-	c.Assert(found, Equals, true)
-}
-
-func (s *MirrorSuite) TestGetMirrorsReturns500OnCorruptRefList(c *C) {
-	collection := s.context.NewCollectionFactory().RemoteRepoCollection()
-
-	repo, err := deb.NewRemoteRepo("broken-mirror", "http://example.com/debian", "stable", []string{"main"}, []string{}, false, false, false, false)
-	c.Assert(err, IsNil)
-	c.Assert(collection.Add(repo), IsNil)
-	putRawDBValue(c, &s.APISuite, repo.RefKey(), []byte("not-msgpack"))
-
-	response, err := s.HTTPRequest("GET", "/api/mirrors", nil)
-	c.Assert(err, IsNil)
-	c.Assert(response.Code, Equals, 500)
-	c.Assert(response.Body.String(), Matches, ".*unable to show:.*")
-}
@@ -1,30 +0,0 @@
-package api
-
-import "github.com/aptly-dev/aptly/deb"
-
-type remoteRepoResponse struct {
-	*deb.RemoteRepo
-	NumPackages int `json:"NumPackages"`
-}
-
-type localRepoResponse struct {
-	*deb.LocalRepo
-	NumPackages int `json:"NumPackages"`
-}
-
-type snapshotResponse struct {
-	*deb.Snapshot
-	NumPackages int `json:"NumPackages"`
-}
-
-func newRemoteRepoResponse(repo *deb.RemoteRepo) remoteRepoResponse {
-	return remoteRepoResponse{RemoteRepo: repo, NumPackages: repo.NumPackages()}
-}
-
-func newLocalRepoResponse(repo *deb.LocalRepo) localRepoResponse {
-	return localRepoResponse{LocalRepo: repo, NumPackages: repo.NumPackages()}
-}
-
-func newSnapshotResponse(snapshot *deb.Snapshot) snapshotResponse {
-	return snapshotResponse{Snapshot: snapshot, NumPackages: snapshot.NumPackages()}
-}
@@ -1,19 +0,0 @@
-package api
-
-import (
-	"github.com/aptly-dev/aptly/deb"
-	. "gopkg.in/check.v1"
-)
-
-func makePackageRefList(c *C) *deb.PackageRefList {
-	list := deb.NewPackageList()
-	c.Assert(list.Add(&deb.Package{Name: "libcount", Version: "1.0", Architecture: "amd64"}), IsNil)
-	c.Assert(list.Add(&deb.Package{Name: "appcount", Version: "2.0", Architecture: "all"}), IsNil)
-	return deb.NewPackageRefListFromPackageList(list)
-}
-
-func putRawDBValue(c *C, s *APISuite, key []byte, value []byte) {
-	db, err := s.context.Database()
-	c.Assert(err, IsNil)
-	c.Assert(db.Put(key, value), IsNil)
-}
@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"net/http"
 	"strings"
-	"errors"

 	"github.com/aptly-dev/aptly/aptly"
 	"github.com/aptly-dev/aptly/deb"
@@ -17,8 +16,8 @@ import (
 type signingParams struct {
 	// Don't sign published repository
 	Skip bool `                json:"Skip"           example:"false"`
-	// GPG key ID(s) to use when signing the release, separated by comma, and if not specified, default configured key(s) are used
-	GpgKey string `            json:"GpgKey"         example:"KEY_ID_a, KEY_ID_b"`
+	// GPG key ID to use when signing the release, if not specified default key is used
+	GpgKey string `            json:"GpgKey"         example:"A0546A43624A8331"`
 	// GPG keyring to use (instead of default)
 	Keyring string `           json:"Keyring"        example:"trustedkeys.gpg"`
 	// GPG secret keyring to use (instead of default) Note: depreciated with gpg2
@@ -42,21 +41,7 @@ func getSigner(options *signingParams) (pgp.Signer, error) {
 	}

 	signer := context.GetSigner()
-
-	var multiGpgKeys []string
-	// REST params have priority over config
-	if options.GpgKey != "" {
-		for _, p := range strings.Split(options.GpgKey, ",") {
-			if t := strings.TrimSpace(p); t != "" {
-				multiGpgKeys = append(multiGpgKeys, t)
-			}
-		}
-	} else if len(context.Config().GpgKeys) > 0 {
-		multiGpgKeys = context.Config().GpgKeys
-	}
-	for _, gpgKey := range multiGpgKeys {
-		signer.SetKey(gpgKey)
-	}
+	signer.SetKey(options.GpgKey)
 	signer.SetKeyRing(options.Keyring, options.SecretKeyring)
 	signer.SetPassphrase(options.Passphrase, options.PassphraseFile)

@@ -183,12 +168,8 @@ type publishedRepoCreateParams struct {
 	SkipBz2 *bool `                               json:"SkipBz2"               example:"false"`
 	// Provide index files by hash
 	AcquireByHash *bool `                         json:"AcquireByHash"         example:"false"`
-	// An optional field containing a comma separated list of OpenPGP key fingerprints to be used for validating the next Release file.
-	SignedBy *string `                            json:"SignedBy"              example:""`
 	// Enable multiple packages with the same filename in different distributions
 	MultiDist *bool `                             json:"MultiDist"             example:"false"`
-	// Version of the release
-	Version string `                              json:"Version"               example:""`
 }

 // @Summary Create Published Repository
@@ -256,13 +237,13 @@ func apiPublishRepoOrSnapshot(c *gin.Context) {
 	if b.SourceKind == deb.SourceSnapshot {
 		var snapshot *deb.Snapshot

-		tmpCollection := collectionFactory.SnapshotCollection()
+		snapshotCollection := collectionFactory.SnapshotCollection()

 		for _, source := range b.Sources {
 			components = append(components, source.Component)
 			names = append(names, source.Name)

-			snapshot, err = tmpCollection.ByName(source.Name)
+			snapshot, err = snapshotCollection.ByName(source.Name)
 			if err != nil {
 				AbortWithJSONError(c, http.StatusNotFound, fmt.Errorf("unable to publish: %s", err))
 				return
@@ -274,13 +255,13 @@ func apiPublishRepoOrSnapshot(c *gin.Context) {
 	} else if b.SourceKind == deb.SourceLocalRepo {
 		var localRepo *deb.LocalRepo

-		tmpCollection := collectionFactory.LocalRepoCollection()
+		localCollection := collectionFactory.LocalRepoCollection()

 		for _, source := range b.Sources {
 			components = append(components, source.Component)
 			names = append(names, source.Name)

-			localRepo, err = tmpCollection.ByName(source.Name)
+			localRepo, err = localCollection.ByName(source.Name)
 			if err != nil {
 				AbortWithJSONError(c, http.StatusNotFound, fmt.Errorf("unable to publish: %s", err))
 				return
@@ -333,6 +314,8 @@ func apiPublishRepoOrSnapshot(c *gin.Context) {
 			return &task.ProcessReturnValue{Code: http.StatusInternalServerError, Value: nil}, fmt.Errorf("unable to publish: %s", err)
 		}

+		resources = append(resources, string(published.Key()))
+
 		if b.Origin != "" {
 			published.Origin = b.Origin
 		}
@@ -358,14 +341,6 @@ func apiPublishRepoOrSnapshot(c *gin.Context) {
 			published.AcquireByHash = *b.AcquireByHash
 		}

-		if b.SignedBy != nil {
-			published.SignedBy = *b.SignedBy
-		}
-
-		if b.Version != "" {
-			published.Version = b.Version
-		}
-
 		duplicate := collection.CheckDuplicate(published)
 		if duplicate != nil {
 			_ = collectionFactory.PublishedRepoCollection().LoadComplete(duplicate, collectionFactory)
@@ -401,16 +376,8 @@ type publishedRepoUpdateSwitchParams struct {
 	Snapshots []sourceParams `                    json:"Snapshots"`
 	// Provide index files by hash
 	AcquireByHash *bool `                         json:"AcquireByHash"  example:"false"`
-	// An optional field containing a comma separated list of OpenPGP key fingerprints to be used for validating the next Release file
-	SignedBy *string `                            json:"SignedBy"  example:""`
 	// Enable multiple packages with the same filename in different distributions
 	MultiDist *bool `                             json:"MultiDist"      example:"false"`
-    // Value of Label: field in published repository stanza
-    Label *string `                               json:"Label"          example:"Debian"`
-    // Value of Origin: field in published repository stanza
-    Origin *string `                              json:"Origin"         example:"Debian"`
-    // Version of the release: Optional
-    Version *string `                             json:"Version"        example:"13.3"`
 }

 // @Summary Update Published Repository
@@ -426,6 +393,7 @@ type publishedRepoUpdateSwitchParams struct {
 // @Description
 // @Description See also: `aptly publish update` / `aptly publish switch`
 // @Tags Publish
+// @Produce json
 // @Param prefix path string true "publishing prefix"
 // @Param distribution path string true "distribution name"
 // @Param _async query bool false "Run in background and return task object"
@@ -464,60 +432,18 @@ func apiPublishUpdateSwitch(c *gin.Context) {
 		return
 	}

-	resources := []string{string(published.Key())}
-
 	if published.SourceKind == deb.SourceLocalRepo {
 		if len(b.Snapshots) > 0 {
 			AbortWithJSONError(c, http.StatusBadRequest, fmt.Errorf("snapshots shouldn't be given when updating local repo"))
 			return
 		}
-		fmt.Printf("RACE DEBUG: deb.SourceLocalRepo\n")
-
-		// FIXME: lock repo ?
-		// localCollection := collectionFactory.LocalRepoCollection()
-		// for _, source := range b.Sources {
-		// 	components = append(components, source.Component)
-		// 	names = append(names, source.Name)
-
-		// 	localRepo, err = localCollection.ByName(source.Name)
-		// 	if err != nil {
-		// 		AbortWithJSONError(c, http.StatusNotFound, fmt.Errorf("unable to publish: %s", err))
-		// 		return
-		// 	}
-
-		// 	resources = append(resources, string(localRepo.Key()))
-		// }
 	} else if published.SourceKind == deb.SourceSnapshot {
-		fmt.Printf("RACE DEBUG: deb.SourceSnapshot: %s\n", b.Snapshots)
 		for _, snapshotInfo := range b.Snapshots {
-			snapshot, err2 := snapshotCollection.ByName(snapshotInfo.Name)
+			_, err2 := snapshotCollection.ByName(snapshotInfo.Name)
 			if err2 != nil {
 				AbortWithJSONError(c, http.StatusNotFound, err2)
 				return
 			}
-			resources = append(resources, string(snapshot.ResourceKey()))
-
-			for _, sourceID := range snapshot.SourceIDs {
-				if snapshot.SourceKind == deb.SourceSnapshot {
-					// FIXME: implement
-					err := errors.New("not implemented deb.SourceSnapshot")
-					AbortWithJSONError(c, http.StatusNotFound, err)
-					return
-				} else if snapshot.SourceKind == deb.SourceLocalRepo {
-					var repo *deb.LocalRepo
-					repo, err = context.NewCollectionFactory().LocalRepoCollection().ByUUID(sourceID)
-					if err != nil {
-						AbortWithJSONError(c, http.StatusNotFound, err)
-						return
-					}
-					resources = append(resources, string(repo.Key()))
-				} else if snapshot.SourceKind == deb.SourceRemoteRepo {
-					// FIXME: implement
-					err := errors.New("not implemented: deb.SourceRemoteRepo")
-					AbortWithJSONError(c, http.StatusNotFound, err)
-					return
-				}
-			}
 		}
 	} else {
 		AbortWithJSONError(c, http.StatusInternalServerError, fmt.Errorf("unknown published repository type"))
@@ -536,26 +462,11 @@ func apiPublishUpdateSwitch(c *gin.Context) {
 		published.AcquireByHash = *b.AcquireByHash
 	}

-	if b.SignedBy != nil {
-		published.SignedBy = *b.SignedBy
-	}
-
 	if b.MultiDist != nil {
 		published.MultiDist = *b.MultiDist
 	}

-	if b.Label != nil {
-		published.Label = *b.Label
-	}
-
-	if b.Origin != nil {
-		published.Origin = *b.Origin
-	}
-
-	if b.Version != nil {
-		published.Version = *b.Version
-	}
-
+	resources := []string{string(published.Key())}
 	taskName := fmt.Sprintf("Update published %s repository %s/%s", published.SourceKind, published.StoragePrefix(), published.Distribution)
 	maybeRunTaskInBackground(c, taskName, resources, func(out aptly.Progress, _ *task.Detail) (*task.ProcessReturnValue, error) {
 		err = collection.LoadComplete(published, collectionFactory)
@@ -1044,16 +955,8 @@ type publishedRepoUpdateParams struct {
 	SkipCleanup *bool `                           json:"SkipCleanup"     example:"false"`
 	// Provide index files by hash
 	AcquireByHash *bool `                         json:"AcquireByHash"   example:"false"`
-	// An optional field containing a comma separated list of OpenPGP key fingerprints to be used for validating the next Release file
-	SignedBy *string `                            json:"SignedBy"   example:""`
 	// Enable multiple packages with the same filename in different distributions
 	MultiDist *bool `                             json:"MultiDist"       example:"false"`
-    // Value of Label: field in published repository stanza
-    Label *string `                               json:"Label"          example:"Debian"`
-    // Value of Origin: field in published repository stanza
-    Origin *string `                              json:"Origin"         example:"Debian"`
-    // Version of the release: Optional
-    Version *string `                             json:"Version"        example:"13.3"`
 }

 // @Summary Update Published Repository
@@ -1118,26 +1021,10 @@ func apiPublishUpdate(c *gin.Context) {
 		published.AcquireByHash = *b.AcquireByHash
 	}

-	if b.SignedBy != nil {
-		published.SignedBy = *b.SignedBy
-	}
-
 	if b.MultiDist != nil {
 		published.MultiDist = *b.MultiDist
 	}

-	if b.Label != nil {
-		published.Label = *b.Label
-	}
-
-	if b.Origin != nil {
-		published.Origin = *b.Origin
-	}
-
-	if b.Version != nil {
-		published.Version = *b.Version
-	}
-
 	resources := []string{string(published.Key())}
 	taskName := fmt.Sprintf("Update published %s repository %s/%s", published.SourceKind, published.StoragePrefix(), published.Distribution)
 	maybeRunTaskInBackground(c, taskName, resources, func(out aptly.Progress, _ *task.Detail) (*task.ProcessReturnValue, error) {
@@ -24,7 +24,7 @@ import (
 // @Tags Repos
 // @Produce html
 // @Success 200 {object} string "HTML"
-// @Router /repos [get]
+// @Router /api/repos [get]
 func reposListInAPIMode(localRepos map[string]utils.FileSystemPublishRoot) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		c.Writer.Header().Set("Content-Type", "text/html; charset=utf-8")
@@ -49,7 +49,7 @@ func reposListInAPIMode(localRepos map[string]utils.FileSystemPublishRoot) gin.H
 // @Param pkgPath path string true "Package Path" allowReserved=true
 // @Produce json
 // @Success 200 ""
-// @Router /repos/{storage}/{pkgPath} [get]
+// @Router /api/{storage}/{pkgPath} [get]
 func reposServeInAPIMode(c *gin.Context) {
 	pkgpath := c.Param("pkgPath")

@@ -69,26 +69,17 @@ func reposServeInAPIMode(c *gin.Context) {
 // @Description Each repo is returned as in “show” API.
 // @Tags Repos
 // @Produce  json
-// @Success 200 {array} localRepoResponse
+// @Success 200 {array} deb.LocalRepo
 // @Router /api/repos [get]
 func apiReposList(c *gin.Context) {
-	result := []localRepoResponse{}
+	result := []*deb.LocalRepo{}

 	collectionFactory := context.NewCollectionFactory()
 	collection := collectionFactory.LocalRepoCollection()
-	err := collection.ForEach(func(r *deb.LocalRepo) error {
-		err := collection.LoadComplete(r)
-		if err != nil {
-			return err
-		}
-
-		result = append(result, newLocalRepoResponse(r))
+	_ = collection.ForEach(func(r *deb.LocalRepo) error {
+		result = append(result, r)
 		return nil
 	})
-	if err != nil {
-		AbortWithJSONError(c, 500, err)
-		return
-	}

 	c.JSON(200, result)
 }
@@ -204,18 +195,17 @@ func apiReposEdit(c *gin.Context) {
 	collectionFactory := context.NewCollectionFactory()
 	collection := collectionFactory.LocalRepoCollection()

-	name := c.Params.ByName("name")
-	repo, err := collection.ByName(name)
+	repo, err := collection.ByName(c.Params.ByName("name"))
 	if err != nil {
 		AbortWithJSONError(c, 404, err)
 		return
 	}

-	if b.Name != nil && *b.Name != name {
+	if b.Name != nil {
 		_, err := collection.ByName(*b.Name)
 		if err == nil {
 			// already exists
-			AbortWithJSONError(c, 404, fmt.Errorf("local repo with name %q already exists", *b.Name))
+			AbortWithJSONError(c, 404, err)
 			return
 		}
 		repo.Name = *b.Name
@@ -420,7 +410,6 @@ func apiReposPackagesAddDelete(c *gin.Context, taskNamePrefix string, cb func(li
 // @Description API verifies that packages actually exist in aptly database and checks constraint that conflicting packages can’t be part of the same local repository.
 // @Tags Repos
 // @Param name path string true "Repository name"
-// @Consume  json
 // @Param request body reposPackagesAddDeleteParams true "Parameters"
 // @Param _async query bool false "Run in background and return task object"
 // @Produce json
@@ -466,7 +455,7 @@ func apiReposPackagesDelete(c *gin.Context) {
 // @Tags Repos
 // @Param name path string true "Repository name"
 // @Param dir path string true "Directory of packages"
-// @Param file path string true "Filename"
+// @Param file path string false "Filename (optional)"
 // @Param _async query bool false "Run in background and return task object"
 // @Produce json
 // @Success 200 {string} string "OK"
@@ -624,11 +613,11 @@ type reposCopyPackageParams struct {
 // @Summary Copy Package
 // @Description Copies a package from a source to destination repository
 // @Tags Repos
+// @Produce json
 // @Param name path string true "Destination repo"
 // @Param src path string true "Source repo"
 // @Param file path string true "File/packages to copy"
 // @Param _async query bool false "Run in background and return task object"
-// @Produce json
 // @Success 200 {object} task.ProcessReturnValue "msg"
 // @Failure 400 {object} Error "Bad Request"
 // @Failure 404 {object} Error "Not Found"
@@ -912,10 +901,10 @@ func apiReposIncludePackageFromDir(c *gin.Context) {
 			out.Printf("Failed files: %s\n", strings.Join(failedFiles, ", "))
 		}

-		ret := reposIncludePackageFromDirResponse{
+                ret := reposIncludePackageFromDirResponse{
 			Report:      reporter,
 			FailedFiles: failedFiles,
-		}
+                    }
 		return &task.ProcessReturnValue{Code: http.StatusOK, Value: ret}, nil
 	})
 }
@@ -1,63 +0,0 @@
-package api
-
-import (
-	"bytes"
-	"encoding/json"
-
-	"github.com/aptly-dev/aptly/deb"
-	"github.com/gin-gonic/gin"
-	. "gopkg.in/check.v1"
-)
-
-type ReposSuite struct {
-	APISuite
-}
-
-var _ = Suite(&ReposSuite{})
-
-func (s *ReposSuite) TestGetReposIncludesNumPackages(c *C) {
-	collection := s.context.NewCollectionFactory().LocalRepoCollection()
-	repo := deb.NewLocalRepo("count-repo-list", "")
-	repo.UpdateRefList(makePackageRefList(c))
-	c.Assert(collection.Add(repo), IsNil)
-
-	response, err := s.HTTPRequest("GET", "/api/repos", nil)
-	c.Assert(err, IsNil)
-	c.Assert(response.Code, Equals, 200)
-
-	var repos []map[string]interface{}
-	err = json.Unmarshal(response.Body.Bytes(), &repos)
-	c.Assert(err, IsNil)
-
-	found := false
-	for _, repo := range repos {
-		if repo["Name"] == "count-repo-list" {
-			found = true
-			value, ok := repo["NumPackages"]
-			c.Assert(ok, Equals, true)
-			c.Assert(value, Equals, float64(2))
-			break
-		}
-	}
-
-	c.Assert(found, Equals, true)
-}
-
-func (s *ReposSuite) TestGetReposReturns500OnCorruptRefList(c *C) {
-	body, err := json.Marshal(gin.H{"Name": "broken-repo-list"})
-	c.Assert(err, IsNil)
-
-	response, err := s.HTTPRequest("POST", "/api/repos", bytes.NewReader(body))
-	c.Assert(err, IsNil)
-	c.Assert(response.Code, Equals, 201)
-
-	collection := s.context.NewCollectionFactory().LocalRepoCollection()
-	repo, err := collection.ByName("broken-repo-list")
-	c.Assert(err, IsNil)
-	putRawDBValue(c, &s.APISuite, repo.RefKey(), []byte("not-msgpack"))
-
-	response, err = s.HTTPRequest("GET", "/api/repos", nil)
-	c.Assert(err, IsNil)
-	c.Assert(response.Code, Equals, 500)
-	c.Assert(response.Body.String(), Matches, ".*msgpack.*|.*decode.*")
-}
@@ -18,12 +18,6 @@ import (

 var context *ctx.AptlyContext

-// @Summary Get Metrics
-// @Description **Get Prometheus Metrics**
-// @Tags Status
-// @Produce text/plain
-// @Success 200 {string} string Metrics
-// @Router /api/metrics [get]
 func apiMetricsGet() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		countPackagesByRepos()
@@ -164,15 +158,12 @@ func Router(c *ctx.AptlyContext) http.Handler {
 		api.GET("/mirrors/:name", apiMirrorsShow)
 		api.GET("/mirrors/:name/packages", apiMirrorsPackages)
 		api.POST("/mirrors", apiMirrorsCreate)
-		api.POST("/mirrors/:name", apiMirrorsEdit)
 		api.PUT("/mirrors/:name", apiMirrorsUpdate)
 		api.DELETE("/mirrors/:name", apiMirrorsDrop)
 	}

 	{
-		api.GET("/gpg/keys", apiGPGListKeys)
 		api.POST("/gpg/key", apiGPGAddKey)
-		api.DELETE("/gpg/key", apiGPGDeleteKey)
 	}

 	{
@@ -20,7 +20,7 @@ import (
 // @Description Each snapshot is returned as in “show” API.
 // @Tags Snapshots
 // @Produce  json
-// @Success 200 {array} snapshotResponse
+// @Success 200 {array} deb.Snapshot
 // @Router /api/snapshots [get]
 func apiSnapshotsList(c *gin.Context) {
 	SortMethodString := c.Request.URL.Query().Get("sort")
@@ -32,20 +32,11 @@ func apiSnapshotsList(c *gin.Context) {
 		SortMethodString = "name"
 	}

-	result := []snapshotResponse{}
-	err := collection.ForEachSorted(SortMethodString, func(snapshot *deb.Snapshot) error {
-		err := collection.LoadComplete(snapshot)
-		if err != nil {
-			return err
-		}
-
-		result = append(result, newSnapshotResponse(snapshot))
+	result := []*deb.Snapshot{}
+	_ = collection.ForEachSorted(SortMethodString, func(snapshot *deb.Snapshot) error {
+		result = append(result, snapshot)
 		return nil
 	})
-	if err != nil {
-		AbortWithJSONError(c, 500, err)
-		return
-	}

 	c.JSON(200, result)
 }
@@ -226,9 +217,10 @@ type snapshotsCreateFromRepositoryParams struct {
 // @Summary Snapshot Repository
 // @Description **Create a snapshot of a repository by name**
 // @Tags Snapshots
+// @Param name path string true "Repository name"
 // @Consume json
 // @Param request body snapshotsCreateFromRepositoryParams true "Parameters"
-// @Param name path string true "Repository name"
+// @Param name path string true "Name of the snapshot"
 // @Param _async query bool false "Run in background and return task object"
 // @Produce json
 // @Success 201 {object} deb.Snapshot "Created snapshot object"
@@ -1,53 +0,0 @@
-package api
-
-import (
-	"encoding/json"
-
-	"github.com/aptly-dev/aptly/deb"
-	. "gopkg.in/check.v1"
-)
-
-type SnapshotsSuite struct {
-	APISuite
-}
-
-var _ = Suite(&SnapshotsSuite{})
-
-func (s *SnapshotsSuite) TestGetSnapshotsIncludesNumPackages(c *C) {
-	collection := s.context.NewCollectionFactory().SnapshotCollection()
-	snapshot := deb.NewSnapshotFromRefList("count-snapshot-list", nil, makePackageRefList(c), "")
-	c.Assert(collection.Add(snapshot), IsNil)
-
-	response, err := s.HTTPRequest("GET", "/api/snapshots", nil)
-	c.Assert(err, IsNil)
-	c.Assert(response.Code, Equals, 200)
-
-	var snapshots []map[string]interface{}
-	err = json.Unmarshal(response.Body.Bytes(), &snapshots)
-	c.Assert(err, IsNil)
-
-	found := false
-	for _, snapshot := range snapshots {
-		if snapshot["Name"] == "count-snapshot-list" {
-			found = true
-			value, ok := snapshot["NumPackages"]
-			c.Assert(ok, Equals, true)
-			c.Assert(value, Equals, float64(2))
-			break
-		}
-	}
-
-	c.Assert(found, Equals, true)
-}
-
-func (s *SnapshotsSuite) TestGetSnapshotsReturns500OnCorruptRefList(c *C) {
-	collection := s.context.NewCollectionFactory().SnapshotCollection()
-	snapshot := deb.NewSnapshotFromRefList("broken-snapshot-list", nil, makePackageRefList(c), "")
-	c.Assert(collection.Add(snapshot), IsNil)
-	putRawDBValue(c, &s.APISuite, snapshot.RefKey(), []byte("not-msgpack"))
-
-	response, err := s.HTTPRequest("GET", "/api/snapshots", nil)
-	c.Assert(err, IsNil)
-	c.Assert(response.Code, Equals, 500)
-	c.Assert(response.Body.String(), Matches, ".*msgpack.*|.*decode.*")
-}
@@ -104,7 +104,7 @@ func (pool *PackagePool) Open(path string) (aptly.ReadSeekerCloser, error) {
 	if err != nil {
 		return nil, errors.Wrapf(err, "error creating tempfile for %s", path)
 	}
-	defer func() { _ = os.Remove(temp.Name()) }()
+	defer func () { _ = os.Remove(temp.Name()) }()

 	_, err = pool.az.client.DownloadFile(context.TODO(), pool.az.container, path, temp, nil)
 	if err != nil {
@@ -7,7 +7,7 @@ import (
 	"path/filepath"
 	"runtime"

-	"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
+        "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
 	"github.com/aptly-dev/aptly/aptly"
 	"github.com/aptly-dev/aptly/files"
 	"github.com/aptly-dev/aptly/utils"
@@ -50,10 +50,10 @@ func (s *PackagePoolSuite) SetUpTest(c *C) {

 	s.pool, err = NewPackagePool(s.accountName, s.accountKey, container, "", s.endpoint)
 	c.Assert(err, IsNil)
-	publicAccessType := azblob.PublicAccessTypeContainer
-	_, err = s.pool.az.client.CreateContainer(context.TODO(), s.pool.az.container, &azblob.CreateContainerOptions{
-		Access: &publicAccessType,
-	})
+        publicAccessType := azblob.PublicAccessTypeContainer
+        _, err = s.pool.az.client.CreateContainer(context.TODO(), s.pool.az.container, &azblob.CreateContainerOptions{
+            Access: &publicAccessType,
+        })
 	c.Assert(err, IsNil)

 	s.prefixedPool, err = NewPackagePool(s.accountName, s.accountKey, container, prefix, s.endpoint)
@@ -1,17 +1,17 @@
 package azure

 import (
-	"bytes"
 	"context"
 	"crypto/md5"
 	"crypto/rand"
 	"io"
 	"os"
 	"path/filepath"
+        "bytes"

-	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
-	"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
-	"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/blob"
+        "github.com/Azure/azure-sdk-for-go/sdk/azcore"
+        "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
+        "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/blob"
 	"github.com/aptly-dev/aptly/files"
 	"github.com/aptly-dev/aptly/utils"
 	. "gopkg.in/check.v1"
@@ -69,10 +69,10 @@ func (s *PublishedStorageSuite) SetUpTest(c *C) {

 	s.storage, err = NewPublishedStorage(s.accountName, s.accountKey, container, "", s.endpoint)
 	c.Assert(err, IsNil)
-	publicAccessType := azblob.PublicAccessTypeContainer
-	_, err = s.storage.az.client.CreateContainer(context.Background(), s.storage.az.container, &azblob.CreateContainerOptions{
-		Access: &publicAccessType,
-	})
+        publicAccessType := azblob.PublicAccessTypeContainer
+        _, err = s.storage.az.client.CreateContainer(context.Background(), s.storage.az.container, &azblob.CreateContainerOptions{
+            Access: &publicAccessType,
+        })
 	c.Assert(err, IsNil)

 	s.prefixedStorage, err = NewPublishedStorage(s.accountName, s.accountKey, container, prefix, s.endpoint)
@@ -80,12 +80,12 @@ func (s *PublishedStorageSuite) SetUpTest(c *C) {
 }

 func (s *PublishedStorageSuite) TearDownTest(c *C) {
-	_, err := s.storage.az.client.DeleteContainer(context.Background(), s.storage.az.container, nil)
+        _, err := s.storage.az.client.DeleteContainer(context.Background(), s.storage.az.container, nil)
 	c.Assert(err, IsNil)
 }

 func (s *PublishedStorageSuite) GetFile(c *C, path string) []byte {
-	resp, err := s.storage.az.client.DownloadStream(context.Background(), s.storage.az.container, path, nil)
+        resp, err := s.storage.az.client.DownloadStream(context.Background(), s.storage.az.container, path, nil)
 	c.Assert(err, IsNil)
 	data, err := io.ReadAll(resp.Body)
 	c.Assert(err, IsNil)
@@ -93,26 +93,26 @@ func (s *PublishedStorageSuite) GetFile(c *C, path string) []byte {
 }

 func (s *PublishedStorageSuite) AssertNoFile(c *C, path string) {
-	serviceClient := s.storage.az.client.ServiceClient()
-	containerClient := serviceClient.NewContainerClient(s.storage.az.container)
-	blobClient := containerClient.NewBlobClient(path)
-	_, err := blobClient.GetProperties(context.Background(), nil)
+        serviceClient := s.storage.az.client.ServiceClient()
+        containerClient := serviceClient.NewContainerClient(s.storage.az.container)
+        blobClient := containerClient.NewBlobClient(path)
+        _, err := blobClient.GetProperties(context.Background(), nil)
 	c.Assert(err, NotNil)

-	storageError, ok := err.(*azcore.ResponseError)
+        storageError, ok := err.(*azcore.ResponseError)
 	c.Assert(ok, Equals, true)
 	c.Assert(storageError.StatusCode, Equals, 404)
 }

 func (s *PublishedStorageSuite) PutFile(c *C, path string, data []byte) {
 	hash := md5.Sum(data)
-	uploadOptions := &azblob.UploadStreamOptions{
-		HTTPHeaders: &blob.HTTPHeaders{
-			BlobContentMD5: hash[:],
-		},
-	}
-	reader := bytes.NewReader(data)
-	_, err := s.storage.az.client.UploadStream(context.Background(), s.storage.az.container, path, reader, uploadOptions)
+        uploadOptions := &azblob.UploadStreamOptions{
+            HTTPHeaders: &blob.HTTPHeaders{
+            	BlobContentMD5: hash[:],
+            },
+        }
+        reader := bytes.NewReader(data)
+        _, err := s.storage.az.client.UploadStream(context.Background(), s.storage.az.container, path, reader, uploadOptions)
 	c.Assert(err, IsNil)
 }

@@ -26,7 +26,6 @@ func aptlyDBCleanup(cmd *commander.Command, args []string) error {

 	// collect information about references packages...
 	existingPackageRefs := deb.NewPackageRefList()
-	referencedAppStreamFiles := []string{}

 	// used only in verbose mode to report package use source
 	packageRefSources := map[string][]string{}
@@ -56,10 +55,6 @@ func aptlyDBCleanup(cmd *commander.Command, args []string) error {
 			}
 		}

-		for _, poolPath := range repo.AppStreamFiles {
-			referencedAppStreamFiles = append(referencedAppStreamFiles, poolPath)
-		}
-
 		return nil
 	})
 	if err != nil {
@@ -123,11 +118,6 @@ func aptlyDBCleanup(cmd *commander.Command, args []string) error {
 				return nil
 			})
 		}
-
-		for _, poolPath := range snapshot.AppStreamFiles {
-			referencedAppStreamFiles = append(referencedAppStreamFiles, poolPath)
-		}
-
 		return nil
 	})
 	if err != nil {
@@ -246,7 +236,6 @@ func aptlyDBCleanup(cmd *commander.Command, args []string) error {
 		return err
 	}

-	referencedFiles = append(referencedFiles, referencedAppStreamFiles...)
 	sort.Strings(referencedFiles)
 	context.Progress().ShutdownBar()

@@ -20,7 +20,6 @@ func aptlyMirrorCreate(cmd *commander.Command, args []string) error {
 	downloadSources := LookupOption(context.Config().DownloadSourcePackages, context.Flags(), "with-sources")
 	downloadUdebs := context.Flags().Lookup("with-udebs").Value.Get().(bool)
 	downloadInstaller := context.Flags().Lookup("with-installer").Value.Get().(bool)
-	downloadAppStream := context.Flags().Lookup("with-appstream").Value.Get().(bool)
 	ignoreSignatures := context.Config().GpgDisableVerify
 	if context.Flags().IsSet("ignore-signatures") {
 		ignoreSignatures = context.Flags().Lookup("ignore-signatures").Value.Get().(bool)
@@ -42,7 +41,7 @@ func aptlyMirrorCreate(cmd *commander.Command, args []string) error {
 	}

 	repo, err := deb.NewRemoteRepo(mirrorName, archiveURL, distribution, components, context.ArchitecturesList(),
-		downloadSources, downloadUdebs, downloadInstaller, downloadAppStream)
+		downloadSources, downloadUdebs, downloadInstaller)
 	if err != nil {
 		return fmt.Errorf("unable to create mirror: %s", err)
 	}
@@ -101,7 +100,6 @@ Example:
 	}

 	cmd.Flag.Bool("ignore-signatures", false, "disable verification of Release file signatures")
-	cmd.Flag.Bool("with-appstream", false, "download AppStream (DEP-11) metadata")
 	cmd.Flag.Bool("with-installer", false, "download additional not packaged installer files")
 	cmd.Flag.Bool("with-sources", false, "download source packages in addition to binary packages")
 	cmd.Flag.Bool("with-udebs", false, "download .udeb packages (Debian installer support)")
@@ -35,8 +35,6 @@ func aptlyMirrorEdit(cmd *commander.Command, args []string) error {
 			repo.Filter = flag.Value.String() // allows file/stdin with @
 		case "filter-with-deps":
 			repo.FilterWithDeps = flag.Value.Get().(bool)
-		case "with-appstream":
-			repo.DownloadAppStream = flag.Value.Get().(bool)
 		case "with-installer":
 			repo.DownloadInstaller = flag.Value.Get().(bool)
 		case "with-sources":
@@ -55,10 +53,6 @@ func aptlyMirrorEdit(cmd *commander.Command, args []string) error {
 		return fmt.Errorf("unable to edit: flat mirrors don't support udebs")
 	}

-	if repo.IsFlat() && repo.DownloadAppStream {
-		return fmt.Errorf("unable to edit: flat mirrors don't support AppStream (DEP-11) metadata")
-	}
-
 	if repo.Filter != "" {
 		_, err = query.Parse(repo.Filter)
 		if err != nil {
@@ -113,7 +107,6 @@ Example:
 	AddStringOrFileFlag(&cmd.Flag, "filter", "", "filter packages in mirror, use '@file' to read filter from file or '@-' for stdin")
 	cmd.Flag.Bool("filter-with-deps", false, "when filtering, include dependencies of matching packages as well")
 	cmd.Flag.Bool("ignore-signatures", false, "disable verification of Release file signatures")
-	cmd.Flag.Bool("with-appstream", false, "download AppStream (DEP-11) metadata")
 	cmd.Flag.Bool("with-installer", false, "download additional not packaged installer files")
 	cmd.Flag.Bool("with-sources", false, "download source packages in addition to binary packages")
 	cmd.Flag.Bool("with-udebs", false, "download .udeb packages (Debian installer support)")
@@ -61,11 +61,6 @@ func aptlyMirrorShowTxt(_ *commander.Command, args []string) error {
 		downloadUdebs = Yes
 	}
 	fmt.Printf("Download .udebs: %s\n", downloadUdebs)
-	downloadAppStream := No
-	if repo.DownloadAppStream {
-		downloadAppStream = Yes
-	}
-	fmt.Printf("Download AppStream: %s\n", downloadAppStream)
 	if repo.Filter != "" {
 		fmt.Printf("Filter: %s\n", repo.Filter)
 		filterWithDeps := No
@@ -64,15 +64,6 @@ func aptlyMirrorUpdate(cmd *commander.Command, args []string) error {
 		return fmt.Errorf("unable to update: %s", err)
 	}

-	if repo.DownloadAppStream && !repo.IsFlat() {
-		context.Progress().Printf("Downloading AppStream metadata...\n")
-		err = repo.DownloadAppStreamFiles(context.Progress(), context.Downloader(),
-			context.PackagePool(), collectionFactory.ChecksumCollection(nil), ignoreChecksums)
-		if err != nil {
-			return fmt.Errorf("unable to update: %s", err)
-		}
-	}
-
 	if repo.Filter != "" {
 		context.Progress().Printf("Applying filter...\n")
 		var filterQuery deb.PackageQuery
@@ -96,11 +87,10 @@ func aptlyMirrorUpdate(cmd *commander.Command, args []string) error {
 	)

 	skipExistingPackages := context.Flags().Lookup("skip-existing-packages").Value.Get().(bool)
-	latestOnly := context.Flags().Lookup("latest").Value.Get().(bool)

 	context.Progress().Printf("Building download queue...\n")
 	queue, downloadSize, err = repo.BuildDownloadQueue(context.PackagePool(), collectionFactory.PackageCollection(),
-		collectionFactory.ChecksumCollection(nil), skipExistingPackages, latestOnly)
+		collectionFactory.ChecksumCollection(nil), skipExistingPackages)

 	if err != nil {
 		return fmt.Errorf("unable to update: %s", err)
@@ -302,7 +292,6 @@ Example:
 	cmd.Flag.Bool("ignore-checksums", false, "ignore checksum mismatches while downloading package files and metadata")
 	cmd.Flag.Bool("ignore-signatures", false, "disable verification of Release file signatures")
 	cmd.Flag.Bool("skip-existing-packages", false, "do not check file existence for packages listed in the internal database of the mirror")
-	cmd.Flag.Bool("latest", false, "download only latest version of each package (per architecture)")
 	cmd.Flag.Int64("download-limit", 0, "limit download speed (kbytes/sec)")
 	cmd.Flag.String("downloader", "default", "downloader to use (e.g. grab)")
 	cmd.Flag.Int("max-tries", 1, "max download tries till process fails with download error")
@@ -1,8 +1,6 @@
 package cmd

 import (
-	"strings"
-
 	"github.com/aptly-dev/aptly/pgp"
 	"github.com/smira/commander"
 	"github.com/smira/flag"
@@ -14,20 +12,7 @@ func getSigner(flags *flag.FlagSet) (pgp.Signer, error) {
 	}

 	signer := context.GetSigner()
-
-	var gpgKeys []string
-
-	// CLI args have priority over config
-	cliKeys := flags.Lookup("gpg-key").Value.Get().([]string)
-	if len(cliKeys) > 0 {
-		gpgKeys = cliKeys
-	} else if len(context.Config().GpgKeys) > 0 {
-		gpgKeys = context.Config().GpgKeys
-	}
-
-	for _, gpgKey := range gpgKeys {
-		signer.SetKey(gpgKey)
-	}
+	signer.SetKey(flags.Lookup("gpg-key").Value.String())
 	signer.SetKeyRing(flags.Lookup("keyring").Value.String(), flags.Lookup("secret-keyring").Value.String())
 	signer.SetPassphrase(flags.Lookup("passphrase").Value.String(), flags.Lookup("passphrase-file").Value.String())
 	signer.SetBatch(flags.Lookup("batch").Value.Get().(bool))
@@ -41,23 +26,6 @@ func getSigner(flags *flag.FlagSet) (pgp.Signer, error) {

 }

-type gpgKeyFlag struct {
-	gpgKeys []string
-}
-
-func (k *gpgKeyFlag) Set(value string) error {
-	k.gpgKeys = append(k.gpgKeys, value)
-	return nil
-}
-
-func (k *gpgKeyFlag) Get() interface{} {
-	return k.gpgKeys
-}
-
-func (k *gpgKeyFlag) String() string {
-	return strings.Join(k.gpgKeys, ",")
-}
-
 func makeCmdPublish() *commander.Command {
 	return &commander.Command{
 		UsageLine: "publish",
@@ -34,7 +34,7 @@ Example:
 	}
 	cmd.Flag.String("distribution", "", "distribution name to publish")
 	cmd.Flag.String("component", "", "component name to publish (for multi-component publishing, separate components with commas)")
-	cmd.Flag.Var(&gpgKeyFlag{}, "gpg-key", "GPG key ID to use when signing the release (flag is repeatable, can be specified multiple times)")
+	cmd.Flag.String("gpg-key", "", "GPG key ID to use when signing the release")
 	cmd.Flag.Var(&keyRingsFlag{}, "keyring", "GPG keyring to use (instead of default)")
 	cmd.Flag.String("secret-keyring", "", "GPG secret keyring to use (instead of default)")
 	cmd.Flag.String("passphrase", "", "GPG passphrase for the key (warning: could be insecure)")
@@ -51,9 +51,7 @@ Example:
 	cmd.Flag.String("codename", "", "codename to publish (defaults to distribution)")
 	cmd.Flag.Bool("force-overwrite", false, "overwrite files in package pool in case of mismatch")
 	cmd.Flag.Bool("acquire-by-hash", false, "provide index files by hash")
-	cmd.Flag.String("signed-by", "", "an optional field containing a comma separated list of OpenPGP key fingerprints to be used for validating the next Release file")
 	cmd.Flag.Bool("multi-dist", false, "enable multiple packages with the same filename in different distributions")
-	cmd.Flag.String("version", "", "version of the release")

 	return cmd
 }
@@ -150,18 +150,10 @@ func aptlyPublishSnapshotOrRepo(cmd *commander.Command, args []string) error {
 		published.AcquireByHash = context.Flags().Lookup("acquire-by-hash").Value.Get().(bool)
 	}

-	if context.Flags().IsSet("signed-by") {
-		published.SignedBy = context.Flags().Lookup("signed-by").Value.String()
-	}
-
 	if context.Flags().IsSet("multi-dist") {
 		published.MultiDist = context.Flags().Lookup("multi-dist").Value.Get().(bool)
 	}

-	if context.Flags().IsSet("version") {
-		published.Version = context.Flags().Lookup("version").Value.String()
-	}
-
 	duplicate := collectionFactory.PublishedRepoCollection().CheckDuplicate(published)
 	if duplicate != nil {
 		_ = collectionFactory.PublishedRepoCollection().LoadComplete(duplicate, collectionFactory)
@@ -238,7 +230,7 @@ Example:
 	}
 	cmd.Flag.String("distribution", "", "distribution name to publish")
 	cmd.Flag.String("component", "", "component name to publish (for multi-component publishing, separate components with commas)")
-	cmd.Flag.Var(&gpgKeyFlag{}, "gpg-key", "GPG key ID to use when signing the release (flag is repeatable, can be specified multiple times)")
+	cmd.Flag.String("gpg-key", "", "GPG key ID to use when signing the release")
 	cmd.Flag.Var(&keyRingsFlag{}, "keyring", "GPG keyring to use (instead of default)")
 	cmd.Flag.String("secret-keyring", "", "GPG secret keyring to use (instead of default)")
 	cmd.Flag.String("passphrase", "", "GPG passphrase for the key (warning: could be insecure)")
@@ -255,8 +247,6 @@ Example:
 	cmd.Flag.String("codename", "", "codename to publish (defaults to distribution)")
 	cmd.Flag.Bool("force-overwrite", false, "overwrite files in package pool in case of mismatch")
 	cmd.Flag.Bool("acquire-by-hash", false, "provide index files by hash")
-	cmd.Flag.String("signed-by", "", "an optional field containing a comma separated list of OpenPGP key fingerprints to be used for validating the next Release file")
-	cmd.Flag.String("version", "", "version of the release")
 	cmd.Flag.Bool("multi-dist", false, "enable multiple packages with the same filename in different distributions")

 	return cmd
@@ -99,14 +99,6 @@ func aptlyPublishSwitch(cmd *commander.Command, args []string) error {
 		published.SkipBz2 = context.Flags().Lookup("skip-bz2").Value.Get().(bool)
 	}

-	if context.Flags().IsSet("signed-by") {
-		published.SignedBy = context.Flags().Lookup("signed-by").Value.String()
-	}
-
-	if context.Flags().IsSet("version") {
-		published.Version = context.Flags().Lookup("version").Value.String()
-	}
-
 	if context.Flags().IsSet("multi-dist") {
 		published.MultiDist = context.Flags().Lookup("multi-dist").Value.Get().(bool)
 	}
@@ -159,7 +151,7 @@ This command would switch published repository (with one component) named ppa/wh
 `,
 		Flag: *flag.NewFlagSet("aptly-publish-switch", flag.ExitOnError),
 	}
-	cmd.Flag.Var(&gpgKeyFlag{}, "gpg-key", "GPG key ID to use when signing the release (flag is repeatable, can be specified multiple times)")
+	cmd.Flag.String("gpg-key", "", "GPG key ID to use when signing the release")
 	cmd.Flag.Var(&keyRingsFlag{}, "keyring", "GPG keyring to use (instead of default)")
 	cmd.Flag.String("secret-keyring", "", "GPG secret keyring to use (instead of default)")
 	cmd.Flag.String("passphrase", "", "GPG passphrase for the key (warning: could be insecure)")
@@ -170,8 +162,6 @@ This command would switch published repository (with one component) named ppa/wh
 	cmd.Flag.Bool("skip-bz2", false, "don't generate bzipped indexes")
 	cmd.Flag.String("component", "", "component names to update (for multi-component publishing, separate components with commas)")
 	cmd.Flag.Bool("force-overwrite", false, "overwrite files in package pool in case of mismatch")
-	cmd.Flag.String("signed-by", "", "an optional field containing a comma separated list of OpenPGP key fingerprints to be used for validating the next Release file")
-	cmd.Flag.String("version", "", "version of the release")
 	cmd.Flag.Bool("skip-cleanup", false, "don't remove unreferenced files in prefix/component")
 	cmd.Flag.Bool("multi-dist", false, "enable multiple packages with the same filename in different distributions")

@@ -60,26 +60,10 @@ func aptlyPublishUpdate(cmd *commander.Command, args []string) error {
 		published.SkipBz2 = context.Flags().Lookup("skip-bz2").Value.Get().(bool)
 	}

-	if context.Flags().IsSet("signed-by") {
-		published.SignedBy = context.Flags().Lookup("signed-by").Value.String()
-	}
-
-	if context.Flags().IsSet("origin") {
-		published.Origin = context.Flags().Lookup("origin").Value.String()
-	}
-
-	if context.Flags().IsSet("label") {
-		published.Label = context.Flags().Lookup("label").Value.String()
-	}
-
 	if context.Flags().IsSet("multi-dist") {
 		published.MultiDist = context.Flags().Lookup("multi-dist").Value.Get().(bool)
 	}

-	if context.Flags().IsSet("version") {
-		published.Version = context.Flags().Lookup("version").Value.String()
-	}
-
 	err = published.Publish(context.PackagePool(), context, collectionFactory, signer, context.Progress(), forceOverwrite, context.SkelPath())
 	if err != nil {
 		return fmt.Errorf("unable to publish: %s", err)
@@ -131,7 +115,7 @@ Example:
 `,
 		Flag: *flag.NewFlagSet("aptly-publish-update", flag.ExitOnError),
 	}
-	cmd.Flag.Var(&gpgKeyFlag{}, "gpg-key", "GPG key ID to use when signing the release (flag is repeatable, can be specified multiple times)")
+	cmd.Flag.String("gpg-key", "", "GPG key ID to use when signing the release")
 	cmd.Flag.Var(&keyRingsFlag{}, "keyring", "GPG keyring to use (instead of default)")
 	cmd.Flag.String("secret-keyring", "", "GPG secret keyring to use (instead of default)")
 	cmd.Flag.String("passphrase", "", "GPG passphrase for the key (warning: could be insecure)")
@@ -141,12 +125,8 @@ Example:
 	cmd.Flag.Bool("skip-contents", false, "don't generate Contents indexes")
 	cmd.Flag.Bool("skip-bz2", false, "don't generate bzipped indexes")
 	cmd.Flag.Bool("force-overwrite", false, "overwrite files in package pool in case of mismatch")
-	cmd.Flag.String("signed-by", "", "an optional field containing a comma separated list of OpenPGP key fingerprints to be used for validating the next Release file")
 	cmd.Flag.Bool("skip-cleanup", false, "don't remove unreferenced files in prefix/component")
 	cmd.Flag.Bool("multi-dist", false, "enable multiple packages with the same filename in different distributions")
-    cmd.Flag.String("origin", "", "overwrite origin name to publish")
-    cmd.Flag.String("label", "", "overwrite label to publish")
-    cmd.Flag.String("version", "", "version of the release")

 	return cmd
 }
@@ -185,7 +185,6 @@ local keyring="*-keyring=[gpg keyring to use when verifying Release file (could
                            $keyring \
                            "-with-sources=[download source packages in addition to binary packages]:$bool" \
                            "-with-udebs=[download .udeb packages (Debian installer support)]:$bool" \
-                            "-with-appstream=[download AppStream (DEP-11) metadata]:$bool" \
                            "(-)2:new mirror name: " ":archive url:_urls" ":distribution:($dists)" "*:components:_values -s ' ' components $components"
                        ;;
                    list)
@@ -212,7 +211,6 @@ local keyring="*-keyring=[gpg keyring to use when verifying Release file (could
                            $keyring \
                            "-max-tries=[max download tries till process fails with download error]:number: " \
                            "-skip-existing-packages=[do not check file existence for packages listed in the internal database of the mirror]:$bool" \
-                            "-latest=[download only latest version of each package (per architecture)]:$bool" \
                            "(-)2:mirror name:$mirrors"
                        ;;
                    rename)
@@ -225,7 +223,6 @@ local keyring="*-keyring=[gpg keyring to use when verifying Release file (could
                            "-filter-with-deps=[when filtering, include dependencies of matching packages as well]:$bool" \
                            "-with-sources=[download source packages in addition to binary packages]:$bool" \
                            "-with-udebs=[download .udeb packages (Debian installer support)]:$bool" \
-                            "-with-appstream=[download AppStream (DEP-11) metadata]:$bool" \
                            "(-)2:mirror name:$mirrors"
                        ;;
                    search)
@@ -203,7 +203,7 @@ _aptly()
          "create")
            if [[ $numargs -eq 0 ]]; then
              if [[ "$cur" == -* ]]; then
-                COMPREPLY=($(compgen -W "-filter= -filter-with-deps -force-components -ignore-signatures -keyring= -with-appstream -with-installer -with-sources -with-udebs" -- ${cur}))
+                COMPREPLY=($(compgen -W "-filter= -filter-with-deps -force-components -ignore-signatures -keyring= -with-installer -with-sources -with-udebs" -- ${cur}))
                return 0
              fi
            fi
@@ -211,7 +211,7 @@ _aptly()
          "edit")
            if [[ $numargs -eq 0 ]]; then
              if [[ "$cur" == -* ]]; then
-                COMPREPLY=($(compgen -W "-archive-url= -filter= -filter-with-deps -ignore-signatures -keyring= -with-appstream -with-installer -with-sources -with-udebs" -- ${cur}))
+                COMPREPLY=($(compgen -W "-archive-url= -filter= -filter-with-deps -ignore-signatures -keyring= -with-installer -with-sources -with-udebs" -- ${cur}))
              else
                COMPREPLY=($(compgen -W "$(__aptly_mirror_list)" -- ${cur}))
              fi
@@ -263,7 +263,7 @@ _aptly()
          "update")
            if [[ $numargs -eq 0 ]]; then
              if [[ "$cur" == -* ]]; then
-                COMPREPLY=($(compgen -W "-force -download-limit= -downloader= -ignore-checksums -ignore-signatures -keyring= -skip-existing-packages -latest" -- ${cur}))
+                COMPREPLY=($(compgen -W "-force -download-limit= -downloader= -ignore-checksums -ignore-signatures -keyring= -skip-existing-packages" -- ${cur}))
              else
                COMPREPLY=($(compgen -W "$(__aptly_mirror_list)" -- ${cur}))
              fi
@@ -11,7 +11,7 @@ func Test(t *testing.T) {
 	TestingT(t)
 }

-type ProgressSuite struct{}
+type ProgressSuite struct {}

 var _ = Suite(&ProgressSuite{})

@@ -14,7 +14,7 @@ func Test(t *testing.T) {
 }

 type EtcDDBSuite struct {
-	db database.Storage
+	db  database.Storage
 }

 var _ = Suite(&EtcDDBSuite{})
@@ -133,7 +133,7 @@ func (s *EtcDDBSuite) TestTransactionCommit(c *C) {
 	v, err := s.db.Get(key)
 	c.Assert(err, IsNil)
 	c.Check(v, DeepEquals, value)
-	err = transaction.Delete(key)
+        err = transaction.Delete(key)
 	c.Assert(err, IsNil)

 	_, err = transaction.Get(key2)
@@ -156,3 +156,4 @@ func (s *EtcDDBSuite) TestTransactionCommit(c *C) {
 	_, err = transaction.Get(key)
 	c.Assert(err, NotNil)
 }
+
@@ -26,11 +26,8 @@ var (
 		"Version",
 		"Codename",
 		"Date",
-		"Valid-Until",
 		"NotAutomatic",
 		"ButAutomaticUpgrades",
-		"Acquire-By-Hash",
-		"Signed-By",
 		"Architectures",
 		"Architecture",
 		"Components",
@@ -172,39 +172,6 @@ func (l *PackageList) ForEach(handler func(*Package) error) error {
 	return err
 }

-// FilterLatest creates a copy of the package list containing only the
-// latest version for each package name/architecture pair.
-func (l *PackageList) FilterLatest() (*PackageList, error) {
-	if l == nil {
-		return nil, fmt.Errorf("package list is nil")
-	}
-
-	filtered := make(map[string]*Package, l.Len())
-
-	err := l.ForEach(func(p *Package) error {
-		key := p.Architecture + "|" + p.Name
-
-		if existing, found := filtered[key]; !found || CompareVersions(p.Version, existing.Version) > 0 {
-			filtered[key] = p
-		}
-
-		return nil
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	result := NewPackageListWithDuplicates(l.duplicatesAllowed, len(filtered))
-
-	for _, pkg := range filtered {
-		if err = result.Add(pkg); err != nil {
-			return nil, err
-		}
-	}
-
-	return result, nil
-}
-
 // ForEachIndexed calls handler for each package in list in indexed order
 func (l *PackageList) ForEachIndexed(handler func(*Package) error) error {
 	if !l.indexed {
@@ -503,52 +503,3 @@ func (s *PackageListSuite) TestArchitectures(c *C) {
 	sort.Strings(archs)
 	c.Check(archs, DeepEquals, []string{"amd64", "arm", "i386", "s390"})
 }
-
-func (s *PackageListSuite) TestFilterLatest(c *C) {
-	list := NewPackageList()
-
-	older := packageStanza.Copy()
-	older["Version"] = "1.0"
-	olderPkg := NewPackageFromControlFile(older)
-	_ = list.Add(olderPkg)
-
-	newer := packageStanza.Copy()
-	newer["Version"] = "2.0"
-	newerPkg := NewPackageFromControlFile(newer)
-	_ = list.Add(newerPkg)
-
-	shared := packageStanza.Copy()
-	shared["Architecture"] = ArchitectureAll
-	shared["Version"] = "3.0"
-	shared["Package"] = "shared"
-	sharedPkg := NewPackageFromControlFile(shared)
-	_ = list.Add(sharedPkg)
-
-	filtered, err := list.FilterLatest()
-	c.Assert(err, IsNil)
-	c.Assert(filtered.Len(), Equals, 2)
-	c.Check(filtered.Has(newerPkg), Equals, true)
-	c.Check(filtered.Has(sharedPkg), Equals, true)
-}
-
-func (s *PackageListSuite) TestFilterLatestPreservesDuplicatesFlag(c *C) {
-	list := NewPackageListWithDuplicates(true, 2)
-
-	_ = list.Add(NewPackageFromControlFile(packageStanza.Copy()))
-
-	another := packageStanza.Copy()
-	another["Version"] = "7.41-1"
-	_ = list.Add(NewPackageFromControlFile(another))
-
-	filtered, err := list.FilterLatest()
-	c.Assert(err, IsNil)
-	c.Assert(filtered.duplicatesAllowed, Equals, true)
-}
-
-func (s *PackageListSuite) TestFilterLatestNil(c *C) {
-	var list *PackageList
-
-	filtered, err := list.FilterLatest()
-	c.Assert(err, ErrorMatches, "package list is nil")
-	c.Assert(filtered, IsNil)
-}
@@ -59,7 +59,7 @@ func (s *PackageSuite) TestNewUdebFromPara(c *C) {
 }

 func (s *PackageSuite) TestNewInstallerFromPara(c *C) {
-	repo, _ := NewRemoteRepo("yandex", "http://example.com/debian", "squeeze", []string{"main"}, []string{}, false, false, false, false)
+	repo, _ := NewRemoteRepo("yandex", "http://example.com/debian", "squeeze", []string{"main"}, []string{}, false, false, false)
 	downloader := http.NewFakeDownloader()
 	downloader.ExpectResponse("http://example.com/debian/dists/squeeze/main/installer-i386/current/images/MANIFEST.udebs", "MANIFEST.udebs")
 	downloader.ExpectResponse("http://example.com/debian/dists/squeeze/main/installer-i386/current/images/udeb.list", "udeb.list")
@@ -28,11 +28,6 @@ func ParsePPA(ppaURL string, config *utils.ConfigStructure) (url string, distrib
 		}
 	}

-	baseurl := config.PpaBaseURL
-	if baseurl == "" {
-		baseurl = "http://ppa.launchpad.net"
-	}
-
 	codename := config.PpaCodename
 	if codename == "" {
 		codename, err = getCodename()
@@ -44,7 +39,7 @@ func ParsePPA(ppaURL string, config *utils.ConfigStructure) (url string, distrib

 	distribution = codename
 	components = []string{"main"}
-	url = fmt.Sprintf("%s/%s/%s/%s", baseurl, matches[1], matches[2], distributorID)
+	url = fmt.Sprintf("http://ppa.launchpad.net/%s/%s/%s", matches[1], matches[2], distributorID)

 	return
 }
@@ -9,7 +9,6 @@ import (
 	"os"
 	"path/filepath"
 	"sort"
-	"strconv"
 	"strings"
 	"time"

@@ -55,7 +54,6 @@ type PublishedRepo struct {
 	Label                string
 	Suite                string
 	Codename             string
-	Version              string
 	// Architectures is a list of all architectures published
 	Architectures []string
 	// SourceKind is "local"/"repo"
@@ -83,11 +81,6 @@ type PublishedRepo struct {
 	// Provide index files per hash also
 	AcquireByHash bool

-	// An optional field containing a comma separated list
-	// of OpenPGP key fingerprints to be used
-	// for validating the next Release file
-	SignedBy string
-
 	// Support multiple distributions
 	MultiDist bool

@@ -527,7 +520,6 @@ func (p *PublishedRepo) MarshalJSON() ([]byte, error) {
 		"Origin":               p.Origin,
 		"Suite":                p.Suite,
 		"Codename":             p.Codename,
-		"Version":              p.Version,
 		"NotAutomatic":         p.NotAutomatic,
 		"ButAutomaticUpgrades": p.ButAutomaticUpgrades,
 		"Prefix":               p.Prefix,
@@ -537,7 +529,6 @@ func (p *PublishedRepo) MarshalJSON() ([]byte, error) {
 		"Storage":              p.Storage,
 		"SkipContents":         p.SkipContents,
 		"AcquireByHash":        p.AcquireByHash,
-		"SignedBy":             p.SignedBy,
 		"MultiDist":            p.MultiDist,
 	})
 }
@@ -1055,38 +1046,6 @@ func (p *PublishedRepo) Publish(packagePool aptly.PackagePool, publishedStorageP
 			}
 		}

-		// Pass-through AppStream (DEP-11) files from snapshots
-		for component, item := range p.sourceItems {
-			if item.snapshot == nil || len(item.snapshot.AppStreamFiles) == 0 {
-				continue
-			}
-
-			prefix := component + "/"
-			for relPath, poolPath := range item.snapshot.AppStreamFiles {
-				if !strings.HasPrefix(relPath, prefix) {
-					continue
-				}
-				withinComponent := strings.TrimPrefix(relPath, prefix)
-
-				poolFile, err := packagePool.Open(poolPath)
-				if err != nil {
-					return fmt.Errorf("unable to open AppStream file from pool: %v", err)
-				}
-
-				bufWriter, err := indexes.SkelIndex(component, withinComponent).BufWriter()
-				if err != nil {
-					_ = poolFile.Close()
-					return fmt.Errorf("unable to generate AppStream index: %v", err)
-				}
-
-				_, err = bufio.NewReader(poolFile).WriteTo(bufWriter)
-				_ = poolFile.Close()
-				if err != nil {
-					return fmt.Errorf("unable to write AppStream file: %v", err)
-				}
-			}
-		}
-
 		udebs := []bool{false}
 		if hadUdebs {
 			udebs = append(udebs, true)
@@ -1111,12 +1070,6 @@ func (p *PublishedRepo) Publish(packagePool aptly.PackagePool, publishedStorageP
 				if p.AcquireByHash {
 					release["Acquire-By-Hash"] = "yes"
 				}
-				if p.SignedBy != "" {
-					release["Signed-By"] = p.SignedBy
-				}
-				if p.Version != "" {
-					release["Version"] = p.Version
-				}

 				var bufWriter *bufio.Writer
 				bufWriter, err = indexes.ReleaseIndex(component, arch, udeb).BufWriter()
@@ -1173,31 +1126,11 @@ func (p *PublishedRepo) Publish(packagePool aptly.PackagePool, publishedStorageP
 	release["Label"] = p.GetLabel()
 	release["Suite"] = p.GetSuite()
 	release["Codename"] = p.GetCodename()
-	datetimeformat := "Mon, 2 Jan 2006 15:04:05 MST"
-
-	publishDate := time.Now().UTC()
-	if epoch := os.Getenv("SOURCE_DATE_EPOCH"); epoch != "" {
-		if sec, err := strconv.ParseInt(epoch, 10, 64); err == nil {
-			publishDate = time.Unix(sec, 0).UTC()
-		}
-	}
-	release["Date"] = publishDate.Format(datetimeformat)
+	release["Date"] = time.Now().UTC().Format("Mon, 2 Jan 2006 15:04:05 MST")
 	release["Architectures"] = strings.Join(utils.StrSlicesSubstract(p.Architectures, []string{ArchitectureSource}), " ")
 	if p.AcquireByHash {
 		release["Acquire-By-Hash"] = "yes"
 	}
-	if p.SignedBy != "" {
-		// "If the field is present, a client should only accept future updates
-		// to the repository that are signed with keys listed in the field.
-		// The field should be ignored if the Valid-Until field
-		// is not present or if it is expired."
-		release["Signed-By"] = p.SignedBy
-		// Let's use a century as a "forever" value.
-		release["Valid-Until"] = publishDate.AddDate(100, 0, 0).Format(datetimeformat)
-	}
-	if p.Version != "" {
-        release["Version"] = p.Version
-    }
 	release["Description"] = " Generated by aptly\n"
 	release["MD5Sum"] = ""
 	release["SHA1"] = ""
@@ -13,7 +13,6 @@ import (
 	"github.com/aptly-dev/aptly/database"
 	"github.com/aptly-dev/aptly/database/goleveldb"
 	"github.com/aptly-dev/aptly/files"
-	"github.com/aptly-dev/aptly/utils"
 	"github.com/ugorji/go/codec"

 	. "gopkg.in/check.v1"
@@ -116,7 +115,7 @@ func (s *PublishedRepoSuite) SetUpTest(c *C) {

 	s.reflist = NewPackageRefListFromPackageList(s.list)

-	repo, _ := NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{}, false, false, false, false)
+	repo, _ := NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{}, false, false, false)
 	repo.packageRefs = s.reflist
 	_ = s.factory.RemoteRepoCollection().Add(repo)

@@ -426,81 +425,6 @@ func (s *PublishedRepoSuite) TestPublish(c *C) {
 	c.Assert(err, IsNil)
 }

-func (s *PublishedRepoSuite) TestPublishAppStream(c *C) {
-	// Components + icons
-	content1 := []byte("DEP-11 test content for Components-amd64.yml.gz")
-	tmpFile1 := filepath.Join(c.MkDir(), "Components-amd64.yml.gz")
-	c.Assert(os.WriteFile(tmpFile1, content1, 0644), IsNil)
-
-	checksums1 := utils.ChecksumInfo{Size: int64(len(content1))}
-	poolPath1, err := s.packagePool.Import(tmpFile1, "Components-amd64.yml.gz", &checksums1, false, s.cs)
-	c.Assert(err, IsNil)
-
-	content2 := []byte("DEP-11 icons tar data")
-	tmpFile2 := filepath.Join(c.MkDir(), "icons-48x48.tar.gz")
-	c.Assert(os.WriteFile(tmpFile2, content2, 0644), IsNil)
-
-	checksums2 := utils.ChecksumInfo{Size: int64(len(content2))}
-	poolPath2, err := s.packagePool.Import(tmpFile2, "icons-48x48.tar.gz", &checksums2, false, s.cs)
-	c.Assert(err, IsNil)
-
-	// Include contrib file that should be skipped
-	contribContent := []byte("DEP-11 contrib content")
-	tmpFile3 := filepath.Join(c.MkDir(), "Components-contrib.yml.gz")
-	c.Assert(os.WriteFile(tmpFile3, contribContent, 0644), IsNil)
-
-	checksums3 := utils.ChecksumInfo{Size: int64(len(contribContent))}
-	poolPath3, err := s.packagePool.Import(tmpFile3, "Components-contrib.yml.gz", &checksums3, false, s.cs)
-	c.Assert(err, IsNil)
-
-	s.snapshot.AppStreamFiles = map[string]string{
-		"main/dep11/Components-amd64.yml.gz":    poolPath1,
-		"main/dep11/icons-48x48.tar.gz":         poolPath2,
-		"contrib/dep11/Components-amd64.yml.gz": poolPath3,
-	}
-
-	err = s.repo.Publish(s.packagePool, s.provider, s.factory, &NullSigner{}, nil, false, "")
-	c.Assert(err, IsNil)
-
-	// Both main files should exist
-	appstreamPath1 := filepath.Join(s.publishedStorage.PublicPath(), "ppa/dists/squeeze/main/dep11/Components-amd64.yml.gz")
-	c.Check(appstreamPath1, PathExists)
-	actual1, err := os.ReadFile(appstreamPath1)
-	c.Assert(err, IsNil)
-	c.Check(actual1, DeepEquals, content1)
-
-	appstreamPath2 := filepath.Join(s.publishedStorage.PublicPath(), "ppa/dists/squeeze/main/dep11/icons-48x48.tar.gz")
-	c.Check(appstreamPath2, PathExists)
-	actual2, err := os.ReadFile(appstreamPath2)
-	c.Assert(err, IsNil)
-	c.Check(actual2, DeepEquals, content2)
-
-	// Contrib file should not appear
-	contribPath := filepath.Join(s.publishedStorage.PublicPath(), "ppa/dists/squeeze/contrib/dep11/Components-amd64.yml.gz")
-	_, statErr := os.Stat(contribPath)
-	c.Check(os.IsNotExist(statErr), Equals, true)
-
-	// Release file should reference AppStream files
-	rf, err := os.Open(filepath.Join(s.publishedStorage.PublicPath(), "ppa/dists/squeeze/Release"))
-	c.Assert(err, IsNil)
-	defer func() { _ = rf.Close() }()
-
-	cfr := NewControlFileReader(rf, true, false)
-	st, err := cfr.ReadStanza()
-	c.Assert(err, IsNil)
-
-	c.Check(st["MD5Sum"], Matches, "(?s).*main/dep11/Components-amd64\\.yml\\.gz.*")
-	c.Check(st["SHA256"], Matches, "(?s).*main/dep11/Components-amd64\\.yml\\.gz.*")
-
-	// Pool open error
-	s.snapshot.AppStreamFiles = map[string]string{
-		"main/dep11/Components-amd64.yml.gz": "nonexistent/pool/path",
-	}
-
-	err = s.repo.Publish(s.packagePool, s.provider, s.factory, &NullSigner{}, nil, false, "")
-	c.Assert(err, ErrorMatches, "unable to open AppStream file from pool.*")
-}
-
 func (s *PublishedRepoSuite) TestPublishNoSigner(c *C) {
 	err := s.repo.Publish(s.packagePool, s.provider, s.factory, nil, nil, false, "")
 	c.Assert(err, IsNil)
@@ -509,47 +433,6 @@ func (s *PublishedRepoSuite) TestPublishNoSigner(c *C) {
 	c.Check(filepath.Join(s.publishedStorage.PublicPath(), "ppa/dists/squeeze/main/binary-i386/Release"), PathExists)
 }

-func (s *PublishedRepoSuite) TestPublishSourceDateEpoch(c *C) {
-	// Test with SOURCE_DATE_EPOCH set
-	_ = os.Setenv("SOURCE_DATE_EPOCH", "1234567890")
-	defer func() { _ = os.Unsetenv("SOURCE_DATE_EPOCH") }()
-
-	err := s.repo.Publish(s.packagePool, s.provider, s.factory, &NullSigner{}, nil, false, "")
-	c.Assert(err, IsNil)
-
-	rf, err := os.Open(filepath.Join(s.publishedStorage.PublicPath(), "ppa/dists/squeeze/Release"))
-	c.Assert(err, IsNil)
-	defer func() { _ = rf.Close() }()
-
-	cfr := NewControlFileReader(rf, true, false)
-	st, err := cfr.ReadStanza()
-	c.Assert(err, IsNil)
-
-	// Expected date for Unix timestamp 1234567890: Fri, 13 Feb 2009 23:31:30 UTC
-	c.Check(st["Date"], Equals, "Fri, 13 Feb 2009 23:31:30 UTC")
-}
-
-func (s *PublishedRepoSuite) TestPublishSourceDateEpochInvalid(c *C) {
-	// Test with invalid SOURCE_DATE_EPOCH (should fallback to current time)
-	_ = os.Setenv("SOURCE_DATE_EPOCH", "invalid")
-	defer func() { _ = os.Unsetenv("SOURCE_DATE_EPOCH") }()
-
-	err := s.repo2.Publish(s.packagePool, s.provider, s.factory, nil, nil, false, "")
-	c.Assert(err, IsNil)
-
-	rf, err := os.Open(filepath.Join(s.publishedStorage.PublicPath(), "ppa/dists/maverick/Release"))
-	c.Assert(err, IsNil)
-	defer func() { _ = rf.Close() }()
-
-	cfr := NewControlFileReader(rf, true, false)
-	st, err := cfr.ReadStanza()
-	c.Assert(err, IsNil)
-
-	// Should have a valid Date field (not empty, not the fixed date from SOURCE_DATE_EPOCH)
-	c.Check(st["Date"], Not(Equals), "")
-	c.Check(st["Date"], Not(Equals), "Fri, 13 Feb 2009 23:31:30 UTC")
-}
-
 func (s *PublishedRepoSuite) TestPublishLocalRepo(c *C) {
 	err := s.repo2.Publish(s.packagePool, s.provider, s.factory, nil, nil, false, "")
 	c.Assert(err, IsNil)
@@ -65,7 +65,7 @@ func (s *PackageRefListSuite) TestNewPackageListFromRefList(c *C) {
 	list, err := NewPackageListFromRefList(reflist, coll, nil)
 	c.Assert(err, IsNil)
 	c.Check(list.Len(), Equals, 4)
-	c.Check(list.Add(s.p4), ErrorMatches, "package already exists and is different: .*")
+        c.Check(list.Add(s.p4), ErrorMatches, "package already exists and is different: .*")

 	list, err = NewPackageListFromRefList(nil, coll, nil)
 	c.Assert(err, IsNil)
@@ -70,10 +70,6 @@ type RemoteRepo struct {
 	DownloadUdebs bool
 	// Should we download installer files?
 	DownloadInstaller bool
-	// Should we download AppStream (DEP-11) metadata?
-	DownloadAppStream bool
-	// AppStream files: relative path (e.g. "main/dep11/Components-amd64.yml.gz") → pool path
-	AppStreamFiles map[string]string `codec:"AppStreamFiles" json:"-"`
 	// Packages for json output
 	Packages []string `codec:"-" json:",omitempty"`
 	// "Snapshot" of current list of packages
@@ -86,7 +82,7 @@ type RemoteRepo struct {

 // NewRemoteRepo creates new instance of Debian remote repository with specified params
 func NewRemoteRepo(name string, archiveRoot string, distribution string, components []string,
-	architectures []string, downloadSources bool, downloadUdebs bool, downloadInstaller bool, downloadAppStream bool) (*RemoteRepo, error) {
+	architectures []string, downloadSources bool, downloadUdebs bool, downloadInstaller bool) (*RemoteRepo, error) {
 	result := &RemoteRepo{
 		UUID:              uuid.NewString(),
 		Name:              name,
@@ -97,7 +93,6 @@ func NewRemoteRepo(name string, archiveRoot string, distribution string, compone
 		DownloadSources:   downloadSources,
 		DownloadUdebs:     downloadUdebs,
 		DownloadInstaller: downloadInstaller,
-		DownloadAppStream: downloadAppStream,
 	}

 	err := result.prepare()
@@ -116,9 +111,6 @@ func NewRemoteRepo(name string, archiveRoot string, distribution string, compone
 		if result.DownloadUdebs {
 			return nil, fmt.Errorf("debian-installer udebs aren't supported for flat repos")
 		}
-		if result.DownloadAppStream {
-			return nil, fmt.Errorf("AppStream (DEP-11) metadata isn't supported for flat repos")
-		}
 		result.Components = nil
 	}

@@ -155,9 +147,6 @@ func (repo *RemoteRepo) String() string {
 	if repo.DownloadInstaller {
 		srcFlag += " [installer]"
 	}
-	if repo.DownloadAppStream {
-		srcFlag += " [appstream]"
-	}
 	distribution := repo.Distribution
 	if distribution == "" {
 		distribution = "./"
@@ -275,82 +264,6 @@ func (repo *RemoteRepo) InstallerPath(component string, architecture string) str
 	return fmt.Sprintf("%s/installer-%s/current/images/SHA256SUMS", component, architecture)
 }

-// AppStreamPaths returns dep11 file paths from ReleaseFiles for a given component
-func (repo *RemoteRepo) AppStreamPaths(component string) []string {
-	prefix := component + "/dep11/"
-	var paths []string
-	for path := range repo.ReleaseFiles {
-		if strings.HasPrefix(path, prefix) {
-			paths = append(paths, path)
-		}
-	}
-	sort.Strings(paths)
-	return paths
-}
-
-// DownloadAppStreamFiles downloads AppStream (DEP-11) metadata files and imports them into the pool
-func (repo *RemoteRepo) DownloadAppStreamFiles(progress aptly.Progress, d aptly.Downloader,
-	packagePool aptly.PackagePool, checksumStorage aptly.ChecksumStorage, ignoreChecksums bool) error {
-
-	repo.AppStreamFiles = make(map[string]string)
-
-	for _, component := range repo.Components {
-		paths := repo.AppStreamPaths(component)
-		if len(paths) == 0 {
-			continue
-		}
-
-		for _, relativePath := range paths {
-			info, ok := repo.ReleaseFiles[relativePath]
-			if !ok {
-				continue
-			}
-
-			url := repo.IndexesRootURL().ResolveReference(&url.URL{Path: relativePath}).String()
-
-			if progress != nil {
-				progress.Printf("Downloading AppStream file %s...\n", relativePath)
-			}
-
-			tempDir, err := os.MkdirTemp("", "aptly-appstream-*")
-			if err != nil {
-				return fmt.Errorf("unable to create temp dir for AppStream file %s: %s", relativePath, err)
-			}
-
-			tempPath := path.Join(tempDir, path.Base(relativePath))
-
-			var expected *utils.ChecksumInfo
-			if !ignoreChecksums {
-				expected = &info
-			}
-
-			err = d.DownloadWithChecksum(gocontext.TODO(), url, tempPath, expected, ignoreChecksums)
-			if err != nil {
-				_ = os.RemoveAll(tempDir)
-				// Skip files that are not found (some repos list dep11 files but don't serve them)
-				if herr, ok := err.(*http.Error); ok && (herr.Code == 404 || herr.Code == 403) {
-					if progress != nil {
-						progress.ColoredPrintf("@y[!]@| @!skipping AppStream file %s: not found@|", relativePath)
-					}
-					continue
-				}
-				return fmt.Errorf("unable to download AppStream file %s: %s", relativePath, err)
-			}
-
-			basename := path.Base(relativePath)
-			poolPath, err := packagePool.Import(tempPath, basename, &info, true, checksumStorage)
-			_ = os.RemoveAll(tempDir)
-			if err != nil {
-				return fmt.Errorf("unable to import AppStream file %s: %s", relativePath, err)
-			}
-
-			repo.AppStreamFiles[relativePath] = poolPath
-		}
-	}
-
-	return nil
-}
-
 // PackageURL returns URL of package file relative to repository root
 // architecture
 func (repo *RemoteRepo) PackageURL(filename string) *url.URL {
@@ -661,7 +574,7 @@ func (repo *RemoteRepo) DownloadPackageIndexes(progress aptly.Progress, d aptly.
 					if progress != nil {
 						progress.ColoredPrintf("@y[!]@| @!skipping package %s: duplicate in packages index@|", p)
 					}
-				} else {
+				} else if err != nil {
 					return err
 				}
 			}
@@ -699,19 +612,7 @@ func (repo *RemoteRepo) ApplyFilter(dependencyOptions int, filterQuery PackageQu
 }

 // BuildDownloadQueue builds queue, discards current PackageList
-func (repo *RemoteRepo) BuildDownloadQueue(packagePool aptly.PackagePool, packageCollection *PackageCollection, checksumStorage aptly.ChecksumStorage, skipExistingPackages, latestOnly bool) (queue []PackageDownloadTask, downloadSize int64, err error) {
-	if repo.packageList == nil {
-		err = fmt.Errorf("package list is empty, please (re)download package indexes")
-		return
-	}
-
-	if latestOnly {
-		repo.packageList, err = repo.packageList.FilterLatest()
-		if err != nil {
-			return
-		}
-	}
-
+func (repo *RemoteRepo) BuildDownloadQueue(packagePool aptly.PackagePool, packageCollection *PackageCollection, checksumStorage aptly.ChecksumStorage, skipExistingPackages bool) (queue []PackageDownloadTask, downloadSize int64, err error) {
 	queue = make([]PackageDownloadTask, 0, repo.packageList.Len())
 	seen := make(map[string]int, repo.packageList.Len())

@@ -2,7 +2,6 @@ package deb

 import (
 	"errors"
-	"fmt"
 	"io"
 	"os"
 	"sort"
@@ -91,8 +90,8 @@ type RemoteRepoSuite struct {
 var _ = Suite(&RemoteRepoSuite{})

 func (s *RemoteRepoSuite) SetUpTest(c *C) {
-	s.repo, _ = NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian", "squeeze", []string{"main"}, []string{}, false, false, false, false)
-	s.flat, _ = NewRemoteRepo("exp42", "http://repos.express42.com/virool/precise/", "./", []string{}, []string{}, false, false, false, false)
+	s.repo, _ = NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian", "squeeze", []string{"main"}, []string{}, false, false, false)
+	s.flat, _ = NewRemoteRepo("exp42", "http://repos.express42.com/virool/precise/", "./", []string{}, []string{}, false, false, false)
 	s.downloader = http.NewFakeDownloader().ExpectResponse("http://mirror.yandex.ru/debian/dists/squeeze/Release", exampleReleaseFile)
 	s.progress = console.NewProgress(false)
 	s.db, _ = goleveldb.NewOpenDB(c.MkDir())
@@ -109,7 +108,7 @@ func (s *RemoteRepoSuite) TearDownTest(c *C) {
 }

 func (s *RemoteRepoSuite) TestInvalidURL(c *C) {
-	_, err := NewRemoteRepo("s", "http://lolo%2", "squeeze", []string{"main"}, []string{}, false, false, false, false)
+	_, err := NewRemoteRepo("s", "http://lolo%2", "squeeze", []string{"main"}, []string{}, false, false, false)
 	c.Assert(err, ErrorMatches, ".*(hexadecimal escape in host|percent-encoded characters in host|invalid URL escape).*")
 }

@@ -118,15 +117,12 @@ func (s *RemoteRepoSuite) TestFlatCreation(c *C) {
 	c.Check(s.flat.Distribution, Equals, "./")
 	c.Check(s.flat.Components, IsNil)

-	flat2, _ := NewRemoteRepo("flat2", "http://pkg.jenkins-ci.org/debian-stable", "binary/", []string{}, []string{}, false, false, false, false)
+	flat2, _ := NewRemoteRepo("flat2", "http://pkg.jenkins-ci.org/debian-stable", "binary/", []string{}, []string{}, false, false, false)
 	c.Check(flat2.IsFlat(), Equals, true)
 	c.Check(flat2.Distribution, Equals, "./binary/")

-	_, err := NewRemoteRepo("fl", "http://some.repo/", "./", []string{"main"}, []string{}, false, false, false, false)
+	_, err := NewRemoteRepo("fl", "http://some.repo/", "./", []string{"main"}, []string{}, false, false, false)
 	c.Check(err, ErrorMatches, "components aren't supported for flat repos")
-
-	_, err = NewRemoteRepo("fl", "http://some.repo/", "./", []string{}, []string{}, false, false, false, true)
-	c.Check(err, ErrorMatches, "AppStream \\(DEP-11\\) metadata isn't supported for flat repos")
 }

 func (s *RemoteRepoSuite) TestString(c *C) {
@@ -139,43 +135,6 @@ func (s *RemoteRepoSuite) TestString(c *C) {
 	s.flat.DownloadSources = true
 	c.Check(s.repo.String(), Equals, "[yandex]: http://mirror.yandex.ru/debian/ squeeze [src] [udeb] [installer]")
 	c.Check(s.flat.String(), Equals, "[exp42]: http://repos.express42.com/virool/precise/ ./ [src]")
-
-	s.repo.DownloadAppStream = true
-	c.Check(s.repo.String(), Equals, "[yandex]: http://mirror.yandex.ru/debian/ squeeze [src] [udeb] [installer] [appstream]")
-
-	// AppStream is not supported for flat repos, so no flat test here
-}
-
-func (s *RemoteRepoSuite) TestAppStreamPaths(c *C) {
-	s.repo.ReleaseFiles = nil
-	c.Check(s.repo.AppStreamPaths("main"), DeepEquals, []string(nil))
-
-	s.repo.ReleaseFiles = map[string]utils.ChecksumInfo{
-		"main/binary-amd64/Packages":              {Size: 100},
-		"main/dep11/Components-amd64.yml.gz":       {Size: 200},
-		"main/dep11/Components-i386.yml.gz":         {Size: 300},
-		"main/dep11/icons-48x48.tar.gz":             {Size: 400},
-		"contrib/dep11/Components-amd64.yml.gz":     {Size: 500},
-		"main/source/Sources":                       {Size: 600},
-	}
-
-	paths := s.repo.AppStreamPaths("main")
-	c.Check(paths, DeepEquals, []string{
-		"main/dep11/Components-amd64.yml.gz",
-		"main/dep11/Components-i386.yml.gz",
-		"main/dep11/icons-48x48.tar.gz",
-	})
-
-	paths = s.repo.AppStreamPaths("contrib")
-	c.Check(paths, DeepEquals, []string{
-		"contrib/dep11/Components-amd64.yml.gz",
-	})
-
-	paths = s.repo.AppStreamPaths("non-free")
-	c.Check(paths, DeepEquals, []string(nil))
-
-	s.repo.ReleaseFiles = map[string]utils.ChecksumInfo{}
-	c.Check(s.repo.AppStreamPaths("main"), DeepEquals, []string(nil))
 }

 func (s *RemoteRepoSuite) TestNumPackages(c *C) {
@@ -277,13 +236,13 @@ func (s *RemoteRepoSuite) TestFetchNullVerifier2(c *C) {
 }

 func (s *RemoteRepoSuite) TestFetchWrongArchitecture(c *C) {
-	s.repo, _ = NewRemoteRepo("s", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{"xyz"}, false, false, false, false)
+	s.repo, _ = NewRemoteRepo("s", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{"xyz"}, false, false, false)
 	err := s.repo.Fetch(s.downloader, nil, true)
 	c.Assert(err, ErrorMatches, "architecture xyz not available in repo.*")
 }

 func (s *RemoteRepoSuite) TestFetchWrongComponent(c *C) {
-	s.repo, _ = NewRemoteRepo("s", "http://mirror.yandex.ru/debian/", "squeeze", []string{"xyz"}, []string{"i386"}, false, false, false, false)
+	s.repo, _ = NewRemoteRepo("s", "http://mirror.yandex.ru/debian/", "squeeze", []string{"xyz"}, []string{"i386"}, false, false, false)
 	err := s.repo.Fetch(s.downloader, nil, true)
 	c.Assert(err, ErrorMatches, "component xyz not available in repo.*")
 }
@@ -322,7 +281,7 @@ func (s *RemoteRepoSuite) TestDownload(c *C) {
 	c.Assert(err, IsNil)
 	c.Assert(s.downloader.Empty(), Equals, true)

-	queue, size, err := s.repo.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false, false)
+	queue, size, err := s.repo.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false)
 	c.Assert(err, IsNil)
 	c.Check(size, Equals, int64(3))
 	c.Check(queue, HasLen, 1)
@@ -349,7 +308,7 @@ func (s *RemoteRepoSuite) TestDownload(c *C) {
 	c.Assert(err, IsNil)
 	c.Assert(s.downloader.Empty(), Equals, true)

-	queue, size, err = s.repo.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, true, false)
+	queue, size, err = s.repo.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, true)
 	c.Assert(err, IsNil)
 	c.Check(size, Equals, int64(0))
 	c.Check(queue, HasLen, 0)
@@ -370,7 +329,7 @@ func (s *RemoteRepoSuite) TestDownload(c *C) {
 	c.Assert(err, IsNil)
 	c.Assert(s.downloader.Empty(), Equals, true)

-	queue, size, err = s.repo.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false, false)
+	queue, size, err = s.repo.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false)
 	c.Assert(err, IsNil)
 	c.Check(size, Equals, int64(3))
 	c.Check(queue, HasLen, 1)
@@ -397,7 +356,7 @@ func (s *RemoteRepoSuite) TestDownloadWithInstaller(c *C) {
 	c.Assert(err, IsNil)
 	c.Assert(s.downloader.Empty(), Equals, true)

-	queue, size, err := s.repo.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false, false)
+	queue, size, err := s.repo.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false)
 	c.Assert(err, IsNil)
 	c.Check(size, Equals, int64(3)+int64(len(exampleInstallerManifestFile)))
 	c.Check(queue, HasLen, 2)
@@ -423,35 +382,6 @@ func (s *RemoteRepoSuite) TestDownloadWithInstaller(c *C) {
 	c.Check(pkg.Name, Equals, "installer")
 }

-func (s *RemoteRepoSuite) TestBuildDownloadQueueLatestOnly(c *C) {
-	s.repo.Architectures = []string{"i386"}
-
-	err := s.repo.Fetch(s.downloader, nil, true)
-	c.Assert(err, IsNil)
-
-	s.downloader.ExpectError("http://mirror.yandex.ru/debian/dists/squeeze/main/binary-i386/Packages.bz2", &http.Error{Code: 404})
-	s.downloader.ExpectError("http://mirror.yandex.ru/debian/dists/squeeze/main/binary-i386/Packages.gz", &http.Error{Code: 404})
-	s.downloader.ExpectResponse("http://mirror.yandex.ru/debian/dists/squeeze/main/binary-i386/Packages", examplePackagesFile)
-
-	err = s.repo.DownloadPackageIndexes(s.progress, s.downloader, nil, s.collectionFactory, true, false)
-	c.Assert(err, IsNil)
-	c.Assert(s.downloader.Empty(), Equals, true)
-
-	stanza := packageStanza.Copy()
-	stanza["Package"] = "amanda-client"
-	stanza["Version"] = "1:3.4.0-1"
-	stanza["Filename"] = "pool/main/a/amanda/amanda-client_3.4.0-1_i386.deb"
-
-	newest := NewPackageFromControlFile(stanza)
-	_ = s.repo.packageList.Add(newest)
-
-	queue, size, err := s.repo.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false, true)
-	c.Assert(err, IsNil)
-	c.Check(queue, HasLen, 1)
-	c.Check(queue[0].File.DownloadURL(), Equals, "pool/main/a/amanda/amanda-client_3.4.0-1_i386.deb")
-	c.Check(size, Equals, int64(187518))
-}
-
 func (s *RemoteRepoSuite) TestDownloadWithSources(c *C) {
 	s.repo.Architectures = []string{"i386"}
 	s.repo.DownloadSources = true
@@ -470,7 +400,7 @@ func (s *RemoteRepoSuite) TestDownloadWithSources(c *C) {
 	c.Assert(err, IsNil)
 	c.Assert(s.downloader.Empty(), Equals, true)

-	queue, size, err := s.repo.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false, false)
+	queue, size, err := s.repo.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false)
 	c.Assert(err, IsNil)
 	c.Check(size, Equals, int64(15))
 	c.Check(queue, HasLen, 4)
@@ -514,7 +444,7 @@ func (s *RemoteRepoSuite) TestDownloadWithSources(c *C) {
 	c.Assert(err, IsNil)
 	c.Assert(s.downloader.Empty(), Equals, true)

-	queue, size, err = s.repo.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, true, false)
+	queue, size, err = s.repo.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, true)
 	c.Assert(err, IsNil)
 	c.Check(size, Equals, int64(0))
 	c.Check(queue, HasLen, 0)
@@ -539,7 +469,7 @@ func (s *RemoteRepoSuite) TestDownloadWithSources(c *C) {
 	c.Assert(err, IsNil)
 	c.Assert(s.downloader.Empty(), Equals, true)

-	queue, size, err = s.repo.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false, false)
+	queue, size, err = s.repo.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false)
 	c.Assert(err, IsNil)
 	c.Check(size, Equals, int64(15))
 	c.Check(queue, HasLen, 4)
@@ -563,7 +493,7 @@ func (s *RemoteRepoSuite) TestDownloadFlat(c *C) {
 	c.Assert(err, IsNil)
 	c.Assert(downloader.Empty(), Equals, true)

-	queue, size, err := s.flat.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false, false)
+	queue, size, err := s.flat.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false)
 	c.Assert(err, IsNil)
 	c.Check(size, Equals, int64(3))
 	c.Check(queue, HasLen, 1)
@@ -591,7 +521,7 @@ func (s *RemoteRepoSuite) TestDownloadFlat(c *C) {
 	c.Assert(err, IsNil)
 	c.Assert(downloader.Empty(), Equals, true)

-	queue, size, err = s.flat.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, true, false)
+	queue, size, err = s.flat.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, true)
 	c.Assert(err, IsNil)
 	c.Check(size, Equals, int64(0))
 	c.Check(queue, HasLen, 0)
@@ -613,7 +543,7 @@ func (s *RemoteRepoSuite) TestDownloadFlat(c *C) {
 	c.Assert(err, IsNil)
 	c.Assert(downloader.Empty(), Equals, true)

-	queue, size, err = s.flat.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false, false)
+	queue, size, err = s.flat.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false)
 	c.Assert(err, IsNil)
 	c.Check(size, Equals, int64(3))
 	c.Check(queue, HasLen, 1)
@@ -644,7 +574,7 @@ func (s *RemoteRepoSuite) TestDownloadWithSourcesFlat(c *C) {
 	c.Assert(err, IsNil)
 	c.Assert(downloader.Empty(), Equals, true)

-	queue, size, err := s.flat.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false, false)
+	queue, size, err := s.flat.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false)
 	c.Assert(err, IsNil)
 	c.Check(size, Equals, int64(15))
 	c.Check(queue, HasLen, 4)
@@ -690,7 +620,7 @@ func (s *RemoteRepoSuite) TestDownloadWithSourcesFlat(c *C) {
 	c.Assert(err, IsNil)
 	c.Assert(downloader.Empty(), Equals, true)

-	queue, size, err = s.flat.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, true, false)
+	queue, size, err = s.flat.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, true)
 	c.Assert(err, IsNil)
 	c.Check(size, Equals, int64(0))
 	c.Check(queue, HasLen, 0)
@@ -716,7 +646,7 @@ func (s *RemoteRepoSuite) TestDownloadWithSourcesFlat(c *C) {
 	c.Assert(err, IsNil)
 	c.Assert(downloader.Empty(), Equals, true)

-	queue, size, err = s.flat.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false, false)
+	queue, size, err = s.flat.BuildDownloadQueue(s.packagePool, s.collectionFactory.PackageCollection(), s.cs, false)
 	c.Assert(err, IsNil)
 	c.Check(size, Equals, int64(15))
 	c.Check(queue, HasLen, 4)
@@ -725,74 +655,6 @@ func (s *RemoteRepoSuite) TestDownloadWithSourcesFlat(c *C) {
 	c.Assert(s.flat.packageRefs, NotNil)
 }

-func (s *RemoteRepoSuite) TestDownloadAppStreamFiles(c *C) {
-	// No dep11 entries
-	s.repo.Components = []string{"main"}
-	s.repo.ReleaseFiles = map[string]utils.ChecksumInfo{
-		"main/binary-amd64/Packages": {Size: 100},
-		"main/source/Sources":        {Size: 200},
-	}
-
-	err := s.repo.DownloadAppStreamFiles(s.progress, s.downloader, s.packagePool, s.cs, false)
-	c.Assert(err, IsNil)
-	c.Check(s.repo.AppStreamFiles, HasLen, 0)
-
-	s.repo.ReleaseFiles = map[string]utils.ChecksumInfo{
-		"main/dep11/Components-amd64.yml.gz": {Size: 16},
-		"main/dep11/icons-48x48.tar.gz":      {Size: 16},
-		"main/binary-amd64/Packages":          {Size: 100},
-	}
-
-	downloader := http.NewFakeDownloader()
-	downloader.AnyExpectResponse("http://mirror.yandex.ru/debian/dists/squeeze/main/dep11/Components-amd64.yml.gz", "dep11-components")
-	downloader.AnyExpectResponse("http://mirror.yandex.ru/debian/dists/squeeze/main/dep11/icons-48x48.tar.gz", "dep11-icons-data")
-
-	err = s.repo.DownloadAppStreamFiles(s.progress, downloader, s.packagePool, s.cs, false)
-	c.Assert(err, IsNil)
-	c.Check(s.repo.AppStreamFiles, HasLen, 2)
-	c.Check(s.repo.AppStreamFiles["main/dep11/Components-amd64.yml.gz"], Not(Equals), "")
-	c.Check(s.repo.AppStreamFiles["main/dep11/icons-48x48.tar.gz"], Not(Equals), "")
-
-	// 404 skipped
-	s.repo.ReleaseFiles = map[string]utils.ChecksumInfo{
-		"main/dep11/Components-amd64.yml.gz": {Size: 16},
-		"main/dep11/icons-48x48.tar.gz":      {Size: 15},
-	}
-
-	downloader = http.NewFakeDownloader()
-	downloader.AnyExpectResponse("http://mirror.yandex.ru/debian/dists/squeeze/main/dep11/Components-amd64.yml.gz", "dep11-components")
-	downloader.ExpectError("http://mirror.yandex.ru/debian/dists/squeeze/main/dep11/icons-48x48.tar.gz", &http.Error{Code: 404, URL: "http://mirror.yandex.ru/debian/dists/squeeze/main/dep11/icons-48x48.tar.gz"})
-
-	err = s.repo.DownloadAppStreamFiles(s.progress, downloader, s.packagePool, s.cs, false)
-	c.Assert(err, IsNil)
-	c.Check(s.repo.AppStreamFiles, HasLen, 1)
-	c.Check(s.repo.AppStreamFiles["main/dep11/Components-amd64.yml.gz"], Not(Equals), "")
-
-	// Generic download error propagated
-	s.repo.ReleaseFiles = map[string]utils.ChecksumInfo{
-		"main/dep11/Components-amd64.yml.gz": {Size: 18},
-	}
-
-	downloader = http.NewFakeDownloader()
-	downloader.ExpectError("http://mirror.yandex.ru/debian/dists/squeeze/main/dep11/Components-amd64.yml.gz", fmt.Errorf("connection refused"))
-
-	err = s.repo.DownloadAppStreamFiles(s.progress, downloader, s.packagePool, s.cs, false)
-	c.Assert(err, ErrorMatches, "unable to download AppStream file.*connection refused")
-
-	// Bypass checksum validation
-	s.repo.ReleaseFiles = map[string]utils.ChecksumInfo{
-		"main/dep11/Components-amd64.yml.gz": {Size: 999, MD5: "bad", SHA256: "bad"},
-	}
-
-	downloader = http.NewFakeDownloader()
-	downloader.AnyExpectResponse("http://mirror.yandex.ru/debian/dists/squeeze/main/dep11/Components-amd64.yml.gz", "dep11-components")
-
-	err = s.repo.DownloadAppStreamFiles(s.progress, downloader, s.packagePool, s.cs, true)
-	c.Assert(err, IsNil)
-	c.Check(s.repo.AppStreamFiles, HasLen, 1)
-	c.Check(s.repo.AppStreamFiles["main/dep11/Components-amd64.yml.gz"], Not(Equals), "")
-}
-
 type RemoteRepoCollectionSuite struct {
 	PackageListMixinSuite
 	db         database.Storage
@@ -815,7 +677,7 @@ func (s *RemoteRepoCollectionSuite) TestAddByName(c *C) {
 	_, err := s.collection.ByName("yandex")
 	c.Assert(err, ErrorMatches, "*.not found")

-	repo, _ := NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{}, false, false, false, false)
+	repo, _ := NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{}, false, false, false)
 	c.Assert(s.collection.Add(repo), IsNil)
 	c.Assert(s.collection.Add(repo), ErrorMatches, ".*already exists")

@@ -833,7 +695,7 @@ func (s *RemoteRepoCollectionSuite) TestByUUID(c *C) {
 	_, err := s.collection.ByUUID("some-uuid")
 	c.Assert(err, ErrorMatches, "*.not found")

-	repo, _ := NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{}, false, false, false, false)
+	repo, _ := NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{}, false, false, false)
 	c.Assert(s.collection.Add(repo), IsNil)

 	r, err := s.collection.ByUUID(repo.UUID)
@@ -847,7 +709,7 @@ func (s *RemoteRepoCollectionSuite) TestByUUID(c *C) {
 }

 func (s *RemoteRepoCollectionSuite) TestUpdateLoadComplete(c *C) {
-	repo, _ := NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{}, false, false, false, false)
+	repo, _ := NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{}, false, false, false)
 	c.Assert(s.collection.Update(repo), IsNil)

 	collection := NewRemoteRepoCollection(s.db)
@@ -868,7 +730,7 @@ func (s *RemoteRepoCollectionSuite) TestUpdateLoadComplete(c *C) {
 }

 func (s *RemoteRepoCollectionSuite) TestForEachAndLen(c *C) {
-	repo, _ := NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{}, false, false, false, false)
+	repo, _ := NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{}, false, false, false)
 	_ = s.collection.Add(repo)

 	count := 0
@@ -890,10 +752,10 @@ func (s *RemoteRepoCollectionSuite) TestForEachAndLen(c *C) {
 }

 func (s *RemoteRepoCollectionSuite) TestDrop(c *C) {
-	repo1, _ := NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{}, false, false, false, false)
+	repo1, _ := NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{}, false, false, false)
 	_ = s.collection.Add(repo1)

-	repo2, _ := NewRemoteRepo("tyndex", "http://mirror.yandex.ru/debian/", "wheezy", []string{"main"}, []string{}, false, false, false, false)
+	repo2, _ := NewRemoteRepo("tyndex", "http://mirror.yandex.ru/debian/", "wheezy", []string{"main"}, []string{}, false, false, false)
 	_ = s.collection.Add(repo2)

 	r1, _ := s.collection.ByUUID(repo1.UUID)
@@ -40,9 +40,6 @@ type Snapshot struct {
 	NotAutomatic         string
 	ButAutomaticUpgrades string

-	// AppStream files: relative path → pool path (pass-through from mirror)
-	AppStreamFiles map[string]string `json:",omitempty"`
-
 	packageRefs *PackageRefList
 }

@@ -62,7 +59,6 @@ func NewSnapshotFromRepository(name string, repo *RemoteRepo) (*Snapshot, error)
 		Origin:               repo.Meta["Origin"],
 		NotAutomatic:         repo.Meta["NotAutomatic"],
 		ButAutomaticUpgrades: repo.Meta["ButAutomaticUpgrades"],
-		AppStreamFiles:       repo.AppStreamFiles,
 		packageRefs:          repo.packageRefs,
 	}, nil
 }
@@ -98,28 +94,14 @@ func NewSnapshotFromRefList(name string, sources []*Snapshot, list *PackageRefLi
 		sourceUUIDs[i] = sources[i].UUID
 	}

-	// Merge AppStreamFiles from all source snapshots
-	var mergedAppStream map[string]string
-	for _, source := range sources {
-		if len(source.AppStreamFiles) > 0 {
-			if mergedAppStream == nil {
-				mergedAppStream = make(map[string]string)
-			}
-			for k, v := range source.AppStreamFiles {
-				mergedAppStream[k] = v
-			}
-		}
-	}
-
 	return &Snapshot{
-		UUID:           uuid.NewString(),
-		Name:           name,
-		CreatedAt:      time.Now(),
-		SourceKind:     "snapshot",
-		SourceIDs:      sourceUUIDs,
-		Description:    description,
-		AppStreamFiles: mergedAppStream,
-		packageRefs:    list,
+		UUID:        uuid.NewString(),
+		Name:        name,
+		CreatedAt:   time.Now(),
+		SourceKind:  "snapshot",
+		SourceIDs:   sourceUUIDs,
+		Description: description,
+		packageRefs: list,
 	}
 }

@@ -31,7 +31,8 @@ func BenchmarkSnapshotCollectionForEach(b *testing.B) {
 	for i := 0; i < b.N; i++ {
 		collection = NewSnapshotCollection(db)

-		_ = collection.ForEach(func(s *Snapshot) error {
+
+                _ = collection.ForEach(func(s *Snapshot) error {
 			return nil
 		})
 	}
@@ -19,7 +19,7 @@ var _ = Suite(&SnapshotSuite{})

 func (s *SnapshotSuite) SetUpTest(c *C) {
 	s.SetUpPackages()
-	s.repo, _ = NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{}, false, false, false, false)
+	s.repo, _ = NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{}, false, false, false)
 	s.repo.packageRefs = s.reflist
 }

@@ -101,62 +101,6 @@ func (s *SnapshotSuite) TestEncodeDecode(c *C) {
 	c.Assert(snapshot2.packageRefs, IsNil)
 }

-func (s *SnapshotSuite) TestSnapshotFromRepositoryAppStream(c *C) {
-	s.repo.AppStreamFiles = map[string]string{
-		"main/dep11/Components-amd64.yml.gz": "ab/cd/Components-amd64.yml.gz",
-		"main/dep11/icons-48x48.tar.gz":      "ef/gh/icons-48x48.tar.gz",
-	}
-	snapshot, err := NewSnapshotFromRepository("snap-as", s.repo)
-	c.Assert(err, IsNil)
-	c.Check(snapshot.AppStreamFiles, DeepEquals, s.repo.AppStreamFiles)
-
-	s.repo.AppStreamFiles = nil
-	snapshot2, err := NewSnapshotFromRepository("snap-no-as", s.repo)
-	c.Assert(err, IsNil)
-	c.Check(snapshot2.AppStreamFiles, IsNil)
-}
-
-func (s *SnapshotSuite) TestSnapshotFromRefListAppStreamMerge(c *C) {
-	snap1, _ := NewSnapshotFromRepository("snap1", s.repo)
-	snap1.AppStreamFiles = map[string]string{
-		"main/dep11/Components-amd64.yml.gz": "aa/bb/Components-amd64.yml.gz",
-		"main/dep11/icons-48x48.tar.gz":      "cc/dd/icons-48x48.tar.gz",
-	}
-
-	snap2, _ := NewSnapshotFromRepository("snap2", s.repo)
-	snap2.AppStreamFiles = map[string]string{
-		"contrib/dep11/Components-amd64.yml.gz": "ee/ff/Components-amd64.yml.gz",
-		"main/dep11/Components-amd64.yml.gz":     "xx/yy/Components-amd64.yml.gz",
-	}
-
-	merged := NewSnapshotFromRefList("merged", []*Snapshot{snap1, snap2}, s.reflist, "Merged")
-
-	c.Check(len(merged.AppStreamFiles), Equals, 3)
-	c.Check(merged.AppStreamFiles["main/dep11/icons-48x48.tar.gz"], Equals, "cc/dd/icons-48x48.tar.gz")
-	c.Check(merged.AppStreamFiles["contrib/dep11/Components-amd64.yml.gz"], Equals, "ee/ff/Components-amd64.yml.gz")
-	c.Check(merged.AppStreamFiles["main/dep11/Components-amd64.yml.gz"], Equals, "xx/yy/Components-amd64.yml.gz")
-
-	snap3, _ := NewSnapshotFromRepository("snap3", s.repo)
-	snap3.AppStreamFiles = nil
-	snap4, _ := NewSnapshotFromRepository("snap4", s.repo)
-	snap4.AppStreamFiles = nil
-	merged2 := NewSnapshotFromRefList("merged2", []*Snapshot{snap3, snap4}, s.reflist, "Merged2")
-	c.Check(merged2.AppStreamFiles, IsNil)
-}
-
-func (s *SnapshotSuite) TestEncodeDecodeAppStream(c *C) {
-	snapshot, _ := NewSnapshotFromRepository("snap-as-enc", s.repo)
-	snapshot.AppStreamFiles = map[string]string{
-		"main/dep11/Components-amd64.yml.gz": "ab/cd/Components-amd64.yml.gz",
-		"main/dep11/icons-48x48.tar.gz":      "ef/gh/icons-48x48.tar.gz",
-	}
-
-	decoded := &Snapshot{}
-	c.Assert(decoded.Decode(snapshot.Encode()), IsNil)
-	c.Check(decoded.Name, Equals, snapshot.Name)
-	c.Check(decoded.AppStreamFiles, DeepEquals, snapshot.AppStreamFiles)
-}
-
 type SnapshotCollectionSuite struct {
 	PackageListMixinSuite
 	db                   database.Storage
@@ -174,11 +118,11 @@ func (s *SnapshotCollectionSuite) SetUpTest(c *C) {
 	s.collection = NewSnapshotCollection(s.db)
 	s.SetUpPackages()

-	s.repo1, _ = NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{}, false, false, false, false)
+	s.repo1, _ = NewRemoteRepo("yandex", "http://mirror.yandex.ru/debian/", "squeeze", []string{"main"}, []string{}, false, false, false)
 	s.repo1.packageRefs = s.reflist
 	s.snapshot1, _ = NewSnapshotFromRepository("snap1", s.repo1)

-	s.repo2, _ = NewRemoteRepo("android", "http://mirror.yandex.ru/debian/", "lenny", []string{"main"}, []string{}, false, false, false, false)
+	s.repo2, _ = NewRemoteRepo("android", "http://mirror.yandex.ru/debian/", "lenny", []string{"main"}, []string{}, false, false, false)
 	s.repo2.packageRefs = s.reflist
 	s.snapshot2, _ = NewSnapshotFromRepository("snap2", s.repo2)

@@ -279,7 +223,7 @@ func (s *SnapshotCollectionSuite) TestFindByRemoteRepoSource(c *C) {
 	c.Check(s.collection.ByRemoteRepoSource(s.repo1), DeepEquals, []*Snapshot{s.snapshot1})
 	c.Check(s.collection.ByRemoteRepoSource(s.repo2), DeepEquals, []*Snapshot{s.snapshot2})

-	repo3, _ := NewRemoteRepo("other", "http://mirror.yandex.ru/debian/", "lenny", []string{"main"}, []string{}, false, false, false, false)
+	repo3, _ := NewRemoteRepo("other", "http://mirror.yandex.ru/debian/", "lenny", []string{"main"}, []string{}, false, false, false)

 	c.Check(s.collection.ByRemoteRepoSource(repo3), DeepEquals, []*Snapshot(nil))
 }
@@ -30,16 +30,16 @@ func CompareVersions(ver1, ver2 string) int {

 // parseVersions breaks down full version to components (possibly empty)
 func parseVersion(ver string) (epoch, upstream, debian string) {
-	i := strings.Index(ver, ":")
-	if i != -1 {
-		epoch, ver = ver[:i], ver[i+1:]
-	}
-
-	i = strings.Index(ver, "-")
+	i := strings.LastIndex(ver, "-")
 	if i != -1 {
 		debian, ver = ver[i+1:], ver[:i]
 	}

+	i = strings.Index(ver, ":")
+	if i != -1 {
+		epoch, ver = ver[:i], ver[i+1:]
+	}
+
 	upstream = ver

 	return
@@ -50,7 +50,7 @@ func compareLexicographic(s1, s2 string) int {
 	i := 0
 	l1, l2 := len(s1), len(s2)

-	for !(i == l1 && i == l2) { // break if s1 equal to s2
+	for !(i == l1 && i == l2) {  // break if s1 equal to s2

 		if i == l2 {
 			// s1 is longer than s2
@@ -20,10 +20,10 @@ func (s *VersionSuite) TestParseVersion(c *C) {
 	c.Check([]string{e, u, d}, DeepEquals, []string{"", "1.3.4", "1"})

 	e, u, d = parseVersion("1.3-pre4-1")
-	c.Check([]string{e, u, d}, DeepEquals, []string{"", "1.3", "pre4-1"})
+	c.Check([]string{e, u, d}, DeepEquals, []string{"", "1.3-pre4", "1"})

 	e, u, d = parseVersion("4:1.3-pre4-1")
-	c.Check([]string{e, u, d}, DeepEquals, []string{"4", "1.3", "pre4-1"})
+	c.Check([]string{e, u, d}, DeepEquals, []string{"4", "1.3-pre4", "1"})
 }

 func (s *VersionSuite) TestCompareLexicographic(c *C) {
@@ -100,7 +100,6 @@ func (s *VersionSuite) TestCompareVersions(c *C) {
 	c.Check(CompareVersions("1.0-133-avc", "1.0"), Equals, 1)

 	c.Check(CompareVersions("5.2.0.3", "5.2.0.283"), Equals, -1)
-	c.Check(CompareVersions("4.3.5a", "4.3.5-rc3-1"), Equals, 1)
 }

 func (s *VersionSuite) TestParseDependency(c *C) {
@@ -0,0 +1,33 @@
+aptly (1.6.0+ds1-1) unstable; urgency=medium
+
+  - aptly-api: configuration file is now /etc/aptly.conf, and `rootDir`
+    defaults to `~/.aptly`
+
+  - aptly-api: default port is 8080, as declared in
+    `/etc/default/aptly-api`
+
+  - aptly: swagger support is disabled, but will be re-enabled after the
+    corresponding golang packages make it to unstable
+  
+  - aptly: default format is yaml, but the old format is still supported 
+    for now
+
+ -- Sebastien Delafond <seb@debian.org>  Sun, 29 Dec 2024 08:46:07 +0100
+
+aptly (1.3.0+ds1-2.2) unstable; urgency=medium
+
+  This version tries to fix the database backwards compatibility,
+  so you don't need to rebuild the database if you upgrade from
+  aptly <= 1.3.0-6.
+
+  However some fields are missing, like created time of a snapshot.
+
+ -- Shengjing Zhu <zhsj@debian.org>  Sat, 13 Apr 2019 23:26:39 +0800
+
+aptly (1.3.0+ds1-2) unstable; urgency=medium
+
+  * The database created by aptly <= 1.3.0-6 is not compatible
+    with greater versions. Users must create a new database.
+    The `aptly db recover` will not fix the issue.
+
+ -- Alexandre Viau <aviau@debian.org>  Fri, 26 Oct 2018 13:20:53 -0400
@@ -70,9 +70,6 @@ ppa_distributor_id: ubuntu
 # Codename for short PPA url expansion
 ppa_codename: ""

-# PPA Base URL (default: launchpad)
-# # ppa_baseurl: http://ppa.launchpad.net
-

 # Aptly Server
 ###############
@@ -83,8 +80,9 @@ serve_in_api_mode: false
 # Enable metrics for Prometheus client
 enable_metrics_endpoint: false

+# Not implemented in this version.
 # Enable API documentation on /docs
-enable_swagger_endpoint: false
+#enable_swagger_endpoint: false

 # OBSOLETE: use via url param ?_async=true
 async_api: false
@@ -1,51 +1,522 @@
-aptly (1.6.2) stable; urgency=medium
+aptly (1.6.2-3) unstable; urgency=medium

-  * doc: add swagger doc for /api/gpg/key (https://github.com/aptly-dev/aptly/pull/1456)
-  * bash-completion: include global options in aptly command completions (https://github.com/aptly-dev/aptly/pull/1452)
-  * Bump golang.org/x/net from 0.33.0 to 0.38.0 (https://github.com/aptly-dev/aptly/pull/1443)
-  * Bump golang.org/x/crypto from 0.31.0 to 0.35.0 (https://github.com/aptly-dev/aptly/pull/1441)
-  * Remove corrupt package references in `db recover` (https://github.com/aptly-dev/aptly/pull/1445)
-  * Fix upload of unchanged packages in S3 (https://github.com/aptly-dev/aptly/pull/1440)
-  * use go 1.24 (https://github.com/aptly-dev/aptly/pull/1439)
+  [ Sébastien Delafond ]
+  * tests: disable t04_mirror/create/CreateMirror18Test (Closes: #1135740)
+  * tests: disable t12_api/gpg/GPGAPITestAddKey (Closes: #1135672)
+  * d/control: bump-up Standards-Version

- -- André Roth <neolynx@gmail.com>  Mon, 09 Jun 2025 13:45:15 +0200
+ -- Sebastien Delafond <seb@debian.org>  Tue, 05 May 2026 18:14:44 +0200

-aptly (1.6.1) stable; urgency=medium
+aptly (1.6.2-2) unstable; urgency=medium

-  * update golang-github-syndtr-goleveldb-dev dependency (v1.0.1-0.20220721030215-126854af5e6d) to fix segfault on arm64
-    (bug in golang-github-golang-snappy-dev)
-  * allow snapshotting empty mirrors again (regression)
-  * debian compliance: add postrm (note: `apt purge aptly-api` will remove all data in ~aptly-api/)
-  * update other dependencies (x/net 0.33.0, gin-gonic/gin 1.9.1)
+  [ Sébastien Delafond ]
+  * Remove Built-Using
+  * Mark patches as "Forwarded: not-needed"

- -- André Roth <neolynx@gmail.com>  Sat, 15 Feb 2025 13:03:16 +0100
+ -- Sebastien Delafond <seb@debian.org>  Fri, 21 Nov 2025 15:46:51 +0100

-aptly (1.6.0) stable; urgency=medium
+aptly (1.6.2-1) unstable; urgency=medium

-  * support reading filters from file or stdin
-  * fix mirroring source packages
-  * support yaml config per default
-  * provide swagger API documentation
-  * provide API for querying aptly storage usage
-  * provide snapshot pull via API
-  * support creating repos from snapshots
-  * fix mirroring flat remote repos
-  * support skeleton files for publishing
-  * use new azure sdk
-  * support updating the components of a published repo
-  * support publishing multiple distributions (-multi-dist)
-  * support etcd database
-  * allow slash (/) in distribution names
-  * support for storing the "local" pool on Azure
-  * provide copy package API
-  * fix publish concurrency and improve performance
-  * improved mirroring
-  * fix download throttling
-  * fix resuming package downloads
-  * fix ignoring signatures
-  * fix packages dependency resolution (Virtual Packages, version numbers in Provides)
-  * improved S3 support and performance
-  * fix race condition with goleveldb
-  * use go 1.22
+  [ Sébastien Delafond ]
+  * d/watch: v5
+  * Bump up Standards-Version
+  * Remove +ds suffix
+  * Add Static-Built-Using
+  * New upstream version 1.6.2

- -- André Roth <neolynx@gmail.com>  Tue, 24 Dec 2024 17:44:35 +0100
+ -- Sebastien Delafond <seb@debian.org>  Wed, 24 Sep 2025 06:19:54 +0200
+
+aptly (1.6.1+ds1-3) unstable; urgency=medium
+
+  [ Sébastien Delafond ]
+  * tests: declare needs-internet for system-test
+  * tests: disable unit test TestVerifyClearsigned & system test
+    CreateMirror31Test (Closes: #1108828)
+
+ -- Sebastien Delafond <seb@debian.org>  Tue, 08 Jul 2025 14:12:52 +0200
+
+aptly (1.6.1+ds1-2) unstable; urgency=medium
+
+  [ Sébastien Delafond ]
+  * Do not re-publish unchanged files to S3 every single time (Closes: #1104299)
+
+ -- Sebastien Delafond <seb@debian.org>  Mon, 28 Apr 2025 15:38:43 +0200
+
+aptly (1.6.1+ds1-1) unstable; urgency=medium
+
+  [ Sébastien Delafond ]
+  * New upstream version 1.6.1
+
+ -- Sebastien Delafond <seb@debian.org>  Mon, 24 Feb 2025 09:04:35 +0100
+
+aptly (1.6.0+ds1-8) unstable; urgency=medium
+
+  [ Sébastien Delafond ]
+  * tests: disable riscv64-flaky EditRepo4Test
+
+ -- Sebastien Delafond <seb@debian.org>  Fri, 21 Feb 2025 06:54:18 +0100
+
+aptly (1.6.0+ds1-7) unstable; urgency=medium
+
+  [ Sébastien Delafond ]
+  * tests: clean way to disable single tests, disable s390-flaky CreateMirror35Test
+
+ -- Sebastien Delafond <seb@debian.org>  Thu, 20 Feb 2025 07:26:41 +0100
+
+aptly (1.6.0+ds1-6) unstable; urgency=medium
+
+  [ Sébastien Delafond ]
+  * tests: disable system-test's etcd tests as the corresponding fixture is also arch-specific
+
+ -- Sebastien Delafond <seb@debian.org>  Wed, 19 Feb 2025 14:02:19 +0100
+
+aptly (1.6.0+ds1-5) unstable; urgency=medium
+
+  [ Sébastien Delafond ]
+  * tests: do not use upstream's etcd installer
+
+ -- Sebastien Delafond <seb@debian.org>  Wed, 19 Feb 2025 07:20:44 +0100
+
+aptly (1.6.0+ds1-4) unstable; urgency=medium
+
+  [ Sébastien Delafond ]
+  * postrm: remove aptly-api user and home directory on purge
+  * tests: use extensive coverage from make's test and system-test
+
+ -- Sebastien Delafond <seb@debian.org>  Tue, 18 Feb 2025 10:36:13 +0100
+
+aptly (1.6.0+ds1-3) unstable; urgency=medium
+
+  [ Sébastien Delafond ]
+  * aptly.conf: fix s3 example
+
+ -- Sebastien Delafond <seb@debian.org>  Mon, 13 Jan 2025 14:51:29 +0100
+
+aptly (1.6.0+ds1-2) unstable; urgency=medium
+
+  [ Sébastien Delafond ]
+  * Document disabled swagger in default config file
+  * Rediff patches: swagger references in man page
+
+ -- Sebastien Delafond <seb@debian.org>  Mon, 30 Dec 2024 11:11:07 +0100
+
+aptly (1.6.0+ds1-1) unstable; urgency=medium
+
+  [ Sébastien Delafond ]
+  * Official 1.6 release
+
+ -- Sebastien Delafond <seb@debian.org>  Fri, 27 Dec 2024 14:23:29 +0100
+
+aptly (1.6.0+ds1~beta3-1) experimental; urgency=medium
+
+  [ Sébastien Delafond ]
+  * Latest upstream version
+
+ -- Sebastien Delafond <seb@debian.org>  Wed, 11 Dec 2024 18:16:19 +0100
+
+aptly (1.6.0+ds1~beta2-1) experimental; urgency=medium
+
+  [ Sébastien Delafond ]
+  * Latest upstream version
+
+  [ André Roth ]
+  * set systemd service file limit to 32768
+
+ -- Sebastien Delafond <seb@debian.org>  Thu, 21 Nov 2024 16:08:05 +0100
+
+aptly (1.6.0+ds1~beta1-1) experimental; urgency=medium
+
+  [ Sébastien Delafond ]
+  * Latest upstream version
+  * Disable "use new azure-sdk"
+
+ -- Sebastien Delafond <seb@debian.org>  Sun, 17 Nov 2024 18:52:06 +0100
+
+aptly (1.6.0+ds1~alpha5-1) experimental; urgency=medium
+
+  * Sort out dependencies on gpg*
+  * Reduce diff with upstream some more
+
+ -- Sebastien Delafond <seb@debian.org>  Sun, 17 Nov 2024 15:59:23 +0100
+
+aptly (1.6.0+ds1~alpha4-1) experimental; urgency=medium
+
+  [ Sébastien Delafond ]
+  * Remove build-dep on git
+  * Adjust systemd unit for aptly-api
+
+ -- Sebastien Delafond <seb@debian.org>  Sun, 17 Nov 2024 14:51:49 +0100
+
+aptly (1.6.0+ds1~alpha3-1) experimental; urgency=medium
+
+  [ Sébastien Delafond ]
+  * Latest upstream version
+  * Remove useless maintainer scripts
+
+ -- Sebastien Delafond <seb@debian.org>  Sun, 17 Nov 2024 07:50:06 +0100
+
+aptly (1.6.0+ds1~alpha2-1) experimental; urgency=medium
+
+  [ Sébastien Delafond ]
+  * Latest upstream version
+
+ -- Sebastien Delafond <seb@debian.org>  Sat, 16 Nov 2024 14:42:10 +0100
+
+aptly (1.6.0+ds1~alpha1-2) experimental; urgency=medium
+
+  [ Sébastien Delafond ]
+  * Add zsh completion
+  * aptly-api: revert arch:all, so mv_conffile does the right thing
+
+ -- Sebastien Delafond <seb@debian.org>  Wed, 16 Oct 2024 09:10:05 +0200
+
+aptly (1.6.0+ds1~alpha1-1) experimental; urgency=medium
+
+  [ Sébastien Delafond ]
+  * d/patches: remove old patch, and disable swagger support
+  * d/control: bump up Standards-Version
+  * Adjust packaging for 1.6.0~alpha1
+
+ -- Sebastien Delafond <seb@debian.org>  Tue, 15 Oct 2024 14:40:57 +0200
+
+aptly (1.5.0+ds1-2) unstable; urgency=medium
+
+  [ Shengjing Zhu ]
+  * Replace golang-gopkg-cheggaaa-pb.v1-dev with
+    golang-github-cheggaaa-pb-dev (Closes: #1050900)
+
+ -- Sebastien Delafond <seb@debian.org>  Mon, 04 Sep 2023 08:49:36 +0200
+
+aptly (1.5.0+ds1-1) unstable; urgency=medium
+
+  * Team upload.
+  * New upstream release (Closes: #1022721), including fix for "Order of
+    fields in Packages/Sources is unpredictable" (Closes: #907121).
+
+ -- Roland Mas <lolando@debian.org>  Tue, 31 Jan 2023 14:47:04 +0100
+
+aptly (1.4.0+ds1-7) unstable; urgency=medium
+
+  * Team upload.
+  * Add support for zstd compression (Closes: #1010465)
+
+ -- Anton Gladky <gladk@debian.org>  Tue, 17 May 2022 22:42:29 +0200
+
+aptly (1.4.0+ds1-6) unstable; urgency=medium
+
+  * Conflict on gpgv1 (Closes: #990821)
+
+ -- Sebastien Delafond <seb@debian.org>  Thu, 04 Nov 2021 10:24:53 +0100
+
+aptly (1.4.0+ds1-5) unstable; urgency=medium
+
+  * Conflict on gnupg1 (Closes: #990821)
+
+ -- Sebastien Delafond <seb@debian.org>  Thu, 14 Oct 2021 18:43:04 +0200
+
+aptly (1.4.0+ds1-4) unstable; urgency=medium
+
+  * Install correct bash completion snippet (Closes: #984979)
+
+ -- Sebastien Delafond <seb@debian.org>  Thu, 11 Mar 2021 15:20:57 +0100
+
+aptly (1.4.0+ds1-3) unstable; urgency=medium
+
+  * Fix s3 etag issue (Closes: #983877)
+  * Bump-up d/watch version
+  * Bump-up Standards-Version
+
+ -- Sebastien Delafond <seb@debian.org>  Wed, 03 Mar 2021 10:50:51 +0100
+
+aptly (1.4.0+ds1-2) unstable; urgency=medium
+
+  * Use pipeline from salsa-ci-team
+  * Allow reprotest failure
+  * Pass version from d/rules (Closes: #968585)
+
+ -- Sebastien Delafond <seb@debian.org>  Fri, 21 Aug 2020 10:13:44 +0200
+
+aptly (1.4.0+ds1-1) unstable; urgency=medium
+
+  * New upstream version 1.4.0+ds1
+  * Rediff patches
+  * Depend on gnupg 2
+
+ -- Sebastien Delafond <seb@debian.org>  Sun, 22 Dec 2019 15:16:25 +0100
+
+aptly (1.3.0+ds1-4) unstable; urgency=medium
+
+  [ Debian Janitor ]
+  * Rename obsolete path debian/tests/control.autodep8 to debian/tests/control.
+  * Use secure URI in Homepage field.
+  * Bump debhelper from old 11 to 12.
+  * Set debhelper-compat version in Build-Depends.
+
+  [ Sébastien Delafond ]
+  * Bump up Standards-Version
+
+ -- Sebastien Delafond <seb@debian.org>  Sun, 22 Dec 2019 14:10:19 +0100
+
+aptly (1.3.0+ds1-3) unstable; urgency=medium
+
+  * Build-Depend on golang-golang-x-tools-dev instead of golang-go.tools (Closes: #945884)
+  * Lintian fix
+
+ -- Sebastien Delafond <seb@debian.org>  Sat, 21 Dec 2019 10:29:09 +0100
+
+aptly (1.3.0+ds1-2.3) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Remove myself from uploaders.
+
+ -- Alexandre Viau <aviau@debian.org>  Sun, 15 Sep 2019 19:27:47 -0400
+
+aptly (1.3.0+ds1-2.2) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Add patch to fix DB backwards compatibility (Closes: #911924)
+  * Fix struct field tag typo
+  * Update debian/NEWS about DB compatibility
+
+ -- Shengjing Zhu <zhsj@debian.org>  Tue, 16 Apr 2019 00:18:23 +0800
+
+aptly (1.3.0+ds1-2.1) unstable; urgency=medium
+
+  [ Shengjing Zhu ]
+  * Non-maintainer upload.
+  * Add patch to fix UUID struct field not encoded in msgpack (Closes: #923866)
+
+  [ Tobias Frost ]
+  * Prepare upload.
+
+ -- Tobias Frost <tobi@debian.org>  Fri, 05 Apr 2019 17:19:14 +0200
+
+aptly (1.3.0+ds1-2) unstable; urgency=medium
+
+  * Add NEWS to warn about database compatibility.
+
+ -- Alexandre Viau <aviau@debian.org>  Fri, 26 Oct 2018 13:22:38 -0400
+
+aptly (1.3.0+ds1-1) unstable; urgency=medium
+
+  [ Ondřej Nový ]
+  * d/changelog: Remove trailing whitespaces
+
+  [ Alexandre Viau ]
+  * d/watch: Append +ds suffix.
+  * d/copyright: ignore vendor/*. (Closes: #902128)
+  * d/copyright: remove vendor/* sections.
+  * d/copyright: MIT -> Expat.
+  * d/control: add vendor/* build dependencies.
+  * Patch: Use Debian's uuid package.
+  * Patch: Use Debian's lzma package.
+  * d/rules: remove trailing whitespace.
+
+ -- Alexandre Viau <aviau@debian.org>  Mon, 15 Oct 2018 11:54:03 -0400
+
+aptly (1.3.0-6) unstable; urgency=medium
+
+  * Combine autodep8 and autopkgtest.
+
+ -- Alexandre Viau <aviau@debian.org>  Fri, 29 Jun 2018 18:11:41 -0400
+
+aptly (1.3.0-5) unstable; urgency=medium
+
+  * Fix syntax-error-in-dep5-copyright.
+  * Fix unnecessary-testsuite-autopkgtest-field.
+  * Fix broken autopkgtest.
+  * Depend on gpgv1.
+
+ -- Alexandre Viau <aviau@debian.org>  Tue, 26 Jun 2018 23:01:36 -0400
+
+aptly (1.3.0-4) unstable; urgency=medium
+
+  * Document #902128 in debian/copyright
+  * Point debian/watch to new git repo on GitHub
+  * Add simple autopkgtest
+  * Add debian/.gitlab-ci.yml
+  * Depend on gnupg1 (Closes: #902419)
+
+ -- Sebastien Delafond <seb@debian.org>  Tue, 26 Jun 2018 14:24:34 +0200
+
+aptly (1.3.0-3) unstable; urgency=medium
+
+  * Create aptly-api package. (Closes: #902032)
+
+ -- Alexandre Viau <aviau@debian.org>  Fri, 22 Jun 2018 13:51:50 -0400
+
+aptly (1.3.0-2) unstable; urgency=medium
+
+  * Team upload, many thanks to Alexandre Viau for this work
+  * Switch to dh-golang. (Closes: #902038)
+  * Fix vcs-field-not-canonical.
+  * Fix insecure-copyright-format-uri.
+
+ -- Sebastien Delafond <seb@debian.org>  Fri, 22 Jun 2018 13:53:11 +0200
+
+aptly (1.3.0-1) unstable; urgency=medium
+
+  * Fix copyright
+  * New upstream version 1.3.0
+
+ -- Sebastien Delafond <seb@debian.org>  Thu, 21 Jun 2018 15:14:57 +0200
+
+aptly (1.2.0-4) unstable; urgency=medium
+
+  * Enable Built-Using in debian/control (thanks M. Staperberg)
+
+ -- Sebastien Delafond <seb@debian.org>  Tue, 06 Mar 2018 10:10:42 +0100
+
+aptly (1.2.0-3) unstable; urgency=medium
+
+  * Switch to DEP 14
+  * Update Vcs-* to point to salsa.d.o
+
+ -- Sebastien Delafond <seb@debian.org>  Fri, 16 Feb 2018 17:02:25 +0100
+
+aptly (1.2.0-2) unstable; urgency=medium
+
+  * Team upload.
+  * Build-Depend on golang-any, not golang
+  * Set XS-Go-Import-Path
+
+ -- Michael Stapelberg <stapelberg@debian.org>  Sat, 10 Feb 2018 18:41:37 +0100
+
+aptly (1.2.0-1) unstable; urgency=medium
+
+  * New upstream version 1.2.0
+
+ -- Sebastien Delafond <seb@debian.org>  Wed, 03 Jan 2018 13:43:30 +0100
+
+aptly (1.1.1-2) unstable; urgency=medium
+
+  * Support both uncompressed control.tar, and xz-compressed
+    control.tar.xz. Thanks to Boyuan Yang for the patch (Closes: 879718)
+
+ -- Sebastien Delafond <seb@debian.org>  Thu, 02 Nov 2017 13:23:29 +0100
+
+aptly (1.1.1-1) unstable; urgency=medium
+
+  * New upstream version 1.1.1
+  * Use bash-completion snippet from upstream
+  * Bump up Standards-Version
+  * Update debian/copyright
+
+ -- Sebastien Delafond <seb@debian.org>  Thu, 02 Nov 2017 09:03:23 +0100
+
+aptly (1.0.1-1) unstable; urgency=medium
+
+  * Imported Upstream version 1.0.1
+  * Update debian/copyright
+  * Adapt debian/rules
+  * Update Vcs-Git
+  * Bump-up Standards-Version
+
+ -- Sebastien Delafond <seb@debian.org>  Tue, 18 Jul 2017 11:53:29 +0200
+
+aptly (0.9.7-1) unstable; urgency=medium
+
+  * Imported new upstream version 0.9.7
+  * Add new licenses and copyrights info
+
+ -- Sebastien Delafond <seb@debian.org>  Tue, 24 May 2016 09:17:08 +0200
+
+aptly (0.9.6-1) unstable; urgency=medium
+
+  * Import new upstream version 0.9.6
+  * Add dependency on xz-utils
+  * Licenses and copyrights
+
+ -- Sebastien Delafond <seb@debian.org>  Wed, 10 Feb 2016 18:28:51 +0100
+
+aptly (0.9.5-2) unstable; urgency=medium
+
+  * Remove empty component in GOPATH (Closes: #793838)
+
+  [ Sebastien Delafond ]
+
+ -- Sebastien Delafond <seb@debian.org>  Sun, 16 Aug 2015 18:42:22 +0200
+
+aptly (0.9.5-1) unstable; urgency=medium
+
+  * Imported Upstream version 0.9.5
+  * Up-to-date bash completion
+
+ -- Sebastien Delafond <seb@debian.org>  Fri, 15 May 2015 10:46:51 +0200
+
+aptly (0.9.1-1) unstable; urgency=medium
+
+  * Imported Upstream version 0.9.1
+  * Document licenses and copyrights for new dependencies
+  * Suggest graphviz
+  * Proper name for bash-completion file
+  * Bump-up Standards-Version
+
+ -- Sebastien Delafond <seb@debian.org>  Sat, 02 May 2015 12:57:16 +0200
+
+aptly (0.8-3) unstable; urgency=medium
+
+  * Correct Vcs-Browser entry (Closes: #764622)
+  * Correct dependency from "gpg" to "gnupg" (Closes: #764619)
+
+ -- Sebastien Delafond <seb@debian.org>  Thu, 09 Oct 2014 18:41:38 +0200
+
+aptly (0.8-2) unstable; urgency=medium
+
+  * Add missing dependencies on bzip2, gpg and gpgv
+
+ -- Sebastien Delafond <seb@debian.org>  Thu, 09 Oct 2014 11:15:21 +0200
+
+aptly (0.8-1) unstable; urgency=medium
+
+  * Imported Upstream version 0.8
+  * Document new copyrights and licenses
+  * Add bash completion snippet
+  * Reference full paths in debian/copyright, and remove unused
+    references, so lintian does not complain
+
+ -- Sebastien Delafond <seb@debian.org>  Sat, 04 Oct 2014 17:46:24 +0200
+
+aptly (0.7.1-1) unstable; urgency=medium
+
+  * Imported Upstream version 0.7.1
+  * Add copyright information for new libraries
+
+ -- Sebastien Delafond <seb@debian.org>  Wed, 10 Sep 2014 10:03:27 +0200
+
+aptly (0.5-5) unstable; urgency=medium
+
+  * Turn off verbose mode
+  * Correct Vcs-* information
+  * gocov is licensed MIT, not BSD-3
+  * Add missing MIT license text
+
+ -- Sebastien Delafond <seb@debian.org>  Tue, 09 Sep 2014 09:20:40 +0200
+
+aptly (0.5-4) unstable; urgency=medium
+
+  * Collect licenses by going over files one by one
+  * Use packaged golang-go.tools
+
+ -- Sebastien Delafond <seb@debian.org>  Thu, 10 Jul 2014 00:49:09 +0200
+
+aptly (0.5-3) unstable; urgency=low
+
+  * Licensing:
+    - goleveldb is BSD-2, not BSD-3
+    - _vendor/src/code.google.com/p/gographviz/scanner/scanner is BSD-3,
+      copyright 2009 The Go Authors
+
+ -- Sebastien Delafond <seb@debian.org>  Wed, 28 May 2014 10:04:01 +0200
+
+aptly (0.5-2) unstable; urgency=low
+
+  * Go interpreter not needed at runtime
+
+ -- Sebastien Delafond <seb@debian.org>  Fri, 02 May 2014 12:04:02 +0200
+
+aptly (0.5-1) unstable; urgency=low
+
+  * Initial release (Closes: #746343)
+
+ -- Sebastien Delafond <seb@debian.org>  Tue, 29 Apr 2014 15:47:31 +0200
@@ -1,7 +1,7 @@
 Source: aptly
 Section: utils
 Priority: optional
-Maintainer: André Roth <neolynx@gmail.com>
+Maintainer: Sebastien Delafond <seb@debian.org>
 Build-Depends: bash-completion,
               debhelper-compat (= 13),
               dh-golang,
@@ -77,20 +77,18 @@ Build-Depends: bash-completion,
               golang-go.uber-zap-dev,
               golang-etcd-server-dev (>= 3.5.15-7),
               golang-gopkg-yaml.v3-dev,
-               git
-Standards-Version: 4.7.0
+Standards-Version: 4.7.4
 Homepage: https://www.aptly.info
-Vcs-Git: https://github.com/aptly-dev/aptly.git
-Vcs-Browser: https://github.com/aptly-dev/aptly
+Vcs-Git: https://salsa.debian.org/debian/aptly.git
+Vcs-Browser: https://salsa.debian.org/debian/aptly
 XS-Go-Import-Path: github.com/aptly-dev/aptly
-Testsuite: autopkgtest-pkg-go

 Package: aptly
 Architecture: any
 Depends: ${misc:Depends}, ${shlibs:Depends}, bzip2, xz-utils, gpgv, gpg
-Suggests: graphviz
+Static-Built-Using: ${misc:Static-Built-Using}
 Conflicts: gnupg1, gpgv1
-Built-Using: ${misc:Static-Built-Using}, ${misc:Built-Using}
+Suggests: graphviz
 Description: Swiss army knife for Debian repository management - main package
 It offers several features making it easy to manage Debian package
 repositories:
@@ -107,7 +105,7 @@ Description: Swiss army knife for Debian repository management - main package
 This is the main package, it contains the aptly command-line utility.

 Package: aptly-api
-Architecture: any
+Architecture: all
 Depends: ${misc:Depends}, aptly
 Description: Swiss army knife for Debian repository management - API
 It offers several features making it easy to manage Debian package
@@ -123,10 +121,3 @@ Description: Swiss army knife for Debian repository management - API
  - merge two or more snapshots into one
 .
 This package contains the aptly-api service.
-
-Package: aptly-dbg
-Architecture: any
-Depends: ${misc:Depends}
-Built-Using: ${misc:Static-Built-Using}, ${misc:Built-Using}
-Description: Debian repository management tool (debug files)
- Debug symbols for aptly
@@ -0,0 +1,3 @@
+[DEFAULT]
+debian-branch = debian/master
+upstream-branch = upstream/latest
@@ -0,0 +1 @@
+usr/bin/files
@@ -0,0 +1,123 @@
+From: =?utf-8?q?Andr=C3=A9_Roth?= <neolynx@gmail.com>
+Date: Tue, 15 Oct 2024 12:09:33 +0200
+Subject: Disable swagger
+
+This can be enabled once the following modules make it into Debian:
+
+  - github.com/swaggo/files v1.0.1
+  - github.com/swaggo/gin-swagger v1.6.0
+  - github.com/swaggo/swag v1.16.3
+
+Forwarded: not-needed
+---
+ api/router.go          | 22 +++++++++++-----------
+ docs/index.go          | 10 ----------
+ docs/index.go.disabled | 10 ++++++++++
+ man/aptly.1            |  3 ++-
+ man/aptly.1.ronn.tmpl  |  3 ++-
+ 5 files changed, 25 insertions(+), 23 deletions(-)
+ delete mode 100644 docs/index.go
+ create mode 100644 docs/index.go.disabled
+
+diff --git a/api/router.go b/api/router.go
+index 3cd7d42..cf53cd2 100644
+--- a/api/router.go
+++ b/api/router.go
+@@ -11,9 +11,9 @@
+ 	"github.com/prometheus/client_golang/prometheus/promhttp"
+ 	"github.com/rs/zerolog/log"
+ 
+-	"github.com/aptly-dev/aptly/docs"
+-	swaggerFiles "github.com/swaggo/files"
+-	ginSwagger "github.com/swaggo/gin-swagger"
+	// _ "github.com/aptly-dev/aptly/docs" // import docs
+	// swaggerFiles "github.com/swaggo/files"
+	// ginSwagger "github.com/swaggo/gin-swagger"
+ )
+ 
+ var context *ctx.AptlyContext
+@@ -63,14 +63,14 @@ func Router(c *ctx.AptlyContext) http.Handler {
+ 
+ 	router.Use(gin.Recovery(), gin.ErrorLogger())
+ 
+-	if c.Config().EnableSwaggerEndpoint {
+-		router.GET("docs.html", func(c *gin.Context) {
+-			c.Data(http.StatusOK, "text/html; charset=utf-8", docs.DocsHTML)
+-		})
+-		router.Use(redirectSwagger)
+-		url := ginSwagger.URL("/docs/doc.json")
+-		router.GET("/docs/*any", ginSwagger.WrapHandler(swaggerFiles.Handler, url))
+-	}
+	// if c.Config().EnableSwaggerEndpoint {
+	// 	router.GET("docs.html", func(c *gin.Context) {
+	// 		c.Data(http.StatusOK, "text/html; charset=utf-8", docs.DocsHTML)
+	// 	})
+	// 	router.Use(redirectSwagger)
+	// 	url := ginSwagger.URL("/docs/doc.json")
+	// 	router.GET("/docs/*any", ginSwagger.WrapHandler(swaggerFiles.Handler, url))
+	// }
+ 
+ 	if c.Config().EnableMetricsEndpoint {
+ 		MetricsCollectorRegistrar.Register(router)
+diff --git a/docs/index.go b/docs/index.go
+deleted file mode 100644
+index ca4c914..0000000
+--- a/docs/index.go
+++ /dev/null
+@@ -1,10 +0,0 @@
+-package docs
+-
+-import (
+-	_ "embed" // embed html below
+-
+-	_ "github.com/swaggo/swag" // make sure swag is in go.mod
+-)
+-
+-//go:embed docs.html
+-var DocsHTML []byte
+diff --git a/docs/index.go.disabled b/docs/index.go.disabled
+new file mode 100644
+index 0000000..ca4c914
+--- /dev/null
+++ b/docs/index.go.disabled
+@@ -0,0 +1,10 @@
+package docs
+
+import (
+	_ "embed" // embed html below
+
+	_ "github.com/swaggo/swag" // make sure swag is in go.mod
+)
+
+//go:embed docs.html
+var DocsHTML []byte
+diff --git a/man/aptly.1 b/man/aptly.1
+index bd6ad22..11ed990 100644
+--- a/man/aptly.1
+++ b/man/aptly.1
+@@ -111,8 +111,9 @@ The legacy json configuration is still supported (and also supports comments):
+   // Enable metrics for Prometheus client
+   "enableMetricsEndpoint": false,
+ 
+  // Not implemented in this version\.
+   // Enable API documentation on /docs
+-  "enableSwaggerEndpoint": false,
+  //"enableSwaggerEndpoint": false,
+ 
+   // OBSOLETE: use via url param ?_async=true
+   "AsyncAPI": false,
+diff --git a/man/aptly.1.ronn.tmpl b/man/aptly.1.ronn.tmpl
+index 203cc7f..ed2c87c 100644
+--- a/man/aptly.1.ronn.tmpl
+++ b/man/aptly.1.ronn.tmpl
+@@ -100,8 +100,9 @@ The legacy json configuration is still supported (and also supports comments):
+       // Enable metrics for Prometheus client
+       "enableMetricsEndpoint": false,
+ 
+      // Not implemented in this version.
+       // Enable API documentation on /docs
+-      "enableSwaggerEndpoint": false,
+      //"enableSwaggerEndpoint": false,
+ 
+       // OBSOLETE: use via url param ?_async=true
+       "AsyncAPI": false,
@@ -0,0 +1,880 @@
+From: =?utf-8?q?Andr=C3=A9_Roth?= <neolynx@gmail.com>
+Date: Sun, 17 Nov 2024 17:58:04 +0100
+Subject: Disable new azure-sdk
+
+This reverts commit e2cbd637b82a153a6756f2af0519e8fe769ee9ab.
+
+We can enable this once the golang-github-azure-azure-sdk-for-go-dev
+packages are upgraded in Debian:
+
+  - github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0
+  - github.com/Azure/azure-sdk-for-go/sdk/azcore v1.14.0
+  - github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.4.1
+
+Forwarded: not-needed
+---
+ azure/azure.go             |  89 +++++++++++++++-----------------
+ azure/package_pool.go      |  45 ++++++++--------
+ azure/package_pool_test.go |   8 ++-
+ azure/public.go            | 125 +++++++++++++++++++++------------------------
+ azure/public_test.go       |  49 +++++++++---------
+ context/context.go         |   1 +
+ deb/list.go                |   1 +
+ go.mod                     |   8 +--
+ go.sum                     |  52 +++++++++++--------
+ 9 files changed, 185 insertions(+), 193 deletions(-)
+
+diff --git a/azure/azure.go b/azure/azure.go
+index 3f12678..b313f90 100644
+--- a/azure/azure.go
+++ b/azure/azure.go
+@@ -5,35 +5,28 @@
+ import (
+ 	"context"
+ 	"encoding/hex"
+-	"errors"
+ 	"fmt"
+ 	"io"
+-	"os"
+	"net/url"
+ 	"path/filepath"
+ 	"time"
+ 
+-	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
+-	"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
+-	"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/blob"
+	"github.com/Azure/azure-storage-blob-go/azblob"
+ 	"github.com/aptly-dev/aptly/aptly"
+ )
+ 
+ func isBlobNotFound(err error) bool {
+-	var respErr *azcore.ResponseError
+-	if errors.As(err, &respErr) {
+-		return respErr.StatusCode == 404 // BlobNotFound
+-	}
+-	return false
+	storageError, ok := err.(azblob.StorageError)
+	return ok && storageError.ServiceCode() == azblob.ServiceCodeBlobNotFound
+ }
+ 
+ type azContext struct {
+-	client    *azblob.Client
+-	container string
+	container azblob.ContainerURL
+ 	prefix    string
+ }
+ 
+ func newAzContext(accountName, accountKey, container, prefix, endpoint string) (*azContext, error) {
+-	cred, err := azblob.NewSharedKeyCredential(accountName, accountKey)
+	credential, err := azblob.NewSharedKeyCredential(accountName, accountKey)
+ 	if err != nil {
+ 		return nil, err
+ 	}
+@@ -42,14 +35,15 @@ func newAzContext(accountName, accountKey, container, prefix, endpoint string) (
+ 		endpoint = fmt.Sprintf("https://%s.blob.core.windows.net", accountName)
+ 	}
+ 
+-	serviceClient, err := azblob.NewClientWithSharedKeyCredential(endpoint, cred, nil)
+	url, err := url.Parse(fmt.Sprintf("%s/%s", endpoint, container))
+ 	if err != nil {
+ 		return nil, err
+ 	}
+ 
+	containerURL := azblob.NewContainerURL(*url, azblob.NewPipeline(credential, azblob.PipelineOptions{}))
+
+ 	result := &azContext{
+-		client:    serviceClient,
+-		container: container,
+		container: containerURL,
+ 		prefix:    prefix,
+ 	}
+ 
+@@ -60,6 +54,10 @@ func (az *azContext) blobPath(path string) string {
+ 	return filepath.Join(az.prefix, path)
+ }
+ 
+func (az *azContext) blobURL(path string) azblob.BlobURL {
+	return az.container.NewBlobURL(az.blobPath(path))
+}
+
+ func (az *azContext) internalFilelist(prefix string, progress aptly.Progress) (paths []string, md5s []string, err error) {
+ 	const delimiter = "/"
+ 	paths = make([]string, 0, 1024)
+@@ -69,33 +67,27 @@ func (az *azContext) internalFilelist(prefix string, progress aptly.Progress) (p
+ 		prefix += delimiter
+ 	}
+ 
+-	ctx := context.Background()
+-	maxResults := int32(1)
+-	pager := az.client.NewListBlobsFlatPager(az.container, &azblob.ListBlobsFlatOptions{
+-		Prefix:     &prefix,
+-		MaxResults: &maxResults,
+-		Include:    azblob.ListBlobsInclude{Metadata: true},
+-	})
+-
+-	// Iterate over each page
+-	for pager.More() {
+-		page, err := pager.NextPage(ctx)
+	for marker := (azblob.Marker{}); marker.NotDone(); {
+		listBlob, err := az.container.ListBlobsFlatSegment(
+			context.Background(), marker, azblob.ListBlobsSegmentOptions{
+				Prefix:     prefix,
+				MaxResults: 1,
+				Details:    azblob.BlobListingDetails{Metadata: true}})
+ 		if err != nil {
+ 			return nil, nil, fmt.Errorf("error listing under prefix %s in %s: %s", prefix, az, err)
+ 		}
+ 
+-		for _, blob := range page.Segment.BlobItems {
+-			if prefix == "" {
+-				paths = append(paths, *blob.Name)
+-			} else {
+-				name := *blob.Name
+-				paths = append(paths, name[len(prefix):])
+-			}
+-			b := *blob
+-			md5 := b.Properties.ContentMD5
+-			md5s = append(md5s, fmt.Sprintf("%x", md5))
+		marker = listBlob.NextMarker
+ 
+		for _, blob := range listBlob.Segment.BlobItems {
+			if prefix == "" {
+				paths = append(paths, blob.Name)
+			} else {
+				paths = append(paths, blob.Name[len(prefix):])
+			}
+			md5s = append(md5s, fmt.Sprintf("%x", blob.Properties.ContentMD5))
+ 		}
+
+ 		if progress != nil {
+ 			time.Sleep(time.Duration(500) * time.Millisecond)
+ 			progress.AddBar(1)
+@@ -105,27 +97,28 @@ func (az *azContext) internalFilelist(prefix string, progress aptly.Progress) (p
+ 	return paths, md5s, nil
+ }
+ 
+-func (az *azContext) putFile(blobName string, source io.Reader, sourceMD5 string) error {
+-	uploadOptions := &azblob.UploadFileOptions{
+-		BlockSize:   4 * 1024 * 1024,
+-		Concurrency: 8,
+func (az *azContext) putFile(blob azblob.BlobURL, source io.Reader, sourceMD5 string) error {
+	uploadOptions := azblob.UploadStreamToBlockBlobOptions{
+		BufferSize: 4 * 1024 * 1024,
+		MaxBuffers: 8,
+ 	}
+ 
+-	path := az.blobPath(blobName)
+ 	if len(sourceMD5) > 0 {
+ 		decodedMD5, err := hex.DecodeString(sourceMD5)
+ 		if err != nil {
+ 			return err
+ 		}
+-		uploadOptions.HTTPHeaders = &blob.HTTPHeaders{
+-			BlobContentMD5: decodedMD5,
+		uploadOptions.BlobHTTPHeaders = azblob.BlobHTTPHeaders{
+			ContentMD5: decodedMD5,
+ 		}
+ 	}
+ 
+-	var err error
+-	if file, ok := source.(*os.File); ok {
+-		_, err = az.client.UploadFile(context.TODO(), az.container, path, file, uploadOptions)
+-	}
+	_, err := azblob.UploadStreamToBlockBlob(
+		context.Background(),
+		source,
+		blob.ToBlockBlobURL(),
+		uploadOptions,
+	)
+ 
+ 	return err
+ }
+diff --git a/azure/package_pool.go b/azure/package_pool.go
+index 97be8e6..6d7af1a 100644
+--- a/azure/package_pool.go
+++ b/azure/package_pool.go
+@@ -5,6 +5,7 @@
+ 	"os"
+ 	"path/filepath"
+ 
+	"github.com/Azure/azure-storage-blob-go/azblob"
+ 	"github.com/aptly-dev/aptly/aptly"
+ 	"github.com/aptly-dev/aptly/utils"
+ 	"github.com/pkg/errors"
+@@ -40,7 +41,10 @@ func (pool *PackagePool) buildPoolPath(filename string, checksums *utils.Checksu
+ 	return filepath.Join(hash[0:2], hash[2:4], hash[4:32]+"_"+filename)
+ }
+ 
+-func (pool *PackagePool) ensureChecksums(poolPath string, checksumStorage aptly.ChecksumStorage) (*utils.ChecksumInfo, error) {
+func (pool *PackagePool) ensureChecksums(
+	poolPath string,
+	checksumStorage aptly.ChecksumStorage,
+) (*utils.ChecksumInfo, error) {
+ 	targetChecksums, err := checksumStorage.Get(poolPath)
+ 	if err != nil {
+ 		return nil, err
+@@ -48,7 +52,8 @@ func (pool *PackagePool) ensureChecksums(poolPath string, checksumStorage aptly.
+ 
+ 	if targetChecksums == nil {
+ 		// we don't have checksums stored yet for this file
+-		download, err := pool.az.client.DownloadStream(context.Background(), pool.az.container, poolPath, nil)
+		blob := pool.az.blobURL(poolPath)
+		download, err := blob.Download(context.Background(), 0, 0, azblob.BlobAccessConditions{}, false, azblob.ClientProvidedKeyOptions{})
+ 		if err != nil {
+ 			if isBlobNotFound(err) {
+ 				return nil, nil
+@@ -58,7 +63,7 @@ func (pool *PackagePool) ensureChecksums(poolPath string, checksumStorage aptly.
+ 		}
+ 
+ 		targetChecksums = &utils.ChecksumInfo{}
+-		*targetChecksums, err = utils.ChecksumsForReader(download.Body)
+		*targetChecksums, err = utils.ChecksumsForReader(download.Body(azblob.RetryReaderOptions{}))
+ 		if err != nil {
+ 			return nil, errors.Wrapf(err, "error checksumming blob at %s", poolPath)
+ 		}
+@@ -87,49 +92,46 @@ func (pool *PackagePool) LegacyPath(_ string, _ *utils.ChecksumInfo) (string, er
+ }
+ 
+ func (pool *PackagePool) Size(path string) (int64, error) {
+-	serviceClient := pool.az.client.ServiceClient()
+-	containerClient := serviceClient.NewContainerClient(pool.az.container)
+-	blobClient := containerClient.NewBlobClient(path)
+-
+-	props, err := blobClient.GetProperties(context.TODO(), nil)
+	blob := pool.az.blobURL(path)
+	props, err := blob.GetProperties(context.Background(), azblob.BlobAccessConditions{}, azblob.ClientProvidedKeyOptions{})
+ 	if err != nil {
+ 		return 0, errors.Wrapf(err, "error examining %s from %s", path, pool)
+ 	}
+ 
+-	return *props.ContentLength, nil
+	return props.ContentLength(), nil
+ }
+ 
+ func (pool *PackagePool) Open(path string) (aptly.ReadSeekerCloser, error) {
+	blob := pool.az.blobURL(path)
+
+ 	temp, err := os.CreateTemp("", "blob-download")
+ 	if err != nil {
+-		return nil, errors.Wrapf(err, "error creating tempfile for %s", path)
+		return nil, errors.Wrap(err, "error creating temporary file for blob download")
+ 	}
+
+ 	defer func () { _ = os.Remove(temp.Name()) }()
+ 
+-	_, err = pool.az.client.DownloadFile(context.TODO(), pool.az.container, path, temp, nil)
+	err = azblob.DownloadBlobToFile(context.Background(), blob, 0, 0, temp, azblob.DownloadFromBlobOptions{})
+ 	if err != nil {
+-		return nil, errors.Wrapf(err, "error downloading blob %s", path)
+		return nil, errors.Wrapf(err, "error downloading blob at %s", path)
+ 	}
+ 
+ 	return temp, nil
+ }
+ 
+ func (pool *PackagePool) Remove(path string) (int64, error) {
+-	serviceClient := pool.az.client.ServiceClient()
+-	containerClient := serviceClient.NewContainerClient(pool.az.container)
+-	blobClient := containerClient.NewBlobClient(path)
+-
+-	props, err := blobClient.GetProperties(context.TODO(), nil)
+	blob := pool.az.blobURL(path)
+	props, err := blob.GetProperties(context.Background(), azblob.BlobAccessConditions{}, azblob.ClientProvidedKeyOptions{})
+ 	if err != nil {
+-		return 0, errors.Wrapf(err, "error examining %s from %s", path, pool)
+		return 0, errors.Wrapf(err, "error getting props of %s from %s", path, pool)
+ 	}
+ 
+-	_, err = pool.az.client.DeleteBlob(context.Background(), pool.az.container, path, nil)
+	_, err = blob.Delete(context.Background(), azblob.DeleteSnapshotsOptionNone, azblob.BlobAccessConditions{})
+ 	if err != nil {
+ 		return 0, errors.Wrapf(err, "error deleting %s from %s", path, pool)
+ 	}
+ 
+-	return *props.ContentLength, nil
+	return props.ContentLength(), nil
+ }
+ 
+ func (pool *PackagePool) Import(srcPath, basename string, checksums *utils.ChecksumInfo, _ bool, checksumStorage aptly.ChecksumStorage) (string, error) {
+@@ -143,6 +145,7 @@ func (pool *PackagePool) Import(srcPath, basename string, checksums *utils.Check
+ 	}
+ 
+ 	path := pool.buildPoolPath(basename, checksums)
+	blob := pool.az.blobURL(path)
+ 	targetChecksums, err := pool.ensureChecksums(path, checksumStorage)
+ 	if err != nil {
+ 		return "", err
+@@ -158,7 +161,7 @@ func (pool *PackagePool) Import(srcPath, basename string, checksums *utils.Check
+ 	}
+ 	defer func() { _ = source.Close() }()
+ 
+-	err = pool.az.putFile(path, source, checksums.MD5)
+	err = pool.az.putFile(blob, source, checksums.MD5)
+ 	if err != nil {
+ 		return "", err
+ 	}
+diff --git a/azure/package_pool_test.go b/azure/package_pool_test.go
+index ef562cb..6b1341d 100644
+--- a/azure/package_pool_test.go
+++ b/azure/package_pool_test.go
+@@ -7,7 +7,7 @@
+ 	"path/filepath"
+ 	"runtime"
+ 
+-        "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
+	"github.com/Azure/azure-storage-blob-go/azblob"
+ 	"github.com/aptly-dev/aptly/aptly"
+ 	"github.com/aptly-dev/aptly/files"
+ 	"github.com/aptly-dev/aptly/utils"
+@@ -50,10 +50,8 @@ func (s *PackagePoolSuite) SetUpTest(c *C) {
+ 
+ 	s.pool, err = NewPackagePool(s.accountName, s.accountKey, container, "", s.endpoint)
+ 	c.Assert(err, IsNil)
+-        publicAccessType := azblob.PublicAccessTypeContainer
+-        _, err = s.pool.az.client.CreateContainer(context.TODO(), s.pool.az.container, &azblob.CreateContainerOptions{
+-            Access: &publicAccessType,
+-        })
+	cnt := s.pool.az.container
+	_, err = cnt.Create(context.Background(), azblob.Metadata{}, azblob.PublicAccessContainer)
+ 	c.Assert(err, IsNil)
+ 
+ 	s.prefixedPool, err = NewPackagePool(s.accountName, s.accountKey, container, prefix, s.endpoint)
+diff --git a/azure/public.go b/azure/public.go
+index 6775e14..efd2e7a 100644
+--- a/azure/public.go
+++ b/azure/public.go
+@@ -3,22 +3,21 @@
+ import (
+ 	"context"
+ 	"fmt"
+	"net/http"
+ 	"os"
+ 	"path/filepath"
+ 	"time"
+ 
+-	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
+-	"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/blob"
+-	"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/lease"
+	"github.com/Azure/azure-storage-blob-go/azblob"
+ 	"github.com/aptly-dev/aptly/aptly"
+ 	"github.com/aptly-dev/aptly/utils"
+-	"github.com/google/uuid"
+ 	"github.com/pkg/errors"
+ )
+ 
+ // PublishedStorage abstract file system with published files (actually hosted on Azure)
+ type PublishedStorage struct {
+ 	// FIXME: unused ???? prefix    string
+	container azblob.ContainerURL
+ 	az        *azContext
+ 	pathCache map[string]map[string]string
+ }
+@@ -67,7 +66,7 @@ func (storage *PublishedStorage) PutFile(path string, sourceFilename string) err
+ 	}
+ 	defer func() { _ = source.Close() }()
+ 
+-	err = storage.az.putFile(path, source, sourceMD5)
+	err = storage.az.putFile(storage.az.blobURL(path), source, sourceMD5)
+ 	if err != nil {
+ 		err = errors.Wrap(err, fmt.Sprintf("error uploading %s to %s", sourceFilename, storage))
+ 	}
+@@ -77,15 +76,14 @@ func (storage *PublishedStorage) PutFile(path string, sourceFilename string) err
+ 
+ // RemoveDirs removes directory structure under public path
+ func (storage *PublishedStorage) RemoveDirs(path string, _ aptly.Progress) error {
+-	path = storage.az.blobPath(path)
+ 	filelist, err := storage.Filelist(path)
+ 	if err != nil {
+ 		return err
+ 	}
+ 
+ 	for _, filename := range filelist {
+-		blob := filepath.Join(path, filename)
+-		_, err := storage.az.client.DeleteBlob(context.Background(), storage.az.container, blob, nil)
+		blob := storage.az.blobURL(filepath.Join(path, filename))
+		_, err := blob.Delete(context.Background(), azblob.DeleteSnapshotsOptionNone, azblob.BlobAccessConditions{})
+ 		if err != nil {
+ 			return fmt.Errorf("error deleting path %s from %s: %s", filename, storage, err)
+ 		}
+@@ -96,8 +94,8 @@ func (storage *PublishedStorage) RemoveDirs(path string, _ aptly.Progress) error
+ 
+ // Remove removes single file under public path
+ func (storage *PublishedStorage) Remove(path string) error {
+-	path = storage.az.blobPath(path)
+-	_, err := storage.az.client.DeleteBlob(context.Background(), storage.az.container, path, nil)
+	blob := storage.az.blobURL(path)
+	_, err := blob.Delete(context.Background(), azblob.DeleteSnapshotsOptionNone, azblob.BlobAccessConditions{})
+ 	if err != nil {
+ 		err = errors.Wrap(err, fmt.Sprintf("error deleting %s from %s: %s", path, storage, err))
+ 	}
+@@ -116,8 +114,9 @@ func (storage *PublishedStorage) LinkFromPool(publishedPrefix, publishedRelPath,
+ 	sourcePath string, sourceChecksums utils.ChecksumInfo, force bool) error {
+ 
+ 	relFilePath := filepath.Join(publishedRelPath, fileName)
+-	prefixRelFilePath := filepath.Join(publishedPrefix, relFilePath)
+-	poolPath := storage.az.blobPath(prefixRelFilePath)
+	// prefixRelFilePath := filepath.Join(publishedPrefix, relFilePath)
+	// FIXME: check how to integrate publishedPrefix:
+	poolPath := storage.az.blobPath(fileName)
+ 
+ 	if storage.pathCache == nil {
+ 		storage.pathCache = make(map[string]map[string]string)
+@@ -160,7 +159,7 @@ func (storage *PublishedStorage) LinkFromPool(publishedPrefix, publishedRelPath,
+ 	}
+ 	defer func() { _ = source.Close() }()
+ 
+-	err = storage.az.putFile(relFilePath, source, sourceMD5)
+	err = storage.az.putFile(storage.az.blobURL(relFilePath), source, sourceMD5)
+ 	if err == nil {
+ 		pathCache[relFilePath] = sourceMD5
+ 	} else {
+@@ -177,60 +176,59 @@ func (storage *PublishedStorage) Filelist(prefix string) ([]string, error) {
+ }
+ 
+ // Internal copy or move implementation
+-func (storage *PublishedStorage) internalCopyOrMoveBlob(src, dst string, metadata map[string]*string, move bool) error {
+func (storage *PublishedStorage) internalCopyOrMoveBlob(src, dst string, metadata azblob.Metadata, move bool) error {
+ 	const leaseDuration = 30
+-	leaseID := uuid.NewString()
+ 
+-	serviceClient := storage.az.client.ServiceClient()
+-	containerClient := serviceClient.NewContainerClient(storage.az.container)
+-	srcBlobClient := containerClient.NewBlobClient(src)
+-	blobLeaseClient, err := lease.NewBlobClient(srcBlobClient, &lease.BlobClientOptions{LeaseID: to.Ptr(leaseID)})
+-	if err != nil {
+-		return fmt.Errorf("error acquiring lease on source blob %s", src)
+-	}
+-
+-	_, err = blobLeaseClient.AcquireLease(context.Background(), leaseDuration, nil)
+-	if err != nil {
+-		return fmt.Errorf("error acquiring lease on source blob %s", src)
+	dstBlobURL := storage.az.blobURL(dst)
+	srcBlobURL := storage.az.blobURL(src)
+	leaseResp, err := srcBlobURL.AcquireLease(context.Background(), "", leaseDuration, azblob.ModifiedAccessConditions{})
+	if err != nil || leaseResp.StatusCode() != http.StatusCreated {
+		return fmt.Errorf("error acquiring lease on source blob %s", srcBlobURL)
+ 	}
+ 	defer func() {
+-		_, _ = blobLeaseClient.BreakLease(context.Background(), &lease.BlobBreakOptions{BreakPeriod: to.Ptr(int32(60))})
+		_, _ =  srcBlobURL.BreakLease(context.Background(), azblob.LeaseBreakNaturally, azblob.ModifiedAccessConditions{})
+ 	}()
+	srcBlobLeaseID := leaseResp.LeaseID()
+ 
+-	dstBlobClient := containerClient.NewBlobClient(dst)
+-	copyResp, err := dstBlobClient.StartCopyFromURL(context.Background(), srcBlobClient.URL(), &blob.StartCopyFromURLOptions{
+-		Metadata: metadata,
+-	})
+-
+	copyResp, err := dstBlobURL.StartCopyFromURL(
+		context.Background(),
+		srcBlobURL.URL(),
+		metadata,
+		azblob.ModifiedAccessConditions{},
+		azblob.BlobAccessConditions{},
+		azblob.DefaultAccessTier,
+		nil)
+ 	if err != nil {
+ 		return fmt.Errorf("error copying %s -> %s in %s: %s", src, dst, storage, err)
+ 	}
+ 
+-	copyStatus := *copyResp.CopyStatus
+	copyStatus := copyResp.CopyStatus()
+ 	for {
+-		if copyStatus == blob.CopyStatusTypeSuccess {
+		if copyStatus == azblob.CopyStatusSuccess {
+ 			if move {
+-				_, err := storage.az.client.DeleteBlob(context.Background(), storage.az.container, src, &blob.DeleteOptions{
+-					AccessConditions: &blob.AccessConditions{
+-						LeaseAccessConditions: &blob.LeaseAccessConditions{
+-							LeaseID: &leaseID,
+-						},
+-					},
+-				})
+				_, err = srcBlobURL.Delete(
+					context.Background(),
+					azblob.DeleteSnapshotsOptionNone,
+					azblob.BlobAccessConditions{
+						LeaseAccessConditions: azblob.LeaseAccessConditions{LeaseID: srcBlobLeaseID},
+					})
+ 				return err
+ 			}
+ 			return nil
+-		} else if copyStatus == blob.CopyStatusTypePending {
+		} else if copyStatus == azblob.CopyStatusPending {
+ 			time.Sleep(1 * time.Second)
+-			getMetadata, err := dstBlobClient.GetProperties(context.TODO(), nil)
+			blobPropsResp, err := dstBlobURL.GetProperties(
+				context.Background(),
+				azblob.BlobAccessConditions{LeaseAccessConditions: azblob.LeaseAccessConditions{LeaseID: srcBlobLeaseID}},
+				azblob.ClientProvidedKeyOptions{})
+ 			if err != nil {
+-				return fmt.Errorf("error getting copy progress %s", dst)
+				return fmt.Errorf("error getting destination blob properties %s", dstBlobURL)
+ 			}
+-			copyStatus = *getMetadata.CopyStatus
+			copyStatus = blobPropsResp.CopyStatus()
+ 
+-			_, err = blobLeaseClient.RenewLease(context.Background(), nil)
+			_, err = srcBlobURL.RenewLease(context.Background(), srcBlobLeaseID, azblob.ModifiedAccessConditions{})
+ 			if err != nil {
+-				return fmt.Errorf("error renewing source blob lease %s", src)
+				return fmt.Errorf("error renewing source blob lease %s", srcBlobURL)
+ 			}
+ 		} else {
+ 			return fmt.Errorf("error copying %s -> %s in %s: %s", dst, src, storage, copyStatus)
+@@ -245,9 +243,7 @@ func (storage *PublishedStorage) RenameFile(oldName, newName string) error {
+ 
+ // SymLink creates a copy of src file and adds link information as meta data
+ func (storage *PublishedStorage) SymLink(src string, dst string) error {
+-	metadata := make(map[string]*string)
+-	metadata["SymLink"] = &src
+-	return storage.internalCopyOrMoveBlob(src, dst, metadata, false /* do not remove src */)
+	return storage.internalCopyOrMoveBlob(src, dst, azblob.Metadata{"SymLink": src}, false /* move */)
+ }
+ 
+ // HardLink using symlink functionality as hard links do not exist
+@@ -257,33 +253,28 @@ func (storage *PublishedStorage) HardLink(src string, dst string) error {
+ 
+ // FileExists returns true if path exists
+ func (storage *PublishedStorage) FileExists(path string) (bool, error) {
+-	serviceClient := storage.az.client.ServiceClient()
+-	containerClient := serviceClient.NewContainerClient(storage.az.container)
+-	blobClient := containerClient.NewBlobClient(path)
+-	_, err := blobClient.GetProperties(context.Background(), nil)
+	blob := storage.az.blobURL(path)
+	resp, err := blob.GetProperties(context.Background(), azblob.BlobAccessConditions{}, azblob.ClientProvidedKeyOptions{})
+ 	if err != nil {
+ 		if isBlobNotFound(err) {
+ 			return false, nil
+ 		}
+-		return false, fmt.Errorf("error checking if blob %s exists: %v", path, err)
+		return false, err
+	} else if resp.StatusCode() == http.StatusOK {
+		return true, nil
+ 	}
+-	return true, nil
+	return false, fmt.Errorf("error checking if blob %s exists %d", blob, resp.StatusCode())
+ }
+ 
+ // ReadLink returns the symbolic link pointed to by path.
+ // This simply reads text file created with SymLink
+ func (storage *PublishedStorage) ReadLink(path string) (string, error) {
+-	serviceClient := storage.az.client.ServiceClient()
+-	containerClient := serviceClient.NewContainerClient(storage.az.container)
+-	blobClient := containerClient.NewBlobClient(path)
+-	props, err := blobClient.GetProperties(context.Background(), nil)
+	blob := storage.az.blobURL(path)
+	resp, err := blob.GetProperties(context.Background(), azblob.BlobAccessConditions{}, azblob.ClientProvidedKeyOptions{})
+ 	if err != nil {
+-		return "", fmt.Errorf("failed to get blob properties: %v", err)
+		return "", err
+	} else if resp.StatusCode() != http.StatusOK {
+		return "", fmt.Errorf("error checking if blob %s exists %d", blob, resp.StatusCode())
+ 	}
+-
+-	metadata := props.Metadata
+-	if originalBlob, exists := metadata["original_blob"]; exists {
+-		return *originalBlob, nil
+-	}
+-	return "", fmt.Errorf("error reading link %s: %v", path, err)
+	return resp.NewMetadata()["SymLink"], nil
+ }
+diff --git a/azure/public_test.go b/azure/public_test.go
+index 5c912c5..f58ad51 100644
+--- a/azure/public_test.go
+++ b/azure/public_test.go
+@@ -7,11 +7,8 @@
+ 	"io"
+ 	"os"
+ 	"path/filepath"
+-        "bytes"
+ 
+-        "github.com/Azure/azure-sdk-for-go/sdk/azcore"
+-        "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
+-        "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/blob"
+	"github.com/Azure/azure-storage-blob-go/azblob"
+ 	"github.com/aptly-dev/aptly/files"
+ 	"github.com/aptly-dev/aptly/utils"
+ 	. "gopkg.in/check.v1"
+@@ -69,10 +66,8 @@ func (s *PublishedStorageSuite) SetUpTest(c *C) {
+ 
+ 	s.storage, err = NewPublishedStorage(s.accountName, s.accountKey, container, "", s.endpoint)
+ 	c.Assert(err, IsNil)
+-        publicAccessType := azblob.PublicAccessTypeContainer
+-        _, err = s.storage.az.client.CreateContainer(context.Background(), s.storage.az.container, &azblob.CreateContainerOptions{
+-            Access: &publicAccessType,
+-        })
+	cnt := s.storage.az.container
+	_, err = cnt.Create(context.Background(), azblob.Metadata{}, azblob.PublicAccessContainer)
+ 	c.Assert(err, IsNil)
+ 
+ 	s.prefixedStorage, err = NewPublishedStorage(s.accountName, s.accountKey, container, prefix, s.endpoint)
+@@ -80,39 +75,41 @@ func (s *PublishedStorageSuite) SetUpTest(c *C) {
+ }
+ 
+ func (s *PublishedStorageSuite) TearDownTest(c *C) {
+-        _, err := s.storage.az.client.DeleteContainer(context.Background(), s.storage.az.container, nil)
+	cnt := s.storage.az.container
+	_, err := cnt.Delete(context.Background(), azblob.ContainerAccessConditions{})
+ 	c.Assert(err, IsNil)
+ }
+ 
+ func (s *PublishedStorageSuite) GetFile(c *C, path string) []byte {
+-        resp, err := s.storage.az.client.DownloadStream(context.Background(), s.storage.az.container, path, nil)
+	blob := s.storage.az.container.NewBlobURL(path)
+	resp, err := blob.Download(context.Background(), 0, azblob.CountToEnd, azblob.BlobAccessConditions{}, false, azblob.ClientProvidedKeyOptions{})
+ 	c.Assert(err, IsNil)
+-	data, err := io.ReadAll(resp.Body)
+	body := resp.Body(azblob.RetryReaderOptions{MaxRetryRequests: 3})
+	data, err := io.ReadAll(body)
+ 	c.Assert(err, IsNil)
+ 	return data
+ }
+ 
+ func (s *PublishedStorageSuite) AssertNoFile(c *C, path string) {
+-        serviceClient := s.storage.az.client.ServiceClient()
+-        containerClient := serviceClient.NewContainerClient(s.storage.az.container)
+-        blobClient := containerClient.NewBlobClient(path)
+-        _, err := blobClient.GetProperties(context.Background(), nil)
+	_, err := s.storage.az.container.NewBlobURL(path).GetProperties(
+		context.Background(), azblob.BlobAccessConditions{}, azblob.ClientProvidedKeyOptions{})
+ 	c.Assert(err, NotNil)
+-
+-        storageError, ok := err.(*azcore.ResponseError)
+	storageError, ok := err.(azblob.StorageError)
+ 	c.Assert(ok, Equals, true)
+-	c.Assert(storageError.StatusCode, Equals, 404)
+	c.Assert(string(storageError.ServiceCode()), Equals, string(string(azblob.StorageErrorCodeBlobNotFound)))
+ }
+ 
+ func (s *PublishedStorageSuite) PutFile(c *C, path string, data []byte) {
+ 	hash := md5.Sum(data)
+-        uploadOptions := &azblob.UploadStreamOptions{
+-            HTTPHeaders: &blob.HTTPHeaders{
+-            	BlobContentMD5: hash[:],
+-            },
+-        }
+-        reader := bytes.NewReader(data)
+-        _, err := s.storage.az.client.UploadStream(context.Background(), s.storage.az.container, path, reader, uploadOptions)
+	_, err := azblob.UploadBufferToBlockBlob(
+		context.Background(),
+		data,
+		s.storage.az.container.NewBlockBlobURL(path),
+		azblob.UploadToBlockBlobOptions{
+			BlobHTTPHeaders: azblob.BlobHTTPHeaders{
+				ContentMD5: hash[:],
+			},
+		})
+ 	c.Assert(err, IsNil)
+ }
+ 
+@@ -333,7 +330,7 @@ func (s *PublishedStorageSuite) TestLinkFromPool(c *C) {
+ 
+ 	// 2nd link from pool, providing wrong path for source file
+ 	//
+-	// this test should check that file already exists in Azure and skip upload (which would fail if not skipped)
+	// this test should check that file already exists in S3 and skip upload (which would fail if not skipped)
+ 	s.prefixedStorage.pathCache = nil
+ 	err = s.prefixedStorage.LinkFromPool("", filepath.Join("pool", "main", "m/mars-invaders"), "mars-invaders_1.03.deb", pool, "wrong-looks-like-pathcache-doesnt-work", cksum1, false)
+ 	c.Check(err, IsNil)
+diff --git a/context/context.go b/context/context.go
+index 0ffc3f7..503cad2 100644
+--- a/context/context.go
+++ b/context/context.go
+@@ -100,6 +100,7 @@ func (context *AptlyContext) config() *utils.ConfigStructure {
+ 			configLocations := []string{homeLocation, "/usr/local/etc/aptly.conf", "/etc/aptly.conf"}
+ 
+ 			for _, configLocation := range configLocations {
+				// FIXME: check if exists, check if readable
+ 				err = utils.LoadConfig(configLocation, &utils.Config)
+ 				if os.IsPermission(err) || os.IsNotExist(err) {
+ 					continue
+diff --git a/deb/list.go b/deb/list.go
+index 25a2d28..9eda528 100644
+--- a/deb/list.go
+++ b/deb/list.go
+@@ -598,6 +598,7 @@ func (l *PackageList) Filter(options FilterOptions) (*PackageList, error) {
+ 					//
+ 					// when follow-all-variants is enabled, we need to try to expand anyway,
+ 					// as even if dependency is satisfied now, there might be other ways to satisfy dependency
+					// FIXME: do not search twice
+ 					if result.Search(dep, false, true) != nil {
+ 						if options.DependencyOptions&DepVerboseResolve == DepVerboseResolve && options.Progress != nil {
+ 							options.Progress.ColoredPrintf("@{y}Already satisfied dependency@|: %s with %s", &dep, result.Search(dep, true, true))
+diff --git a/go.mod b/go.mod
+index 53c5e78..d7f145a 100644
+--- a/go.mod
+++ b/go.mod
+@@ -4,6 +4,7 @@ go 1.24
+ 
+ require (
+ 	github.com/AlekSi/pointer v1.1.0
+	github.com/Azure/azure-storage-blob-go v0.15.0
+ 	github.com/DisposaBoy/JsonConfigReader v0.0.0-20171218180944-5ea4d0ddac55
+ 	github.com/awalterschulze/gographviz v2.0.1+incompatible
+ 	github.com/cavaliergopher/grab/v3 v3.0.1
+@@ -41,7 +42,7 @@ require (
+ )
+ 
+ require (
+-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
+	github.com/Azure/azure-pipeline-go v0.2.3 // indirect
+ 	github.com/KyleBanks/depth v1.2.1 // indirect
+ 	github.com/PuerkitoBio/purell v1.1.1 // indirect
+ 	github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
+@@ -87,6 +88,7 @@ require (
+ 	github.com/kr/text v0.2.0 // indirect
+ 	github.com/leodido/go-urn v1.2.4 // indirect
+ 	github.com/mailru/easyjson v0.7.6 // indirect
+	github.com/mattn/go-ieproxy v0.0.9 // indirect
+ 	github.com/mattn/go-isatty v0.0.20 // indirect
+ 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+ 	github.com/modern-go/reflect2 v1.0.2 // indirect
+@@ -96,7 +98,7 @@ require (
+ 	github.com/prometheus/common v0.59.1 // indirect
+ 	github.com/prometheus/procfs v0.15.1 // indirect
+ 	github.com/rivo/uniseg v0.4.7 // indirect
+-	github.com/rogpeppe/go-internal v1.12.0 // indirect
+	github.com/rogpeppe/go-internal v1.10.0 // indirect
+ 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
+ 	go.etcd.io/etcd/api/v3 v3.5.15 // indirect
+ 	go.etcd.io/etcd/client/pkg/v3 v3.5.15 // indirect
+@@ -115,8 +117,6 @@ require (
+ )
+ 
+ require (
+-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.14.0
+-	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.4.1
+ 	github.com/ProtonMail/go-crypto v1.0.0
+ 	github.com/aws/aws-sdk-go-v2 v1.32.5
+ 	github.com/aws/aws-sdk-go-v2/config v1.28.5
+diff --git a/go.sum b/go.sum
+index 502f4b2..453a288 100644
+--- a/go.sum
+++ b/go.sum
+@@ -1,17 +1,20 @@
+ github.com/AlekSi/pointer v1.1.0 h1:SSDMPcXD9jSl8FPy9cRzoRaMJtm9g9ggGTxecRUbQoI=
+ github.com/AlekSi/pointer v1.1.0/go.mod h1:y7BvfRI3wXPWKXEBhU71nbnIEEZX0QTSB2Bj48UJIZE=
+-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.14.0 h1:nyQWyZvwGTvunIMxi1Y9uXkcyr+I7TeNrr/foo4Kpk8=
+-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.14.0/go.mod h1:l38EPgmsp71HHLq9j7De57JcKOWPyhrsW1Awm1JS6K0=
+-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0 h1:tfLQ34V6F7tVSwoTf/4lH5sE0o6eCJuNDTmH09nDpbc=
+-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0/go.mod h1:9kIvujWAA58nmPmWB1m23fyWic1kYZMxD9CxaWn4Qpg=
+-github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 h1:ywEEhmNahHBihViHepv3xPBn1663uRv2t2q/ESv9seY=
+-github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0/go.mod h1:iZDifYGJTIgIIkYRNWPENUnqx6bJ2xnSDFI2tjwZNuY=
+-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.6.0 h1:PiSrjRPpkQNjrM8H0WwKMnZUdu1RGMtd/LdGKUrOo+c=
+-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.6.0/go.mod h1:oDrbWx4ewMylP7xHivfgixbfGBT6APAwsSoHRKotnIc=
+-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.4.1 h1:cf+OIKbkmMHBaC3u78AXomweqM0oxQSgBXRZf3WH4yM=
+-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.4.1/go.mod h1:ap1dmS6vQKJxSMNiGJcq4QuUQkOynyD93gLw6MDF7ek=
+-github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 h1:XHOnouVk1mxXfQidrMEnLlPk9UMeRtyBTnEFtxkV0kU=
+-github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
+github.com/Azure/azure-pipeline-go v0.2.3 h1:7U9HBg1JFK3jHl5qmo4CTZKFTVgMwdFHMVtCdfBE21U=
+github.com/Azure/azure-pipeline-go v0.2.3/go.mod h1:x841ezTBIMG6O3lAcl8ATHnsOPVl2bqk7S3ta6S6u4k=
+github.com/Azure/azure-storage-blob-go v0.15.0 h1:rXtgp8tN1p29GvpGgfJetavIG0V7OgcSXPpwp3tx6qk=
+github.com/Azure/azure-storage-blob-go v0.15.0/go.mod h1:vbjsVbX0dlxnRc4FFMPsS9BsJWPcne7GB7onqlPvz58=
+github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs=
+github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
+github.com/Azure/go-autorest/autorest/adal v0.9.13 h1:Mp5hbtOePIzM8pJVRa3YLrWWmZtoxRXqUEzCfJt3+/Q=
+github.com/Azure/go-autorest/autorest/adal v0.9.13/go.mod h1:W/MM4U6nLxnIskrw4UwWzlHfGjwUS50aOsc/I3yuU8M=
+github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw=
+github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
+github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
+github.com/Azure/go-autorest/logger v0.2.1 h1:IG7i4p/mDa2Ce4TRyAO8IHnVhAVF3RFU+ZtXWSmf4Tg=
+github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
+github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUMfuitfgcfuo=
+github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
+ github.com/DisposaBoy/JsonConfigReader v0.0.0-20171218180944-5ea4d0ddac55 h1:jbGlDKdzAZ92NzK65hUP98ri0/r50vVVvmZsFP/nIqo=
+ github.com/DisposaBoy/JsonConfigReader v0.0.0-20171218180944-5ea4d0ddac55/go.mod h1:GCzqZQHydohgVLSIqRKZeTt8IGb1Y4NaFfim3H40uUI=
+ github.com/KyleBanks/depth v1.2.1 h1:5h8fQADFrWtarTdtDudMmGsC7GPbOAu6RVB3ffsVFHc=
+@@ -91,6 +94,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
+ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+ github.com/fatih/color v1.17.0 h1:GlRw1BRJxkpqUCBKzKOw098ed57fEsKeNjpTe3cSjK4=
+ github.com/fatih/color v1.17.0/go.mod h1:YZ7TlrGPkiz6ku9fK3TLD/pl3CpsiFyu8N92HLgmosI=
+github.com/form3tech-oss/jwt-go v3.2.2+incompatible h1:TcekIExNqud5crz4xD2pavyTgWiPvpYe4Xau31I0PRk=
+github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
+ github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+ github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+ github.com/fsnotify/fsnotify v1.5.4 h1:jRbGcIw6P2Meqdwuo0H1p6JVLbL5DHKAKlYndzMwVZI=
+@@ -127,8 +132,6 @@ github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MG
+ github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+ github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+-github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
+-github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+ github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+ github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+ github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+@@ -149,7 +152,8 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
+ github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+ github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+-github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+ github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+ github.com/h2non/filetype v1.1.3 h1:FKkx9QbD7HR/zjK1Ia5XiBsq9zdLi5Kf3zGyFTAFkGg=
+@@ -197,6 +201,9 @@ github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJ
+ github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+ github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+ github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-ieproxy v0.0.1/go.mod h1:pYabZ6IHcRpFh7vIaLfK7rdcWgFEb3SFJ6/gNWuh88E=
+github.com/mattn/go-ieproxy v0.0.9 h1:RvVbLiMv/Hbjf1gRaC2AQyzwbdVhdId7D2vPnXIml4k=
+github.com/mattn/go-ieproxy v0.0.9/go.mod h1:eF30/rfdQUO9EnzNIZQr0r9HiLMlZNCpJkHbmMuOAE0=
+ github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+ github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+@@ -235,8 +242,6 @@ github.com/onsi/gomega v1.19.0 h1:4ieX6qQjPP/BfC3mpsAtIGGlxTWPeA3Inl/7DtXw1tw=
+ github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
+ github.com/pelletier/go-toml/v2 v2.1.0 h1:FnwAJ4oYMvbT/34k9zzHuZNrhlz48GB3/s6at6/MHO4=
+ github.com/pelletier/go-toml/v2 v2.1.0/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
+-github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
+-github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
+ github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+@@ -254,8 +259,8 @@ github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJ
+ github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
+ github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+ github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+-github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+-github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
+ github.com/rs/xid v1.4.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
+ github.com/rs/zerolog v1.29.1 h1:cO+d60CHkknCbvzEWxP0S9K6KqyTjrCNUy1LdQLCGPc=
+ github.com/rs/zerolog v1.29.1/go.mod h1:Le6ESbR7hc+DP6Lt1THiV8CQSdkkNrd3R0XbEgp3ZBU=
+@@ -319,6 +324,8 @@ golang.org/x/arch v0.3.0/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
+ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+ golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+ golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+@@ -333,14 +340,14 @@ golang.org/x/mod v0.23.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+ golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191112182307-2180aed22343/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+ golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+ golang.org/x/net v0.0.0-20210421230115-4e50805a0758/go.mod h1:72T/g9IO56b78aLF+1Kcs5dz7/ng1VjMUvfKvpfy+jM=
+-golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
+-golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+-golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.0.0-20210610132358-84b48f89b13b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220630215102-69896b714898/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+ golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+@@ -362,6 +369,7 @@ golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5h
+ golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+ golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+ golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191112214154-59a1497f0cea/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+ golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+ golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+ golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -0,0 +1,35 @@
+From: =?utf-8?q?S=C3=A9bastien_Delafond?= <seb@debian.org>
+Date: Mon, 17 Feb 2025 10:11:55 +0100
+Subject: tests: no upstream's etcd install as it's arch-specific,
+ and no swagger-related or modules tasks
+
+Forwarded: not-needed
+---
+ Makefile | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index ffe2e8a..91f96a8 100644
+--- a/Makefile
+++ b/Makefile
+@@ -89,17 +89,12 @@ install:
+ 	# go install -v
+ 	@out=`mktemp`; if ! go install -v > $$out 2>&1; then cat $$out; rm -f $$out; echo "\nBuild failed\n"; exit 1; else rm -f $$out; fi
+ 
+-test: prepare swagger etcd-install  ## Run unit tests (add TEST=regex to specify which tests to run)
+-	@echo "\e[33m\e[1mStarting etcd ...\e[0m"
+-	@mkdir -p /tmp/aptly-etcd-data; system/t13_etcd/start-etcd.sh > /tmp/aptly-etcd-data/etcd.log 2>&1 &
+test: ## Run unit tests
+ 	@echo "\e[33m\e[1mRunning go test ...\e[0m"
+-	faketime "$(TEST_FAKETIME)" go test -v ./... -gocheck.v=true -check.f "$(TEST)" -coverprofile=unit.out; echo $$? > .unit-test.ret
+-	@echo "\e[33m\e[1mStopping etcd ...\e[0m"
+-	@pid=`cat /tmp/etcd.pid`; kill $$pid
+-	@rm -f /tmp/aptly-etcd-data/etcd.log
+	go test -v ./... -gocheck.v=true -coverprofile=unit.out; echo $$? > .unit-test.ret
+ 	@ret=`cat .unit-test.ret`; if [ "$$ret" = "0" ]; then echo "\n\e[32m\e[1mUnit Tests SUCCESSFUL\e[0m"; else echo "\n\e[31m\e[1mUnit Tests FAILED\e[0m"; fi; rm -f .unit-test.ret; exit $$ret
+ 
+-system-test: prepare swagger etcd-install  ## Run system tests
+system-test: ## Run system tests
+ 	# build coverage binary
+ 	go test -v -coverpkg="./..." -c -tags testruncli
+ 	# Download fixture-db, fixture-pool, etcd.db
@@ -0,0 +1,40 @@
+From: =?utf-8?q?S=C3=A9bastien_Delafond?= <seb@debian.org>
+Date: Wed, 24 Sep 2025 07:23:24 +0200
+Subject: Revert "system-tests: abort on failure"
+
+We'd rather have the test suite always run completely, and report
+every failed test at the end.
+
+Forwarded: not-needed
+---
+ system/run.py | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/system/run.py b/system/run.py
+index 4e73fb2..599afe5 100755
+--- a/system/run.py
+++ b/system/run.py
+@@ -50,7 +50,6 @@ def run(include_long_tests=False, capture_results=False, tests=None, filters=Non
+     if not coverage_dir:
+         coverage_dir = mkdtemp(suffix="aptly-coverage")
+ 
+-    failed = False
+     for test in tests:
+         orig_stdout = sys.stdout
+         orig_stderr = sys.stderr
+@@ -158,15 +157,8 @@ def run(include_long_tests=False, capture_results=False, tests=None, filters=Non
+ 
+                 t.shutdown()
+ 
+-                if failed:
+-                    break
+-            if failed:
+-                break
+-
+         sys.stdout = orig_stdout
+         sys.stderr = orig_stderr
+-        if failed:
+-            break
+ 
+     if lastBase is not None:
+         lastBase.shutdown_class()
@@ -0,0 +1,4 @@
+0001-disable-swagger.patch
+0002-disable-new-azure-sdk.patch
+0003-tests-no-upstream-s-etcd-install-as-it-s-arch-specif.patch
+0004-Revert-system-tests-abort-on-failure.patch
@@ -2,47 +2,17 @@

 include /usr/share/dpkg/pkg-info.mk

-export GOPATH=$(shell pwd)/.go
-export DEB_BUILD_OPTIONS=crossbuildcanrunhostbinaries
-
-export GOARCH := $(shell if [ $(DEB_TARGET_ARCH) = "i386" ]; then echo "386"; elif [ $(DEB_TARGET_ARCH) = "armhf" ]; then echo "arm"; else echo  $(DEB_TARGET_ARCH); fi)
-export CGO_ENABLED=1
-
-ifneq ($(DEB_HOST_GNU_TYPE), $(DEB_BUILD_GNU_TYPE))
-	export CC=$(DEB_HOST_GNU_TYPE)-gcc
-endif
-
 %:
 	dh $@ --buildsystem=golang --with=golang,bash-completion

-override_dh_auto_clean:
-	rm -rf build/
-	rm -rf obj-$(DEB_TARGET_GNU_TYPE)/
-	dh_auto_clean
-
 override_dh_auto_test:
 	# run during autopkgtests

 override_dh_auto_install:
 	dh_auto_install -- --no-source

-override_dh_strip:
-	dh_strip --dbg-package=aptly-dbg
-
-override_dh_golang: # fails on non native debian build
-
-# override_dh_makeshlibs:  # fails with cross compiling on non native debian build
-
-override_dh_dwz:  # somehow dwz works only with certain newer debhelper versions
-	dhver=`dpkg-query -f '$${Version}' -W debhelper`; (dpkg --compare-versions "$$dhver" lt 13 || test "$$dhver" = "13.3.4" || test "$$dhver" = "13.6ubuntu1") || dh_dwz
-
-override_dh_shlibdeps:
-ifneq ($(DEB_HOST_GNU_TYPE), $(DEB_BUILD_GNU_TYPE))
-	LD_LIBRARY_PATH=/usr/$(DEB_HOST_GNU_TYPE)/lib:$$LD_LIBRARY_PATH dh_shlibdeps
-else
-	dh_shlibdeps
-endif
-
 override_dh_auto_build:
-	echo $(DEB_VERSION) > VERSION
-	go build -buildmode=pie -o usr/bin/aptly
+	echo $(DEB_VERSION) > obj-$(DEB_TARGET_GNU_TYPE)/src/github.com/aptly-dev/aptly/VERSION
+	mkdir -p obj-$(DEB_TARGET_GNU_TYPE)/src/github.com/aptly-dev/aptly/debian
+	cp debian/aptly.conf obj-$(DEB_TARGET_GNU_TYPE)/src/github.com/aptly-dev/aptly/debian/
+	dh_auto_build
@@ -1 +1 @@
-3.0 (git)
+3.0 (quilt)
@@ -0,0 +1,32 @@
+#!/bin/sh
+
+# run upstream's unit tests with Debian-supplied dependencies
+
+# FIXME: right now this fails hard because many prerequisites are only
+# handled in `make test`
+
+set -e
+set -u
+set -x
+
+BUILD_DIR="${PWD}/_build"
+DH_OPTIONS="-O--buildsystem=golang -O--builddirectory=$BUILD_DIR"
+APTLY_DIR="${BUILD_DIR}/src/github.com/aptly-dev/aptly"
+
+dpkg-source --before-build .
+
+dh_update_autotools_config $DH_OPTIONS
+dh_autoreconf $DH_OPTIONS
+dh_auto_configure $DH_OPTIONS
+
+dpkg-parsechangelog --show-field Version | perl -pe 's/\n//' >| ${APTLY_DIR}/VERSION
+find . -name VERSION
+
+mkdir -p ${APTLY_DIR}/debian
+cp debian/aptly.conf ${APTLY_DIR}/debian/
+
+dh_auto_build $DH_OPTIONS
+
+export PATH=${BUILD_DIR}/bin:$PATH
+
+dh_auto_test $DH_OPTIONS --no-parallel
@@ -1,4 +1,7 @@
-# This file is an addition to the autodep8 tests.
-
-Test-Command: HOME=/tmp aptly repo create autopkgtest
+Tests: unit-test
+Depends: @, @builddeps@, ca-certificates, curl, git, gpg, gpg-agent
 Restrictions: allow-stderr
+
+Tests: system-test
+Depends: @, @builddeps@, ca-certificates, curl, dirmngr, git, gpg, gpg-agent, gpgconf, graphviz, procps, python3, python3-requests-unixsocket, python3-termcolor, python3-swiftclient, python3-boto3, python3-azure-storage, python3-etcd3, python3-plyvel, sudo, zip
+Restrictions: allow-stderr, needs-internet
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+set -eux
+
+TMP_DIR="$(mktemp -d)"
+APTLY_SRC_DIR="${TMP_DIR}/src/github.com/aptly-dev/aptly"
+
+# apply patches
+dpkg-source --before-build .
+
+# copy source to GOPATH-compatible dir
+mkdir -p $(dirname $APTLY_SRC_DIR)
+cp -a . $APTLY_SRC_DIR
+
+# not in a git tree, so we need to generate the version ourselves
+dpkg-parsechangelog --show-field Version | perl -pe 's/\n//' > ${APTLY_SRC_DIR}/VERSION
+
+# use only apt-supplied go libraries
+export GOPATH="${TMP_DIR}:/usr/share/gocode"
+export GO111MODULE=off
@@ -0,0 +1,42 @@
+#!/bin/sh
+
+# run upstream's integration tests
+
+set -eux
+
+. debian/tests/setup
+
+## env
+TESTS_DIR="${APTLY_SRC_DIR}/system"
+
+## functions
+disable_test() {
+  local file=${1}.py
+  local name=$2
+  local reason=$3
+
+  echo "${name}.skipTest = 'Debian autopkgtest: $reason'" >> ${TESTS_DIR}/${file}
+}
+
+## main
+export USER=root # for t07/RootDirInaccessible
+
+disable_test t01_version/version VersionTest "version"
+disable_test t02_config/config CreateConfigTest "different conf"
+disable_test t04_mirror/create CreateMirror18Test "target repo down"
+disable_test t04_mirror/create CreateMirror31Test "public key not found"
+disable_test t04_mirror/create CreateMirror35Test "flaky on s390"
+disable_test t07_serve/serve Serve1Test "minor html diff"
+disable_test t09_repo/edit EditRepo4Test "flaky on riscv64"
+disable_test t10_task/run RunTask1Test "version"
+disable_test t12_api/docs TaskAPITestSwaggerDocs "no recent swag"
+disable_test t12_api/gpg GPGAPITestAddKey "flaky on s390"
+disable_test t12_api/unix_socket UnixSocketAPITest "type mismatch"
+disable_test t12_api/version VersionAPITest "type mismatch"
+disable_test t14_graph/graph CreateGraphTest "no viewer"
+disable_test t14_graph/graph CreateGraphOutputTest "no viewer"
+
+# etcd fixture is entirely arch-specific
+rm -fr ${TESTS_DIR}/t13_etcd
+
+make -C $APTLY_SRC_DIR system-test
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+# run upstream's unit tests with their full etcd fixtures, etc
+
+set -eux
+
+. debian/tests/setup
+
+# FIXME: errors with non-constant format string in call to
+# github.com/aptly-dev/aptly/s3.fatalError
+rm ${APTLY_SRC_DIR}/s3/server_test.go
+rm ${APTLY_SRC_DIR}/s3/public_test.go
+
+# upstream's etcd fixture is arch-specific
+rm ${APTLY_SRC_DIR}/database/etcddb/database_test.go
+
+# TestVerifyClearsigned fails because of an extra signature
+perl -i -pe 's/(TestVerifyClearsigned)/No$1/' ${APTLY_SRC_DIR}/pgp/verify_test.go
+
+make -C $APTLY_SRC_DIR test
@@ -1,5 +1,6 @@
-version=4
-opts=\
-repacksuffix=+ds1,\
-dversionmangle=s/\+ds\d*$// \
-https://github.com/aptly-dev/aptly/tags .*/v(\d[\d\.]*)\.tar\.gz debian uupdate
+Version: 5
+Template: Github
+Owner: aptly-dev
+Project: aptly
+Dversion-Mangle: s/\+ds\d*$//
+Repacksuffix: +ds1
@@ -1,209 +0,0 @@
-# GPG Keys Management
-
-GPG keys are used by aptly to verify the authenticity of remote repository Release files when creating mirrors. This document describes the API endpoints for managing GPG keys in the aptly keyring.
-
-## Overview
-
-Aptly uses GNU Privacy Guard (GPG) to verify signed repository metadata. You must add the repository's GPG public key to aptly's keyring before creating mirrors that verify signatures.
-
-Keys are stored in the aptly keyring (default: `trustedkeys.gpg`). You can have multiple keyrings and specify which one to use via the `Keyring` parameter.
-
-## API Endpoints
-
-### List GPG Keys
-
-**GET /api/gpg/keys**
-
-Lists all public GPG keys currently installed in the aptly keyring.
-
-**Parameters:**
- `keyring` (query, optional): Keyring file to list keys from. Default: `trustedkeys.gpg`
-
-**Response:**
-```json
-{
-  "Keys": [
-    {
-      "KeyID": "8B48AD6246925553",
-      "Fingerprint": "D8E8F5A516E7A2C4F3E4B5A6C7D8E9F0",
-      "Validity": "f",
-      "UserIDs": ["John Doe <john@example.com>"],
-      "CreatedAt": "1611864000"
-    }
-  ]
-}
-```
-
-**Status Codes:**
- `200 OK`: Keys successfully retrieved
- `400 Bad Request`: GPG execution failed or invalid parameters
-
-**Example:**
-```bash
-curl http://localhost:8080/api/gpg/keys
-curl "http://localhost:8080/api/gpg/keys?keyring=custom.gpg"
-```
-
---
-
-### Add GPG Key
-
-**POST /api/gpg/key**
-
-Adds a GPG public key to the aptly keyring. Keys can be added in two ways:
-1. Provide the ASCII-armored key directly
-2. Provide a key server and key ID(s) to download from
-
-**Request Body:**
-```json
-{
-  "Keyring": "trustedkeys.gpg",
-  "GpgKeyArmor": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...",
-  "Keyserver": "hkp://keyserver.ubuntu.com:80",
-  "GpgKeyID": "8B48AD6246925553"
-}
-```
-
-**Parameters:**
- `Keyring` (optional): Keyring file to add keys to. Default: `trustedkeys.gpg`
- `GpgKeyArmor` (optional): ASCII-armored GPG public key
- `Keyserver` (optional): Keyserver URL (e.g., `hkp://keyserver.ubuntu.com:80`)
- `GpgKeyID` (optional): Space-separated key IDs to download from keyserver
-
-**Status Codes:**
- `200 OK`: Key successfully added
- `400 Bad Request`: Invalid parameters or GPG execution failed
-
-**Example - From ASCII Key:**
-```bash
-curl -X POST http://localhost:8080/api/gpg/key \
-  -H "Content-Type: application/json" \
-  -d '{
-    "GpgKeyArmor": "-----BEGIN PGP PUBLIC KEY BLOCK-----\nVersion: GnuPG v2\n...\n-----END PGP PUBLIC KEY BLOCK-----"
-  }'
-```
-
-**Example - From Keyserver:**
-```bash
-curl -X POST http://localhost:8080/api/gpg/key \
-  -H "Content-Type: application/json" \
-  -d '{
-    "Keyserver": "hkp://keyserver.ubuntu.com:80",
-    "GpgKeyID": "8B48AD6246925553 A1B2C3D4E5F67890"
-  }'
-```
-
---
-
-### Delete GPG Key
-
-**DELETE /api/gpg/key**
-
-Removes a GPG key from the aptly keyring.
-
-**Request Body:**
-```json
-{
-  "Keyring": "trustedkeys.gpg",
-  "GpgKeyID": "8B48AD6246925553"
-}
-```
-
-**Parameters:**
- `Keyring` (optional): Keyring file to delete from. Default: `trustedkeys.gpg`
- `GpgKeyID` (required): Key ID or fingerprint to delete
-
-**Status Codes:**
- `200 OK`: Key successfully deleted
- `400 Bad Request`: Invalid parameters or GPG execution failed
-
-**Example:**
-```bash
-curl -X DELETE http://localhost:8080/api/gpg/key \
-  -H "Content-Type: application/json" \
-  -d '{
-    "GpgKeyID": "8B48AD6246925553"
-  }'
-```
-
---
-
-## Use Cases
-
-### 1. Verify Downloaded Repository Metadata
-
-Before creating a mirror from a signed repository, add the repository's GPG key:
-
-```bash
-# Add the key from a keyserver
-curl -X POST http://localhost:8080/api/gpg/key \
-  -H "Content-Type: application/json" \
-  -d '{
-    "Keyserver": "hkp://keyserver.ubuntu.com:80",
-    "GpgKeyID": "EB9B46B91F2D3B7E"
-  }'
-
-# Now create a mirror with signature verification
-# (signature verification configured in mirror settings)
-```
-
-### 2. Manage Multiple Keyrings
-
-Aptly supports using different keyrings for different purposes. For example, one for Debian repositories and another for custom internal repositories:
-
-```bash
-# Add key to Debian keyring
-curl -X POST http://localhost:8080/api/gpg/key \
-  -H "Content-Type: application/json" \
-  -d '{
-    "Keyring": "debian-keys.gpg",
-    "Keyserver": "hkp://keyserver.ubuntu.com:80",
-    "GpgKeyID": "EB9B46B91F2D3B7E"
-  }'
-
-# List keys in Debian keyring
-curl "http://localhost:8080/api/gpg/keys?keyring=debian-keys.gpg"
-```
-
-### 3. Remove Compromised Keys
-
-If a GPG key is compromised, remove it from the keyring immediately:
-
-```bash
-curl -X DELETE http://localhost:8080/api/gpg/key \
-  -H "Content-Type: application/json" \
-  -d '{
-    "GpgKeyID": "COMPROMISED_KEY_ID"
-  }'
-```
-
---
-
-## Key Validity Values
-
-Keys retrieved from `GET /api/gpg/keys` have a `Validity` field with the following possible values:
-
- `u` — Unknown validity
- `f` — Full trust
- `m` — Marginal trust
- `n` — Never trust
- `-` — Trust not set
-
-The trust level is typically managed in your GPG configuration and does not affect aptly's ability to verify signatures.
-
---
-
-## Troubleshooting
-
-**"failed to list keys"**
- Check that the keyring file exists and is readable
- Verify GPG is installed and configured
-
-**"unable to delete key: no public key"**
- The key might not exist in the keyring
- Verify the key ID is correct by listing keys first
-
-**"invalid request body"**
- Ensure the JSON is properly formatted
- For POST requests, provide either `GpgKeyArmor` or (`Keyserver` + `GpgKeyID`)
- For DELETE requests, `GpgKeyID` is required
@@ -11,26 +11,7 @@ Repositories can be published to local directories, Amazon S3 buckets, Azure or

 GPG key is required to sign any published repository. The key pari should be generated before publishing.

-Public part of the key should be exported from your keyring using `gpg --export --armor` and imported on the system which uses a published repository.
-
-* Multiple signing keys can be defined in aptly.conf using the gpgKeys array:
-```
-"gpgKeys": [
-    "KEY_ID_x",
-    "KEY_ID_y"
-]
-```
-
-* It is also possible to pass multiple keys via the CLI using the repeatable `--gpg-key` flag:
-```
-aptly publish repo my-repo --gpg-key=KEY_ID_a --gpg-key=KEY_ID_b
-```
-* When using the REST API, the `gpgKey` parameter supports a comma-separated list of key IDs:
-```
-"gpgKey": "KEY_ID_a,KEY_ID_b"
-```
-* If `--gpg-key` is specified on the command line, or `gpgKey` is provided via the REST API, it takes precedence over any gpgKeys configuration in aptly.conf.
-* With multi-key support, aptly will sign all Release files (both clearsigned and detached signatures) with each provided key, ensuring a smooth key rotation process while maintaining compatibility for existing clients.
+Publiс part of the key should be exported from your keyring using `gpg --export --armor` and imported on the system which uses a published repository.

 #### Parameters

@@ -1,283 +0,0 @@
-package files
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"sync"
-	"time"
-
-	"github.com/aptly-dev/aptly/aptly"
-	"github.com/aptly-dev/aptly/utils"
-
-	. "gopkg.in/check.v1"
-)
-
-type LinkFromPoolConcurrencySuite struct {
-	root          string
-	poolDir       string
-	storage       *PublishedStorage
-	pool          *PackagePool
-	cs            aptly.ChecksumStorage
-	testFile      string
-	testContent   []byte
-	testChecksums utils.ChecksumInfo
-	srcPoolPath   string
-}
-
-var _ = Suite(&LinkFromPoolConcurrencySuite{})
-
-func (s *LinkFromPoolConcurrencySuite) SetUpTest(c *C) {
-	s.root = c.MkDir()
-	s.poolDir = filepath.Join(s.root, "pool")
-	publishDir := filepath.Join(s.root, "public")
-
-	// Create package pool and published storage
-	s.pool = NewPackagePool(s.poolDir, true)
-	s.storage = NewPublishedStorage(publishDir, "copy", "checksum")
-	s.cs = NewMockChecksumStorage()
-
-	// Create test file content
-	s.testContent = []byte("test package content for concurrency testing")
-	s.testFile = filepath.Join(s.root, "test-package.deb")
-
-	err := os.WriteFile(s.testFile, s.testContent, 0644)
-	c.Assert(err, IsNil)
-
-	// Calculate checksums
-	md5sum, err := utils.MD5ChecksumForFile(s.testFile)
-	c.Assert(err, IsNil)
-
-	s.testChecksums = utils.ChecksumInfo{
-		Size: int64(len(s.testContent)),
-		MD5:  md5sum,
-	}
-
-	// Import the test file into the pool
-	s.srcPoolPath, err = s.pool.Import(s.testFile, "test-package.deb", &s.testChecksums, false, s.cs)
-	c.Assert(err, IsNil)
-}
-
-func (s *LinkFromPoolConcurrencySuite) TestLinkFromPoolConcurrency(c *C) {
-	// Test concurrent LinkFromPool operations to ensure no race conditions
-	concurrency := 5000
-	iterations := 10
-
-	for iter := 0; iter < iterations; iter++ {
-		c.Logf("Iteration %d: Testing concurrent LinkFromPool with %d goroutines", iter+1, concurrency)
-
-		destPath := fmt.Sprintf("main/t/test%d", iter)
-
-		var wg sync.WaitGroup
-		errors := make(chan error, concurrency)
-		successes := make(chan struct{}, concurrency)
-
-		start := time.Now()
-
-		// Launch concurrent LinkFromPool operations
-		for i := 0; i < concurrency; i++ {
-			wg.Add(1)
-			go func(id int) {
-				defer wg.Done()
-
-				// Use force=true to test the most vulnerable code path (remove-then-create)
-				err := s.storage.LinkFromPool(
-					"",                 // publishedPrefix
-					destPath,           // publishedRelPath
-					"test-package.deb", // fileName
-					s.pool,             // sourcePool
-					s.srcPoolPath,      // sourcePath
-					s.testChecksums,    // sourceChecksums
-					true,               // force - this triggers vulnerable remove-then-create pattern
-				)
-
-				if err != nil {
-					errors <- fmt.Errorf("goroutine %d failed: %v", id, err)
-				} else {
-					successes <- struct{}{}
-				}
-			}(i)
-		}
-
-		// Wait for completion
-		wg.Wait()
-		duration := time.Since(start)
-
-		close(errors)
-		close(successes)
-
-		// Count results
-		errorCount := 0
-		successCount := 0
-		var firstError error
-
-		for err := range errors {
-			errorCount++
-			if firstError == nil {
-				firstError = err
-			}
-			c.Logf("Race condition error: %v", err)
-		}
-
-		for range successes {
-			successCount++
-		}
-
-		c.Logf("Results: %d successes, %d errors, took %v", successCount, errorCount, duration)
-
-		// Assert no race conditions occurred
-		if errorCount > 0 {
-			c.Fatalf("Race condition detected in iteration %d! "+
-				"Errors: %d out of %d operations (%.1f%% failure rate). "+
-				"First error: %v. "+
-				"This indicates the fix is not working properly.",
-				iter+1, errorCount, concurrency,
-				float64(errorCount)/float64(concurrency)*100, firstError)
-		}
-
-		// Verify the final file exists and has correct content
-		finalFile := filepath.Join(s.storage.rootPath, destPath, "test-package.deb")
-		_, err := os.Stat(finalFile)
-		c.Assert(err, IsNil, Commentf("Final file should exist after concurrent operations"))
-
-		content, err := os.ReadFile(finalFile)
-		c.Assert(err, IsNil, Commentf("Should be able to read final file"))
-		c.Assert(content, DeepEquals, s.testContent, Commentf("File content should be intact after concurrent operations"))
-
-		c.Logf("✓ Iteration %d: No race conditions detected", iter+1)
-	}
-
-	c.Logf("SUCCESS: Handled %d total concurrent operations across %d iterations with no race conditions",
-		concurrency*iterations, iterations)
-}
-
-func (s *LinkFromPoolConcurrencySuite) TestLinkFromPoolConcurrencyDifferentFiles(c *C) {
-	// Test concurrent operations on different files to ensure no blocking
-	concurrency := 10
-
-	var wg sync.WaitGroup
-	errors := make(chan error, concurrency)
-
-	start := time.Now()
-
-	// Launch concurrent operations on different destination files
-	for i := 0; i < concurrency; i++ {
-		wg.Add(1)
-		go func(id int) {
-			defer wg.Done()
-
-			destPath := fmt.Sprintf("main/t/test-file-%d", id)
-
-			err := s.storage.LinkFromPool(
-				"",                 // publishedPrefix
-				destPath,           // publishedRelPath
-				"test-package.deb", // fileName
-				s.pool,             // sourcePool
-				s.srcPoolPath,      // sourcePath
-				s.testChecksums,    // sourceChecksums
-				false,              // force
-			)
-
-			if err != nil {
-				errors <- fmt.Errorf("goroutine %d failed: %v", id, err)
-			}
-		}(i)
-	}
-
-	// Wait for completion
-	wg.Wait()
-	duration := time.Since(start)
-
-	close(errors)
-
-	// Count errors
-	errorCount := 0
-	for err := range errors {
-		errorCount++
-		c.Logf("Error: %v", err)
-	}
-
-	c.Assert(errorCount, Equals, 0, Commentf("No errors should occur when linking to different files"))
-	c.Logf("SUCCESS: %d concurrent operations on different files completed in %v", concurrency, duration)
-
-	// Verify all files were created correctly
-	for i := 0; i < concurrency; i++ {
-		finalFile := filepath.Join(s.storage.rootPath, fmt.Sprintf("main/t/test-file-%d", i), "test-package.deb")
-		_, err := os.Stat(finalFile)
-		c.Assert(err, IsNil, Commentf("File %d should exist", i))
-
-		content, err := os.ReadFile(finalFile)
-		c.Assert(err, IsNil, Commentf("Should be able to read file %d", i))
-		c.Assert(content, DeepEquals, s.testContent, Commentf("File %d content should be correct", i))
-	}
-}
-
-func (s *LinkFromPoolConcurrencySuite) TestLinkFromPoolWithoutForceNoConcurrencyIssues(c *C) {
-	// Test that when force=false, concurrent operations fail gracefully without corruption
-	concurrency := 20
-	destPath := "main/t/single-dest"
-
-	var wg sync.WaitGroup
-	errors := make(chan error, concurrency)
-	successes := make(chan struct{}, concurrency)
-
-	// First, create the file so subsequent operations will conflict
-	err := s.storage.LinkFromPool("", destPath, "test-package.deb", s.pool, s.srcPoolPath, s.testChecksums, false)
-	c.Assert(err, IsNil)
-
-	start := time.Now()
-
-	// Launch concurrent operations that should mostly fail
-	for i := 0; i < concurrency; i++ {
-		wg.Add(1)
-		go func(id int) {
-			defer wg.Done()
-
-			err := s.storage.LinkFromPool(
-				"",                 // publishedPrefix
-				destPath,           // publishedRelPath
-				"test-package.deb", // fileName
-				s.pool,             // sourcePool
-				s.srcPoolPath,      // sourcePath
-				s.testChecksums,    // sourceChecksums
-				false,              // force=false - should fail if file exists and is same
-			)
-
-			if err != nil {
-				errors <- err
-			} else {
-				successes <- struct{}{}
-			}
-		}(i)
-	}
-
-	// Wait for completion
-	wg.Wait()
-	duration := time.Since(start)
-
-	close(errors)
-	close(successes)
-
-	errorCount := 0
-	successCount := 0
-
-	for range errors {
-		errorCount++
-	}
-
-	for range successes {
-		successCount++
-	}
-
-	c.Logf("Results with force=false: %d successes, %d errors, took %v", successCount, errorCount, duration)
-
-	// With force=false and identical files, operations should succeed (file already exists with same content)
-	// No race conditions should cause crashes or corruption
-	c.Assert(errorCount, Equals, 0, Commentf("With identical files and force=false, operations should succeed"))
-
-	// Verify the file still exists and has correct content
-	finalFile := filepath.Join(s.storage.rootPath, destPath, "test-package.deb")
-	content, err := os.ReadFile(finalFile)
-	c.Assert(err, IsNil)
-	c.Assert(content, DeepEquals, s.testContent, Commentf("File should not be corrupted by concurrent access"))
-}
@@ -241,7 +241,7 @@ func (pool *PackagePool) Import(srcPath, basename string, checksums *utils.Check
 		return "", err
 	}
 	defer func() {
-		_ = source.Close()
+            _ = source.Close()
 	}()

 	sourceInfo, err := source.Stat()
@@ -15,10 +15,6 @@ import (
 	"github.com/saracen/walker"
 )

-// syncFile is a seam to allow tests to force fsync failures (e.g. ENOSPC).
-// In production it calls (*os.File).Sync().
-var syncFile = func(f *os.File) error { return f.Sync() }
-
 // PublishedStorage abstract file system with public dirs (published repos)
 type PublishedStorage struct {
 	rootPath     string
@@ -26,26 +22,6 @@ type PublishedStorage struct {
 	verifyMethod uint
 }

-// Global mutex map to prevent concurrent access to the same destinationPath in LinkFromPool
-var (
-	fileLockMutex sync.Mutex
-	fileLocks     = make(map[string]*sync.Mutex)
-)
-
-// getFileLock returns a mutex for a specific file path to prevent concurrent modifications
-func getFileLock(filePath string) *sync.Mutex {
-	fileLockMutex.Lock()
-	defer fileLockMutex.Unlock()
-
-	if mutex, exists := fileLocks[filePath]; exists {
-		return mutex
-	}
-
-	mutex := &sync.Mutex{}
-	fileLocks[filePath] = mutex
-	return mutex
-}
-
 // Check interfaces
 var (
 	_ aptly.PublishedStorage           = (*PublishedStorage)(nil)
@@ -123,17 +99,7 @@ func (storage *PublishedStorage) PutFile(path string, sourceFilename string) err
 	}()

 	_, err = io.Copy(f, source)
-	if err != nil {
-		return err
-	}
-
-	// Sync to ensure all data is written to disk and catch ENOSPC errors
-	err = syncFile(f)
-	if err != nil {
-		return fmt.Errorf("error syncing file %s: %s", path, err)
-	}
-
-	return nil
+	return err
 }

 // Remove removes single file under public path
@@ -170,12 +136,6 @@ func (storage *PublishedStorage) LinkFromPool(publishedPrefix, publishedRelPath,

 	baseName := filepath.Base(fileName)
 	poolPath := filepath.Join(storage.rootPath, publishedPrefix, publishedRelPath, filepath.Dir(fileName))
-	destinationPath := filepath.Join(poolPath, baseName)
-
-	// Acquire file-specific lock to prevent concurrent access to the same file
-	fileLock := getFileLock(destinationPath)
-	fileLock.Lock()
-	defer fileLock.Unlock()

 	var localSourcePool aptly.LocalPackagePool
 	if storage.linkMethod != LinkMethodCopy {
@@ -194,7 +154,7 @@ func (storage *PublishedStorage) LinkFromPool(publishedPrefix, publishedRelPath,

 	var dstStat os.FileInfo

-	dstStat, err = os.Stat(destinationPath)
+	dstStat, err = os.Stat(filepath.Join(poolPath, baseName))
 	if err == nil {
 		// already exists, check source file

@@ -213,7 +173,7 @@ func (storage *PublishedStorage) LinkFromPool(publishedPrefix, publishedRelPath,
 			} else {
 				// if source and destination have the same checksums, no need to copy
 				var dstMD5 string
-				dstMD5, err = utils.MD5ChecksumForFile(destinationPath)
+				dstMD5, err = utils.MD5ChecksumForFile(filepath.Join(poolPath, baseName))

 				if err != nil {
 					return err
@@ -244,11 +204,11 @@ func (storage *PublishedStorage) LinkFromPool(publishedPrefix, publishedRelPath,

 		// source and destination have different inodes, if !forced, this is fatal error
 		if !force {
-			return fmt.Errorf("error linking file to %s: file already exists and is different", destinationPath)
+			return fmt.Errorf("error linking file to %s: file already exists and is different", filepath.Join(poolPath, baseName))
 		}

 		// forced, so remove destination
-		err = os.Remove(destinationPath)
+		err = os.Remove(filepath.Join(poolPath, baseName))
 		if err != nil {
 			return err
 		}
@@ -263,7 +223,7 @@ func (storage *PublishedStorage) LinkFromPool(publishedPrefix, publishedRelPath,
 		}

 		var dst *os.File
-		dst, err = os.Create(destinationPath)
+		dst, err = os.Create(filepath.Join(poolPath, baseName))
 		if err != nil {
 			_ = r.Close()
 			return err
@@ -282,18 +242,11 @@ func (storage *PublishedStorage) LinkFromPool(publishedPrefix, publishedRelPath,
 			return err
 		}

-		// Sync to ensure all data is written to disk and catch ENOSPC errors
-		err = syncFile(dst)
-		if err != nil {
-			_ = dst.Close()
-			return fmt.Errorf("error syncing file %s: %s", destinationPath, err)
-		}
-
 		err = dst.Close()
 	} else if storage.linkMethod == LinkMethodSymLink {
-		err = localSourcePool.Symlink(sourcePath, destinationPath)
+		err = localSourcePool.Symlink(sourcePath, filepath.Join(poolPath, baseName))
 	} else {
-		err = localSourcePool.Link(sourcePath, destinationPath)
+		err = localSourcePool.Link(sourcePath, filepath.Join(poolPath, baseName))
 	}

 	return err
@@ -1,14 +1,8 @@
 package files

 import (
-	"bytes"
-	"errors"
-	"io"
 	"os"
-	"os/exec"
 	"path/filepath"
-	"runtime"
-	"strings"
 	"syscall"

 	"github.com/aptly-dev/aptly/aptly"
@@ -17,77 +11,6 @@ import (
 	. "gopkg.in/check.v1"
 )

-type fakeProgress struct{ bytes.Buffer }
-
-func (p *fakeProgress) Start()    {}
-func (p *fakeProgress) Shutdown() {}
-func (p *fakeProgress) Flush()    {}
-func (p *fakeProgress) InitBar(count int64, isBytes bool, barType aptly.BarType) {
-}
-func (p *fakeProgress) ShutdownBar()     {}
-func (p *fakeProgress) AddBar(count int) {}
-func (p *fakeProgress) SetBar(count int) {}
-func (p *fakeProgress) Printf(msg string, a ...interface{}) {
-}
-func (p *fakeProgress) ColoredPrintf(msg string, a ...interface{}) {
-}
-func (p *fakeProgress) PrintfStdErr(msg string, a ...interface{}) {
-}
-
-type fakeRSC struct {
-	*bytes.Reader
-	closeErr error
-}
-
-func (r *fakeRSC) Close() error { return r.closeErr }
-
-type fakePool struct {
-	sizeErr error
-	openFn  func(string) (aptly.ReadSeekerCloser, error)
-}
-
-type fakeLocalPool struct {
-	fakePool
-	statErr error
-}
-
-func (p *fakeLocalPool) Stat(path string) (os.FileInfo, error) { return nil, p.statErr }
-func (p *fakeLocalPool) GenerateTempPath(filename string) (string, error) {
-	return "", nil
-}
-func (p *fakeLocalPool) Link(path, dstPath string) error    { return nil }
-func (p *fakeLocalPool) Symlink(path, dstPath string) error { return nil }
-func (p *fakeLocalPool) FullPath(path string) string        { return path }
-
-func (p *fakePool) Verify(poolPath, basename string, checksums *utils.ChecksumInfo, checksumStorage aptly.ChecksumStorage) (string, bool, error) {
-	return "", false, nil
-}
-
-func (p *fakePool) Import(srcPath, basename string, checksums *utils.ChecksumInfo, move bool, storage aptly.ChecksumStorage) (string, error) {
-	return "", nil
-}
-
-func (p *fakePool) LegacyPath(filename string, checksums *utils.ChecksumInfo) (string, error) {
-	return "", nil
-}
-
-func (p *fakePool) Size(path string) (int64, error) {
-	if p.sizeErr != nil {
-		return 0, p.sizeErr
-	}
-	return int64(len(path)), nil
-}
-
-func (p *fakePool) Open(path string) (aptly.ReadSeekerCloser, error) {
-	if p.openFn != nil {
-		return p.openFn(path)
-	}
-	return nil, io.EOF
-}
-
-func (p *fakePool) FilepathList(progress aptly.Progress) ([]string, error) { return nil, nil }
-func (p *fakePool) Remove(path string) (int64, error)                      { return 0, nil }
-
 type PublishedStorageSuite struct {
 	root            string
 	storage         *PublishedStorage
@@ -146,14 +69,6 @@ func (s *PublishedStorageSuite) TestPutFile(c *C) {
 	c.Assert(err, IsNil)
 }

-func (s *PublishedStorageSuite) TestPutFileReturnsErrorIfSourceMissing(c *C) {
-	err := s.storage.MkDir("ppa/dists/squeeze/")
-	c.Assert(err, IsNil)
-
-	err = s.storage.PutFile("ppa/dists/squeeze/Release", filepath.Join(s.root, "no-such-file"))
-	c.Assert(err, NotNil)
-}
-
 func (s *PublishedStorageSuite) TestFilelist(c *C) {
 	err := s.storage.MkDir("ppa/pool/main/a/ab/")
 	c.Assert(err, IsNil)
@@ -219,11 +134,6 @@ func (s *PublishedStorageSuite) TestSymLink(c *C) {
 	c.Assert(linkTarget, Equals, "ppa/dists/squeeze/Release")
 }

-func (s *PublishedStorageSuite) TestReadLinkReturnsErrorOnMissingPath(c *C) {
-	_, err := s.storage.ReadLink("does/not/exist")
-	c.Assert(err, NotNil)
-}
-
 func (s *PublishedStorageSuite) TestHardLink(c *C) {
 	err := s.storage.MkDir("ppa/dists/squeeze/")
 	c.Assert(err, IsNil)
@@ -253,18 +163,6 @@ func (s *PublishedStorageSuite) TestRemoveDirs(c *C) {
 	c.Assert(os.IsNotExist(err), Equals, true)
 }

-func (s *PublishedStorageSuite) TestRemoveDirsWithProgress(c *C) {
-	err := s.storage.MkDir("ppa/dists/squeeze/")
-	c.Assert(err, IsNil)
-
-	err = s.storage.PutFile("ppa/dists/squeeze/Release", "/dev/null")
-	c.Assert(err, IsNil)
-
-	p := &fakeProgress{}
-	err = s.storage.RemoveDirs("ppa/dists/", p)
-	c.Assert(err, IsNil)
-}
-
 func (s *PublishedStorageSuite) TestRemove(c *C) {
 	err := s.storage.MkDir("ppa/dists/squeeze/")
 	c.Assert(err, IsNil)
@@ -439,287 +337,3 @@ func (s *PublishedStorageSuite) TestRootRemove(c *C) {
 	dirStorage := NewPublishedStorage(pwd, "", "")
 	c.Assert(func() { _ = dirStorage.RemoveDirs("", nil) }, PanicMatches, "trying to remove the root directory")
 }
-
-// DiskFullSuite uses a loopback mount; requires Linux + root.
-
-type DiskFullSuite struct {
-	root string
-}
-
-var _ = Suite(&DiskFullSuite{})
-
-func (s *DiskFullSuite) SetUpTest(c *C) {
-	if runtime.GOOS != "linux" {
-		c.Skip("disk full tests only run on Linux")
-	}
-
-	s.root = c.MkDir()
-}
-
-func (s *DiskFullSuite) TestPutFileOutOfSpace(c *C) {
-	mountPoint := "/smallfs"
-	if os.Geteuid() == 0 {
-		mountPoint = filepath.Join(s.root, "smallfs")
-		err := os.MkdirAll(mountPoint, 0777)
-		c.Assert(err, IsNil)
-		fsImage := filepath.Join(s.root, "small.img")
-		cmd := exec.Command("dd", "if=/dev/zero", "of="+fsImage, "bs=1M", "count=1")
-		err = cmd.Run()
-		c.Assert(err, IsNil)
-		cmd = exec.Command("mkfs.ext4", "-F", fsImage)
-		err = cmd.Run()
-		c.Assert(err, IsNil)
-		cmd = exec.Command("mount", "-o", "loop", fsImage, mountPoint)
-		err = cmd.Run()
-		c.Assert(err, IsNil)
-		defer func() {
-			_ = exec.Command("umount", mountPoint).Run()
-		}()
-	}
-
-	storage := NewPublishedStorage(mountPoint, "", "")
-	largeFile := filepath.Join(s.root, "largefile")
-	cmd := exec.Command("dd", "if=/dev/zero", "of="+largeFile, "bs=1M", "count=2")
-	err := cmd.Run()
-	c.Assert(err, IsNil)
-
-	err = storage.PutFile("testfile", largeFile)
-	c.Assert(err, NotNil)
-	c.Check(strings.Contains(err.Error(), "no space left on device") ||
-		strings.Contains(err.Error(), "sync"), Equals, true,
-		Commentf("Expected disk full error, got: %v", err))
-}
-
-func (s *DiskFullSuite) TestLinkFromPoolCopyOutOfSpace(c *C) {
-	mountPoint := "/smallfs"
-	if os.Geteuid() == 0 {
-		mountPoint = filepath.Join(s.root, "smallfs")
-		err := os.MkdirAll(mountPoint, 0777)
-		c.Assert(err, IsNil)
-		fsImage := filepath.Join(s.root, "small.img")
-
-		cmd := exec.Command("dd", "if=/dev/zero", "of="+fsImage, "bs=1M", "count=1")
-		err = cmd.Run()
-		c.Assert(err, IsNil)
-
-		cmd = exec.Command("mkfs.ext4", "-F", fsImage)
-		err = cmd.Run()
-		c.Assert(err, IsNil)
-
-		cmd = exec.Command("mount", "-o", "loop", fsImage, mountPoint)
-		err = cmd.Run()
-		c.Assert(err, IsNil)
-		defer func() {
-			_ = exec.Command("umount", mountPoint).Run()
-		}()
-	}
-
-	storage := NewPublishedStorage(mountPoint, "copy", "")
-
-	poolPath := filepath.Join(s.root, "pool")
-	pool := NewPackagePool(poolPath, false)
-	cs := NewMockChecksumStorage()
-
-	largeFile := filepath.Join(s.root, "package.deb")
-	cmd := exec.Command("dd", "if=/dev/zero", "of="+largeFile, "bs=1M", "count=2")
-	err := cmd.Run()
-	c.Assert(err, IsNil)
-
-	sourceChecksum, err := utils.ChecksumsForFile(largeFile)
-	c.Assert(err, IsNil)
-
-	srcPoolPath, err := pool.Import(largeFile, "package.deb",
-		&utils.ChecksumInfo{MD5: "d41d8cd98f00b204e9800998ecf8427e"}, false, cs)
-	c.Assert(err, IsNil)
-
-	err = storage.LinkFromPool("", "pool/main/p/package", "package.deb",
-		pool, srcPoolPath, sourceChecksum, false)
-	c.Assert(err, NotNil)
-	c.Check(strings.Contains(err.Error(), "no space left on device") ||
-		strings.Contains(err.Error(), "sync"), Equals, true,
-		Commentf("Expected disk full error, got: %v", err))
-}
-
-type DiskFullNoRootSuite struct {
-	root string
-}
-
-var _ = Suite(&DiskFullNoRootSuite{})
-
-func (s *DiskFullNoRootSuite) SetUpTest(c *C) {
-	s.root = c.MkDir()
-}
-
-func (s *DiskFullNoRootSuite) TestSyncIsCalled(c *C) {
-	storage := NewPublishedStorage(s.root, "", "")
-	sourceFile := filepath.Join(s.root, "source.txt")
-	err := os.WriteFile(sourceFile, []byte("test content"), 0644)
-	c.Assert(err, IsNil)
-	err = storage.PutFile("dest.txt", sourceFile)
-	c.Assert(err, IsNil)
-	content, err := os.ReadFile(filepath.Join(s.root, "dest.txt"))
-	c.Assert(err, IsNil)
-	c.Check(string(content), Equals, "test content")
-}
-
-func (s *DiskFullNoRootSuite) TestLinkFromPoolCopySyncIsCalled(c *C) {
-	storage := NewPublishedStorage(s.root, "copy", "")
-	poolPath := filepath.Join(s.root, "pool")
-	pool := NewPackagePool(poolPath, false)
-	cs := NewMockChecksumStorage()
-
-	pkgFile := filepath.Join(s.root, "package.deb")
-	err := os.WriteFile(pkgFile, []byte("package content"), 0644)
-	c.Assert(err, IsNil)
-
-	sourceChecksum, err := utils.ChecksumsForFile(pkgFile)
-	c.Assert(err, IsNil)
-
-	srcPoolPath, err := pool.Import(pkgFile, "package.deb",
-		&utils.ChecksumInfo{MD5: "d41d8cd98f00b204e9800998ecf8427e"}, false, cs)
-	c.Assert(err, IsNil)
-
-	err = storage.LinkFromPool("", "pool/main/p/package", "package.deb",
-		pool, srcPoolPath, sourceChecksum, false)
-	c.Assert(err, IsNil)
-
-	destPath := filepath.Join(s.root, "pool/main/p/package/package.deb")
-	content, err := os.ReadFile(destPath)
-	c.Assert(err, IsNil)
-	c.Check(string(content), Equals, "package content")
-}
-
-func (s *DiskFullNoRootSuite) TestPutFileSyncErrorIsReturned(c *C) {
-	storage := NewPublishedStorage(s.root, "", "")
-
-	sourceFile := filepath.Join(s.root, "source-syncfail.txt")
-	err := os.WriteFile(sourceFile, []byte("test content"), 0644)
-	c.Assert(err, IsNil)
-
-	oldSyncFile := syncFile
-	syncFile = func(_ *os.File) error { return syscall.ENOSPC }
-	defer func() { syncFile = oldSyncFile }()
-
-	err = storage.PutFile("dest-syncfail.txt", sourceFile)
-	c.Assert(err, NotNil)
-	c.Check(strings.Contains(err.Error(), "error syncing file"), Equals, true)
-}
-
-func (s *DiskFullNoRootSuite) TestLinkFromPoolCopySyncErrorIsReturned(c *C) {
-	storage := NewPublishedStorage(s.root, "copy", "")
-	poolPath := filepath.Join(s.root, "pool")
-	pool := NewPackagePool(poolPath, false)
-	cs := NewMockChecksumStorage()
-
-	pkgFile := filepath.Join(s.root, "package-syncfail.deb")
-	err := os.WriteFile(pkgFile, []byte("package content"), 0644)
-	c.Assert(err, IsNil)
-
-	sourceChecksum, err := utils.ChecksumsForFile(pkgFile)
-	c.Assert(err, IsNil)
-
-	srcPoolPath, err := pool.Import(pkgFile, "package-syncfail.deb",
-		&utils.ChecksumInfo{MD5: "d41d8cd98f00b204e9800998ecf8427e"}, false, cs)
-	c.Assert(err, IsNil)
-
-	oldSyncFile := syncFile
-	syncFile = func(_ *os.File) error { return syscall.ENOSPC }
-	defer func() { syncFile = oldSyncFile }()
-
-	err = storage.LinkFromPool("", "pool/main/p/package", "package-syncfail.deb",
-		pool, srcPoolPath, sourceChecksum, false)
-	c.Assert(err, NotNil)
-	c.Check(strings.Contains(err.Error(), "error syncing file"), Equals, true)
-}
-
-func (s *DiskFullNoRootSuite) TestGetFileLockReusesMutex(c *C) {
-	a := getFileLock(filepath.Join(s.root, "a"))
-	b := getFileLock(filepath.Join(s.root, "a"))
-	c.Check(a == b, Equals, true)
-
-	c1 := getFileLock(filepath.Join(s.root, "c1"))
-	c2 := getFileLock(filepath.Join(s.root, "c2"))
-	c.Check(c1 == c2, Equals, false)
-}
-
-func (s *DiskFullNoRootSuite) TestPutFileFailsIfDestinationDirMissing(c *C) {
-	storage := NewPublishedStorage(s.root, "", "")
-
-	sourceFile := filepath.Join(s.root, "src.txt")
-	err := os.WriteFile(sourceFile, []byte("x"), 0644)
-	c.Assert(err, IsNil)
-
-	err = storage.PutFile("missingdir/dest.txt", sourceFile)
-	c.Assert(err, NotNil)
-}
-
-func (s *DiskFullNoRootSuite) TestLinkFromPoolRejectsNonLocalPoolForHardlink(c *C) {
-	storage := NewPublishedStorage(s.root, "", "")
-	pool := &fakePool{}
-
-	err := storage.LinkFromPool("", "pool/main/p/pkg", "x.deb", pool, "x", utils.ChecksumInfo{MD5: "x"}, false)
-	c.Assert(err, NotNil)
-	c.Check(strings.Contains(err.Error(), "cannot link"), Equals, true)
-}
-
-func (s *DiskFullNoRootSuite) TestLinkFromPoolCopyReturnsErrorIfOpenFails(c *C) {
-	storage := NewPublishedStorage(s.root, "copy", "")
-	pool := &fakePool{openFn: func(string) (aptly.ReadSeekerCloser, error) { return nil, io.ErrUnexpectedEOF }}
-
-	err := storage.LinkFromPool("", "pool/main/p/pkg", "x.deb", pool, "x", utils.ChecksumInfo{MD5: "x"}, false)
-	c.Assert(err, NotNil)
-}
-
-func (s *DiskFullNoRootSuite) TestLinkFromPoolCopyReturnsErrorIfReaderCloseFails(c *C) {
-	storage := NewPublishedStorage(s.root, "copy", "")
-
-	pool := &fakePool{openFn: func(string) (aptly.ReadSeekerCloser, error) {
-		return &fakeRSC{Reader: bytes.NewReader([]byte("data")), closeErr: io.ErrClosedPipe}, nil
-	}}
-
-	err := storage.LinkFromPool("", "pool/main/p/pkg", "x.deb", pool, "x", utils.ChecksumInfo{MD5: "x"}, false)
-	c.Assert(err, NotNil)
-	c.Check(err, Equals, io.ErrClosedPipe)
-}
-
-func (s *DiskFullNoRootSuite) TestLinkFromPoolCopyReturnsErrorIfSizeFailsWhenDestExists(c *C) {
-	storage := NewPublishedStorage(s.root, "copy", "size")
-	pool := &fakePool{sizeErr: io.ErrUnexpectedEOF, openFn: func(string) (aptly.ReadSeekerCloser, error) {
-		return &fakeRSC{Reader: bytes.NewReader([]byte("data")), closeErr: nil}, nil
-	}}
-
-	destDir := filepath.Join(s.root, "pool/main/p/pkg")
-	c.Assert(os.MkdirAll(destDir, 0777), IsNil)
-	c.Assert(os.WriteFile(filepath.Join(destDir, "x.deb"), []byte("old"), 0644), IsNil)
-
-	err := storage.LinkFromPool("", "pool/main/p/pkg", "x.deb", pool, "x", utils.ChecksumInfo{MD5: "x"}, false)
-	c.Assert(err, NotNil)
-	c.Check(err, Equals, io.ErrUnexpectedEOF)
-}
-
-func (s *DiskFullNoRootSuite) TestLinkFromPoolCopyChecksumReturnsErrorIfDstMD5Fails(c *C) {
-	storage := NewPublishedStorage(s.root, "copy", "")
-	pool := &fakePool{openFn: func(string) (aptly.ReadSeekerCloser, error) {
-		return &fakeRSC{Reader: bytes.NewReader([]byte("data")), closeErr: nil}, nil
-	}}
-
-	// Make destinationPath a directory so MD5ChecksumForFile fails.
-	destDir := filepath.Join(s.root, "pool/main/p/pkg")
-	c.Assert(os.MkdirAll(destDir, 0777), IsNil)
-	c.Assert(os.MkdirAll(filepath.Join(destDir, "x.deb"), 0777), IsNil)
-
-	err := storage.LinkFromPool("", "pool/main/p/pkg", "x.deb", pool, "x", utils.ChecksumInfo{MD5: "x"}, false)
-	c.Assert(err, NotNil)
-}
-
-func (s *DiskFullNoRootSuite) TestLinkFromPoolHardlinkReturnsErrorIfStatFailsWhenDestExists(c *C) {
-	storage := NewPublishedStorage(c.MkDir(), "hardlink", "")
-	pool := &fakeLocalPool{statErr: errors.New("stat failed")}
-
-	destDir := filepath.Join(storage.rootPath, "pool", "main", "p", "pkg")
-	c.Assert(os.MkdirAll(destDir, 0777), IsNil)
-	c.Assert(os.WriteFile(filepath.Join(destDir, "x.deb"), []byte("x"), 0644), IsNil)
-
-	err := storage.LinkFromPool("", "pool/main/p/pkg", "x.deb", pool, "x", utils.ChecksumInfo{MD5: "x"}, false)
-	c.Assert(err, NotNil)
-}
@@ -1,6 +1,6 @@
 module github.com/aptly-dev/aptly

-go 1.24.0
+go 1.24

 require (
 	github.com/AlekSi/pointer v1.1.0
@@ -32,30 +32,29 @@ require (
 	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d
 	github.com/ugorji/go/codec v1.2.11
 	github.com/wsxiaoys/terminal v0.0.0-20160513160801-0940f3fc43a0
-	golang.org/x/crypto v0.46.0 // indirect
-	golang.org/x/sys v0.39.0
-	golang.org/x/term v0.38.0
+	golang.org/x/crypto v0.36.0 // indirect
+	golang.org/x/sys v0.31.0
+	golang.org/x/term v0.30.0
 	golang.org/x/time v0.5.0
-	google.golang.org/protobuf v1.36.10 // indirect
+	google.golang.org/protobuf v1.34.2 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
 )

 require (
-	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
 	github.com/KyleBanks/depth v1.2.1 // indirect
 	github.com/PuerkitoBio/purell v1.1.1 // indirect
 	github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.24 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.24 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.24 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.24.6 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.33.1 // indirect
@@ -63,7 +62,7 @@ require (
 	github.com/bytedance/sonic v1.9.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 // indirect
-	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/cloudflare/circl v1.4.0 // indirect
 	github.com/coreos/go-semver v0.3.0 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
 	github.com/fatih/color v1.17.0 // indirect
@@ -104,13 +103,13 @@ require (
 	go.uber.org/multierr v1.10.0 // indirect
 	go.uber.org/zap v1.26.0 // indirect
 	golang.org/x/arch v0.3.0 // indirect
-	golang.org/x/net v0.48.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/text v0.32.0 // indirect
-	golang.org/x/tools v0.39.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
-	google.golang.org/grpc v1.79.3 // indirect
+	golang.org/x/net v0.38.0 // indirect
+	golang.org/x/sync v0.12.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/tools v0.30.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240318140521-94a12d6c2237 // indirect
+	google.golang.org/grpc v1.64.1 // indirect
 	gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
@@ -118,17 +117,16 @@ require (
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.14.0
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.4.1
-	github.com/ProtonMail/go-crypto v1.4.0
-	github.com/aws/aws-sdk-go-v2 v1.41.5
+	github.com/ProtonMail/go-crypto v1.0.0
+	github.com/aws/aws-sdk-go-v2 v1.32.5
 	github.com/aws/aws-sdk-go-v2/config v1.28.5
 	github.com/aws/aws-sdk-go-v2/credentials v1.17.46
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3
-	github.com/aws/smithy-go v1.24.2
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.67.1
+	github.com/aws/smithy-go v1.22.1
 	github.com/google/uuid v1.6.0
 	github.com/swaggo/files v1.0.1
 	github.com/swaggo/gin-swagger v1.6.0
 	github.com/swaggo/swag v1.16.3
 	go.etcd.io/etcd/client/v3 v3.5.15
-	golang.org/x/oauth2 v0.34.0
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -1,5 +1,3 @@
-cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
-cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
 github.com/AlekSi/pointer v1.1.0 h1:SSDMPcXD9jSl8FPy9cRzoRaMJtm9g9ggGTxecRUbQoI=
 github.com/AlekSi/pointer v1.1.0/go.mod h1:y7BvfRI3wXPWKXEBhU71nbnIEEZX0QTSB2Bj48UJIZE=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.14.0 h1:nyQWyZvwGTvunIMxi1Y9uXkcyr+I7TeNrr/foo4Kpk8=
@@ -18,52 +16,53 @@ github.com/DisposaBoy/JsonConfigReader v0.0.0-20171218180944-5ea4d0ddac55 h1:jbG
 github.com/DisposaBoy/JsonConfigReader v0.0.0-20171218180944-5ea4d0ddac55/go.mod h1:GCzqZQHydohgVLSIqRKZeTt8IGb1Y4NaFfim3H40uUI=
 github.com/KyleBanks/depth v1.2.1 h1:5h8fQADFrWtarTdtDudMmGsC7GPbOAu6RVB3ffsVFHc=
 github.com/KyleBanks/depth v1.2.1/go.mod h1:jzSb9d0L43HxTQfT+oSA1EEp2q+ne2uh6XgeJcm8brE=
-github.com/ProtonMail/go-crypto v1.4.0 h1:Zq/pbM3F5DFgJiMouxEdSVY44MVoQNEKp5d5QxIQceQ=
-github.com/ProtonMail/go-crypto v1.4.0/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
+github.com/ProtonMail/go-crypto v1.0.0 h1:LRuvITjQWX+WIfr930YHG2HNfjR1uOfyf5vE0kC2U78=
+github.com/ProtonMail/go-crypto v1.0.0/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
 github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
 github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/awalterschulze/gographviz v2.0.1+incompatible h1:XIECBRq9VPEQqkQL5pw2OtjCAdrtIgFKoJU8eT98AS8=
 github.com/awalterschulze/gographviz v2.0.1+incompatible/go.mod h1:GEV5wmg4YquNw7v1kkyoX9etIk8yVmXj+AkDHuuETHs=
-github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
-github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
+github.com/aws/aws-sdk-go-v2 v1.32.5 h1:U8vdWJuY7ruAkzaOdD7guwJjD06YSKmnKCJs7s3IkIo=
+github.com/aws/aws-sdk-go-v2 v1.32.5/go.mod h1:P5WJBrYqqbWVaOxgH0X/FYYD47/nooaPOZPlQdmiN2U=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 h1:lL7IfaFzngfx0ZwUGOZdsFFnQ5uLvR0hWqqhyE7Q9M8=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7/go.mod h1:QraP0UcVlQJsmHfioCrveWOC1nbiWUl3ej08h4mXWoc=
 github.com/aws/aws-sdk-go-v2/config v1.28.5 h1:Za41twdCXbuyyWv9LndXxZZv3QhTG1DinqlFsSuvtI0=
 github.com/aws/aws-sdk-go-v2/config v1.28.5/go.mod h1:4VsPbHP8JdcdUDmbTVgNL/8w9SqOkM5jyY8ljIxLO3o=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.46 h1:AU7RcriIo2lXjUfHFnFKYsLCwgbz1E7Mm95ieIRDNUg=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.46/go.mod h1:1FmYyLGL08KQXQ6mcTlifyFXfJVCNJTVGuQP4m0d/UA=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20 h1:sDSXIrlsFSFJtWKLQS4PUWRvrT580rrnuLydJrCQ/yA=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20/go.mod h1:WZ/c+w0ofps+/OUqMwWgnfrgzZH1DZO1RIkktICsqnY=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 h1:Rgg6wvjjtX8bNHcvi9OnXWwcE0a2vGpbwmtICOsvcf4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21/go.mod h1:A/kJFst/nm//cyqonihbdpQZwiUhhzpqTsdbhDdRF9c=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgqSE5hE/o47Ij9qk/SEZFbUOe9A=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.24 h1:4usbeaes3yJnCFC7kfeyhkdkPtoRYPa/hTmCqMpKpLI=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.24/go.mod h1:5CI1JemjVwde8m2WG3cz23qHKPOxbpkq0HaoreEgLIY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.24 h1:N1zsICrQglfzaBnrfM0Ys00860C+QFwu6u/5+LomP+o=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.24/go.mod h1:dCn9HbJ8+K31i8IQ8EWmWj0EiIk0+vKiHNMxTTYveAg=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 h1:VaRN3TlFdd6KxX1x3ILT5ynH6HvKgqdiXoTxAF4HQcQ=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 h1:rWyie/PxDRIdhNf4DzRk0lvjVOqFJuNnO8WwaIRVxzQ=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22/go.mod h1:zd/JsJ4P7oGfUhXn1VyLqaRZwPmZwg44Jf2dS84Dm3Y=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 h1:JRaIgADQS/U6uXDqlPiefP32yXTda7Kqfx+LgspooZM=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13/go.mod h1:CEuVn5WqOMilYl+tbccq8+N2ieCy0gVn3OtRb0vBNNM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3xgIJMSC8S6hEVq+38DcvUlgFY0FM6mSI5oto=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 h1:ZlvrNcHSFFWURB8avufQq9gFsheUgjVD9536obIknfM=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21/go.mod h1:cv3TNhVrssKR0O/xxLJVRfd2oazSnZnkUeTf6ctUwfQ=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 h1:HwxWTbTrIHm5qY+CAEur0s/figc3qwvLWsNkF4RPToo=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.24 h1:JX70yGKLj25+lMC5Yyh8wBtvB01GDilyRuJvXJ4piD0=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.24/go.mod h1:+Ln60j9SUTD0LEwnhEB0Xhg61DHqplBrbZpLgyjoEHg=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 h1:iXtILhvDxB6kPvEXgsDhGaZCSC6LQET5ZHSdJozeI0Y=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1/go.mod h1:9nu0fVANtYiAePIBh2/pFUSwtJ402hLnp854CNoDOeE=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.5 h1:gvZOjQKPxFXy1ft3QnEyXmT+IqneM9QAUWlM3r0mfqw=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.5/go.mod h1:DLWnfvIcm9IET/mmjdxeXbBKmTCm0ZB8p1za9BVteM8=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.5 h1:wtpJ4zcwrSbwhECWQoI/g6WM9zqCcSpHDJIWSbMLOu4=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.5/go.mod h1:qu/W9HXQbbQ4+1+JcZp0ZNPV31ym537ZJN+fiS7Ti8E=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.5 h1:P1doBzv5VEg1ONxnJss1Kh5ZG/ewoIE4MQtKKc6Crgg=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.5/go.mod h1:NOP+euMW7W3Ukt28tAxPuoWao4rhhqJD3QEBk7oCg7w=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.67.1 h1:LXLnDfjT/P6SPIaCE86xCOjJROPn4FNB2EdN68vMK5c=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.67.1/go.mod h1:ralv4XawHjEMaHOWnTFushl0WRqim/gQWesAMF6hTow=
 github.com/aws/aws-sdk-go-v2/service/sso v1.24.6 h1:3zu537oLmsPfDMyjnUS2g+F2vITgy5pB74tHI+JBNoM=
 github.com/aws/aws-sdk-go-v2/service/sso v1.24.6/go.mod h1:WJSZH2ZvepM6t6jwu4w/Z45Eoi75lPN7DcydSRtJg6Y=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.5 h1:K0OQAsDywb0ltlFrZm0JHPY3yZp/S9OaoLU33S7vPS8=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.5/go.mod h1:ORITg+fyuMoeiQFiVGoqB3OydVTLkClw/ljbblMq6Cc=
 github.com/aws/aws-sdk-go-v2/service/sts v1.33.1 h1:6SZUVRQNvExYlMLbHdlKB48x0fLbc2iVROyaNEwBHbU=
 github.com/aws/aws-sdk-go-v2/service/sts v1.33.1/go.mod h1:GqWyYCwLXnlUB1lOAXQyNSPqPLQJvmo8J0DWBzp9mtg=
-github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
-github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/smithy-go v1.22.1 h1:/HPHZQ0g7f4eUeK6HKglFz8uwVfZKgoI25rb/J+dnro=
+github.com/aws/smithy-go v1.22.1/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
 github.com/bytedance/sonic v1.5.0/go.mod h1:ED5hyg4y6t3/9Ku1R6dU/4KyJ48DZ4jPhfY1O2AihPM=
 github.com/bytedance/sonic v1.9.1 h1:6iJ6NqdoxCDr6mbY8h18oSO+cShGSMRGCEo7F2h0x8s=
 github.com/bytedance/sonic v1.9.1/go.mod h1:i736AoUSYt75HyZLoJW9ERYxcy6eaN6h4BZXU064P/U=
@@ -79,8 +78,9 @@ github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311/go.mod h1:b583j
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
-github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
+github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
+github.com/cloudflare/circl v1.4.0 h1:BV7h5MgrktNzytKmWjpOtdYrf0lkkbF8YMlBGPhJQrY=
+github.com/cloudflare/circl v1.4.0/go.mod h1:PDRU+oXvdD7KCtgKxW95M5Z8BpSCJXQORiZFnBQS5QU=
 github.com/coreos/go-semver v0.3.0 h1:wkHLiw0WNATZnSG7epLsujiMCgPAc9xhjJ4tgnAxmfM=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
@@ -103,10 +103,6 @@ github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE
 github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
 github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqJ+Jmg=
 github.com/gin-gonic/gin v1.9.1/go.mod h1:hPrL7YrpYKXt5YId3A/Tnip5kqbEAP+KLuI3SUcPTeU=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
-github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
 github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
@@ -150,8 +146,8 @@ github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -311,18 +307,6 @@ go.etcd.io/etcd/client/pkg/v3 v3.5.15 h1:fo0HpWz/KlHGMCC+YejpiCmyWDEuIpnTDzpJLB5
 go.etcd.io/etcd/client/pkg/v3 v3.5.15/go.mod h1:mXDI4NAOwEiszrHCb0aqfAYNCrZP4e9hRca3d1YK8EU=
 go.etcd.io/etcd/client/v3 v3.5.15 h1:23M0eY4Fd/inNv1ZfU3AxrbbOdW79r9V9Rl62Nm6ip4=
 go.etcd.io/etcd/client/v3 v3.5.15/go.mod h1:CLSJxrYjvLtHsrPKsy7LmZEE+DK2ktfd2bN4RhBMwlU=
-go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
-go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
-go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
-go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
-go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
-go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
-go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
-go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
-go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
-go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
-go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
 go.uber.org/goleak v1.2.0 h1:xqgm/S+aQvhWFTtR0XK3Jvg7z8kGV8P4X14IzwN3Eqk=
 go.uber.org/goleak v1.2.0/go.mod h1:XJYK+MuIchqpmGmUSAzotztawfKvYLUIgg7guXrwVUo=
 go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
@@ -336,13 +320,16 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
-golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
+golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
+golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
-golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.23.0 h1:Zb7khfcRGKk+kqfxFaP5tZqCnDZMjC5VtUBs87Hr6QM=
+golang.org/x/mod v0.23.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -355,19 +342,21 @@ golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
-golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
-golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
-golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
+golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
+golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -390,22 +379,28 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
-golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
-golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
+golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
+golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -414,21 +409,20 @@ golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roY
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ=
-golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.30.0 h1:BgcpHewrV5AUp2G9MebG4XPFI1E2W41zU1SaqVA9vJY=
+golang.org/x/tools v0.30.0/go.mod h1:c347cR/OJfw5TI+GfX7RUPNMdDRRbjvYTS0jPyvsVtY=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 h1:fCvbg86sFXwdrl5LgVcTEvNC+2txB5mgROGmRL5mrls=
-google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:+rXWjjaukWZun3mLfjmVnQi18E1AsFbDN9QdJ5YXLto=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 h1:gRkg/vSppuSQoDjxyiGfN4Upv/h/DQmIR10ZU8dh4Ww=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
-google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
-google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237 h1:RFiFrvy37/mpSpdySBDrUdipW/dHwsRwh3J3+A9VgT4=
+google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237/go.mod h1:Z5Iiy3jtmioajWHDGFk7CeugTyHtPvMHA4UTmUkyalE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240318140521-94a12d6c2237 h1:NnYq6UN9ReLM9/Y01KWNOWyI5xQ9kbIms5GGJVwS/Yc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240318140521-94a12d6c2237/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY=
+google.golang.org/grpc v1.64.1 h1:LKtvyfbX3UGVPFcGqJ9ItpVWW6oN/2XqTxfAnwRRXiA=
+google.golang.org/grpc v1.64.1/go.mod h1:hiQF4LFZelK2WKaP6W0L92zGHtiQdZxk8CrSdvyjeP0=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -437,8 +431,8 @@ google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzi
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
-google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
+google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -44,7 +44,6 @@ func NewDownloader(downLimit int64, maxTries int, progress aptly.Progress) aptly
 	transport.DisableCompression = true
 	initTransport(&transport)
 	transport.RegisterProtocol("ftp", &protocol.FTPRoundTripper{})
-	transport.RegisterProtocol("ar+https", NewGCPRoundTripper(&transport))

 	downloader := &downloaderImpl{
 		progress:  progress,
@@ -241,7 +240,7 @@ func (downloader *downloaderImpl) download(req *http.Request, url, destination s
 	}
 	if resp.Body != nil {
 		defer func() {
-			_ = resp.Body.Close()
+                    _ = resp.Body.Close()
 		}()
 	}

@@ -1,4 +1,3 @@
-//go:build !go1.7
 // +build !go1.7

 package http
@@ -1,64 +0,0 @@
-package http
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"strings"
-	"sync"
-
-	"golang.org/x/oauth2"
-	"golang.org/x/oauth2/google"
-)
-
-// gcpRoundTripper wraps http.RoundTripper to add Google Cloud authentication.
-// It delays GCP authentication initialization until the first actual request is made.
-// This avoids unnecessary credential loading when ar+https protocol is not actually used.
-//
-// It uses Application Default Credentials (ADC) which checks:
-// 1. GOOGLE_APPLICATION_CREDENTIALS environment variable
-// 2. gcloud auth application-default credentials
-// 3. GCE/GKE metadata server
-// See https://cloud.google.com/docs/authentication/application-default-credentials for usage details.
-type gcpRoundTripper struct {
-	base     http.RoundTripper
-	initOnce sync.Once
-	tokenSrc oauth2.TokenSource
-	initErr  error
-}
-
-func (t *gcpRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
-	// Lazy initialization: only initialize GCP credentials on first request
-	t.initOnce.Do(func() {
-		creds, err := google.FindDefaultCredentials(context.Background(),
-			"https://www.googleapis.com/auth/cloud-platform")
-		if err != nil {
-			t.initErr = fmt.Errorf("failed to find default credentials: %w", err)
-			return
-		}
-		t.tokenSrc = creds.TokenSource
-	})
-
-	reqCopy := req.Clone(req.Context())
-	reqCopy.URL.Scheme = strings.TrimPrefix(reqCopy.URL.Scheme, "ar+")
-
-	// Fall back to base transport if GCP auth initialization failed
-	if t.initErr != nil {
-		return t.base.RoundTrip(reqCopy)
-	}
-
-	token, err := t.tokenSrc.Token()
-	if err != nil {
-		return nil, fmt.Errorf("failed to get OAuth2 token: %w", err)
-	}
-	token.SetAuthHeader(reqCopy)
-
-	return t.base.RoundTrip(reqCopy)
-}
-
-// NewGCPRoundTripper creates a new RoundTripper that handles GCP authentication for ar+https protocol.
-func NewGCPRoundTripper(base http.RoundTripper) http.RoundTripper {
-	return &gcpRoundTripper{
-		base: base,
-	}
-}
@@ -1,110 +0,0 @@
-package http
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"testing"
-
-	"golang.org/x/oauth2"
-)
-
-func TestGCPAuthTransport_RoundTrip(t *testing.T) {
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		auth := r.Header.Get("Authorization")
-		if auth == "" {
-			t.Error("Expected Authorization header, got none")
-		}
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer ts.Close()
-
-	transport := NewGCPRoundTripper(http.DefaultTransport)
-
-	if os.Getenv("GOOGLE_APPLICATION_CREDENTIALS") == "" {
-		t.Skip("Skipping test: GOOGLE_APPLICATION_CREDENTIALS not set")
-	}
-
-	client := &http.Client{Transport: transport}
-	resp, err := client.Get(ts.URL)
-	if err != nil {
-		t.Fatalf("Failed to make request: %v", err)
-	}
-	defer func() { _ = resp.Body.Close() }()
-
-	if resp.StatusCode != http.StatusOK {
-		t.Errorf("Expected status 200, got %d", resp.StatusCode)
-	}
-}
-
-func TestGCPAuthTransport_RoundTrip_with_dummy_tokenSource(t *testing.T) {
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		auth := r.Header.Get("Authorization")
-		if auth != "Bearer dummy-token" {
-			t.Errorf("Expected Authorization header 'Bearer dummy-token', got '%s'", auth)
-		}
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer ts.Close()
-
-	// Use a dummy token source for testing
-	transport := &gcpRoundTripper{
-		base: http.DefaultTransport,
-		tokenSrc: oauth2.StaticTokenSource(&oauth2.Token{
-			AccessToken: "dummy-token",
-		}),
-	}
-	transport.initOnce.Do(func() {}) // Mark as initialized for testing
-
-	client := &http.Client{Transport: transport}
-	resp, err := client.Get(ts.URL)
-	if err != nil {
-		t.Fatalf("Failed to make request: %v", err)
-	}
-	defer func(){ _ = resp.Body.Close() }()
-
-	if resp.StatusCode != http.StatusOK {
-		t.Errorf("Expected status 200, got %d", resp.StatusCode)
-	}
-}
-
-func TestGCPAuthTransport_RoundTrip_with_InvalidCredentials(t *testing.T) {
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusForbidden)
-	}))
-	defer ts.Close()
-
-	// Create a temporary invalid credentials file
-	tmpFile, err := os.CreateTemp("", "invalid_credentials.json")
-	if err != nil {
-		t.Fatalf("Failed to create temp file: %s", err)
-	}
-	defer func() { _ = os.Remove(tmpFile.Name()) }()
-	if _, err := tmpFile.WriteString(`{"invalid": "data"}`); err != nil {
-		t.Fatalf("Failed to write to temp file: %s", err)
-	}
-	_ = tmpFile.Close()
-
-	defaultEnv := os.Getenv("GOOGLE_APPLICATION_CREDENTIALS")
-	_ = os.Setenv("GOOGLE_APPLICATION_CREDENTIALS", tmpFile.Name())
-	defer func() { _ = os.Setenv("GOOGLE_APPLICATION_CREDENTIALS", defaultEnv) }()
-
-	transport := &gcpRoundTripper{
-		base: http.DefaultTransport,
-	}
-
-	client := &http.Client{Transport: transport}
-	resp, err := client.Get(ts.URL)
-	if err != nil {
-		t.Fatalf("Failed to make request: %s", err)
-	}
-	defer func() { _ = resp.Body.Close() }()
-
-	if resp.StatusCode != http.StatusForbidden {
-		t.Errorf("Expected status 403, got %d", resp.StatusCode)
-	}
-
-	if transport.initErr == nil {
-		t.Error("Expected init error due to invalid credentials, got none")
-	}
-}
@@ -49,9 +49,9 @@ func (d *GrabDownloader) Download(ctx context.Context, url string, destination s

 func (d *GrabDownloader) DownloadWithChecksum(ctx context.Context, url string, destination string, expected *utils.ChecksumInfo, ignoreMismatch bool) error {
 	maxTries := d.maxTries
-	// FIXME: const delayMax = time.Duration(5 * time.Minute)
+        // FIXME: const delayMax = time.Duration(5 * time.Minute)
 	delay := time.Duration(1 * time.Second)
-	// FIXME: const delayMultiplier = 2
+        // FIXME: const delayMultiplier = 2
 	err := fmt.Errorf("no tries available")
 	for maxTries > 0 {
 		err = d.download(ctx, url, destination, expected, ignoreMismatch)
@@ -133,17 +133,17 @@ func (d *GrabDownloader) download(_ context.Context, url string, destination str

 	resp := d.client.Do(req)

-	<-resp.Done
+        <-resp.Done
 	// download is complete

-	// Loop:
-	// 	for {
-	// 		select {
-	// 		case <-resp.Done:
-	// 			// download is complete
-	// 			break Loop
-	// 		}
-	// 	}
+// Loop:
+// 	for {
+// 		select {
+// 		case <-resp.Done:
+// 			// download is complete
+// 			break Loop
+// 		}
+// 	}
 	err = resp.Err()
 	if err != nil && err == grab.ErrBadChecksum && ignoreMismatch {
 		fmt.Printf("Ignoring checksum mismatch for %s\n", url)
@@ -615,10 +615,6 @@ gpg keyring to use when verifying Release file (could be specified multiple time
 max download tries till process fails with download error
 .
 .TP
-\-\fBwith\-appstream\fR
-download AppStream (DEP\-11) metadata
-.
-.TP
 \-\fBwith\-installer\fR
 download additional not packaged installer files
 .
@@ -742,10 +738,6 @@ max download tries till process fails with download error
 \-\fBskip\-existing\-packages\fR
 do not check file existence for packages listed in the internal database of the mirror
 .
-.TP
-\-\fBlatest\fR
-download only latest version of each package (per architecture)
-.
 .SH "RENAMES MIRROR"
 \fBaptly\fR \fBmirror\fR \fBrename\fR \fIold\-name\fR \fInew\-name\fR
 .
@@ -794,10 +786,6 @@ disable verification of Release file signatures
 gpg keyring to use when verifying Release file (could be specified multiple times)
 .
 .TP
-\-\fBwith\-appstream\fR
-download AppStream (DEP\-11) metadata
-.
-.TP
 \-\fBwith\-installer\fR
 download additional not packaged installer files
 .
@@ -1573,14 +1561,6 @@ $ aptly publish repo testing
 Options:
 .
 .TP
-\-\fBsigned\-by\fR
-set value for Signed-By field
-.
-.TP
-\-\fBversion\fR
-version of the release
-.
-.TP
 \-\fBacquire\-by\-hash\fR
 provide index files by hash
 .
@@ -1722,14 +1702,6 @@ $ aptly publish snapshot wheezy\-main
 Options:
 .
 .TP
-\-\fBsigned\-by\fR
-set value for Signed-By field
-.
-.TP
-\-\fBversion\fR
-version of the release
-.
-.TP
 \-\fBacquire\-by\-hash\fR
 provide index files by hash
 .
@@ -2089,10 +2061,6 @@ This command would switch published repository (with one component) named ppa/wh
 Options:
 .
 .TP
-\-\fBsigned\-by\fR
-set value for Signed-By field
-.
-.TP
 \-\fBbatch\fR
 run GPG with detached tty
 .
@@ -2199,14 +2167,6 @@ $ aptly publish update wheezy ppa
 Options:
 .
 .TP
-\-\fBsigned\-by\fR
-set value for Signed-By field
-.
-.TP
-\-\fBversion\fR
-version of the release
-.
-.TP
 \-\fBbatch\fR
 run GPG with detached tty
 .
@@ -2492,9 +2452,6 @@ show yaml config
 .SH "ENVIRONMENT"
 If environment variable \fBHTTP_PROXY\fR is set \fBaptly\fR would use its value to proxy all HTTP requests\.
 .
-.P
-If environment variable \fBSOURCE_DATE_EPOCH\fR is set to a Unix timestamp, \fBaptly\fR would use that timestamp for the \fBDate\fR and \fBValid\-Until\fR fields in the \fBRelease\fR file when publishing\. This enables reproducible builds as specified by \fIhttps://reproducible\-builds\.org/specs/source\-date\-epoch/\fR\.
-.
 .SH "RETURN VALUES"
 \fBaptly\fR exists with:
 .
@@ -533,11 +533,6 @@ For example, default aptly display format could be presented with the following
 If environment variable `HTTP_PROXY` is set `aptly` would use its value
 to proxy all HTTP requests.

-If environment variable `SOURCE_DATE_EPOCH` is set to a Unix timestamp,
-`aptly` would use that timestamp for the `Date` and `Valid-Until` fields
-in the `Release` file when publishing. This enables reproducible builds
-as specified by https://reproducible-builds.org/specs/source-date-epoch/.
-
 ## RETURN VALUES

 `aptly` exists with:
@@ -9,7 +9,6 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"strconv"
 	"strings"
 )

@@ -23,7 +22,7 @@ var (
 type GpgSigner struct {
 	gpg                        string
 	version                    GPGVersion
-	keyRefs                    []string
+	keyRef                     string
 	keyring, secretKeyring     string
 	passphrase, passphraseFile string
 	batch                      bool
@@ -36,14 +35,7 @@ func (g *GpgSigner) SetBatch(batch bool) {

 // SetKey sets key ID to use when signing files
 func (g *GpgSigner) SetKey(keyRef string) {
-    keyRef = strings.TrimSpace(keyRef)
-    if keyRef != "" {
-        if g.keyRefs == nil {
-            g.keyRefs = []string{keyRef}
-        } else {
-            g.keyRefs = append(g.keyRefs, keyRef)
-        }
-    }
+	g.keyRef = keyRef
 }

 // SetKeyRing allows to set custom keyring and secretkeyring
@@ -65,8 +57,8 @@ func (g *GpgSigner) gpgArgs() []string {
 		args = append(args, "--secret-keyring", g.secretKeyring)
 	}

-	for _, k := range g.keyRefs {
-		args = append(args, "-u", k)
+	if g.keyRef != "" {
+		args = append(args, "-u", g.keyRef)
 	}

 	if g.passphrase != "" || g.passphraseFile != "" {
@@ -90,12 +82,6 @@ func (g *GpgSigner) gpgArgs() []string {
 		}
 	}

-	if epoch := os.Getenv("SOURCE_DATE_EPOCH"); epoch != "" {
-		if _, err := strconv.ParseInt(epoch, 10, 64); err == nil {
-			args = append(args, "--faked-system-time", epoch)
-		}
-	}
-
 	return args
 }

@@ -7,7 +7,6 @@ import (
 	"os"
 	"path/filepath"
 	"sort"
-	"strconv"
 	"strings"
 	"syscall"
 	"time"
@@ -75,14 +74,6 @@ func (g *GoSigner) Init() error {
 		},
 	}

-	if epoch := os.Getenv("SOURCE_DATE_EPOCH"); epoch != "" {
-		if sec, err := strconv.ParseInt(epoch, 10, 64); err == nil {
-			t := time.Unix(sec, 0).UTC()
-			g.signerConfig.Time = func() time.Time { return t }
-			g.signerConfig.NonDeterministicSignaturesViaNotation = packet.BoolPointer(false)
-		}
-	}
-
 	if g.passphraseFile != "" {
 		passF, err := os.Open(g.passphraseFile)
 		if err != nil {
@@ -346,7 +346,7 @@ func (storage *PublishedStorage) LinkFromPool(publishedPrefix, publishedRelPath,
 		storage.pathCache = make(map[string]string, len(paths))

 		for i := range paths {
-			storage.pathCache[filepath.Join(publishedPrefix, "pool", paths[i])] = md5s[i]
+			storage.pathCache[filepath.Join("pool", paths[i])] = md5s[i]
 		}
 	}

@@ -112,11 +112,9 @@ func NewServer(config *Config) (*Server, error) {
 		buckets:  make(map[string]*bucket),
 		config:   config,
 	}
-	go func() {
-		_ = http.Serve(l, http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-			srv.serveHTTP(w, req)
-		}))
-	}()
+	go func() { _ = http.Serve(l, http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		srv.serveHTTP(w, req)
+	})) }()
 	return srv, nil
 }

@@ -529,13 +527,14 @@ func (bucketResource) post(a *action) interface{} {
 // and dashes (-). You can use uppercase letters for buckets only in the
 // US Standard region.
 //
-// # Must start with a number or letter
+// Must start with a number or letter
 //
-// # Must be between 3 and 255 characters long
+// Must be between 3 and 255 characters long
 //
 // There's one extra rule (Must not be formatted as an IP address (e.g., 192.168.5.4)
 // but the real S3 server does not seem to check that rule, so we will not
 // check it either.
+//
 func validBucketName(name string) bool {
 	if len(name) < 3 || len(name) > 255 {
 		return false
@@ -34,7 +34,6 @@ class APITest(BaseTest):
                "linkMethod": "symlink"
            }
        },
-        "enableMetricsEndpoint": True,
        "enableSwaggerEndpoint": True
    }

@@ -15,4 +15,4 @@ else
 fi

 cd /work/src
-sudo -u aptly PATH=$PATH:/work/src/build GOPATH=/work/src/.go GOCACHE=/work/src/.go/cache $cmd
+sudo -u aptly PATH=$PATH:/work/src/build GOPATH=/work/src/.go $cmd
@@ -1,29 +0,0 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQGiBFL7pY8RBAC5uHg/9AuGJ7EF7RYty89IDLeqvlPe710eDQpJ+itsOaA/5rr3
-IV1LMlqHpM2rkZkAPpARwjrga2ByJ1ww77Zq2uPqJIO2LZYWTLXic9Zity2OVu3Z
-XwtdsqagIMfT5dAgNmhe5lL7qgGUwYcFFa52s7U4qO0z2FfwHW1IQrnMpwCg5RQh
-Uqs5iUKdDtoeQjX5mWgQhjEEAI1zfXUvvcOrRsDlGNKYZigZiWC6J46jeR8Nnf9C
-WwhXS2fzQaJyDq9DorkvPZgWUAaLLCdfGETqLzDKajynhS1+OnfFQNzvkvEPRBSb
-C5k+GOF2E1E9rGXb31+1XZTcdIprp4/F3RNLLWNUwfgPLWJx9NzHTYqgBStecHkC
-ySZRA/9PNFAbeJZ27HNuzoGnAa0piZDLeAAHsM1V6cosMh7U1IZqjZcrMC9YXNxH
-2D90PvoBvpufCMRzL/fOVPT1JzQGYoKIX17Nmzvdq/a4YyLWRODjvWXd94bae2Xd
-Vy03DYhfp8VOVJW6HuAX9JN6MKXSNxaibgOPjU822Hxd1iCIQ7QtQXB0bHkgVGVz
-dGVyIChkb24ndCB1c2UgaXQpIDx0ZXN0QGFwdGx5LmluZm8+iGIEExECACIFAlL7
-pY8CGyMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJECHbuJwW2z5t2sQAoNn+
-0cADZa66HZNY2qJi44Oq4hjaAJsHzj9JKAHEpdix5N7b6QvaZQZYhrkBDQRS+6WP
-EAQA9BX+kbIM6VJYoyY9vUHXfAF4E2y2M7vl9knZ+jMPfMbI7dE3gRJQb3mngST5
-7eZWawo1DNE6h3LbHsB4mpro9XLUXUMBgXRsOq4D5E0ygvDZ/tJhy0AwFiTOXKEs
-/erzmbF7j/TWh4LVHXFI9DrnN0+EeF/mQC/wzX7WGCKe70cAAwUEAMr7959zUYNp
-E3v4IquIJpD22bT/FiyQjFG8yGy36c+7mOP3VWi0lz5yFqqeR9NDFuLDSwOEi0nB
-zXNmimLy+hIwMaHjbQLjLODmy/T9wKCgeAmK1ygT6YBGJJflThZ05M80T5hBtRA9
-z2eoTn0wbi6MLmD/rbEt+lUPfSA4V0t2iEkEGBECAAkFAlL7pY8CGwwACgkQIdu4
-nBbbPm05hgCgvYatZXRbEdZ91jJCQi1KI7lJ5Y8AnjvrHU0g84mE45QZFegZzzQo
-9relmDMEZ3YCRhYJKwYBBAHaRw8BAQdAYDU0VSBcurX+uqAeR/w/XOLSZcghvOqz
-Y8yWdcj3HUy0L0FwdGx5IFNlY29uZGFyeSBTaWduaW5nIEtleSA8YXB0bHlAZXhh
-bXBsZS5jb20+iJYEExYKAD4WIQSu4W3wGDVPZ/5fXHK79OGUNOkeTgUCZ3YCRgIb
-AwUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRC79OGUNOkeTid/AP9A
-kIMn2qI5TqZgzrnPt7SN16VvpMppPb2H0m0P6knQKQD8DHcLcrqAl2cjcEuntv75
-gOnEvmPDAO6S1rc8UgcWdQQ=
-=XPoo
-----END PGP PUBLIC KEY BLOCK-----
@@ -1,11 +0,0 @@
-----BEGIN PGP PRIVATE KEY BLOCK-----
-
-lFgEZ3YCRhYJKwYBBAHaRw8BAQdAYDU0VSBcurX+uqAeR/w/XOLSZcghvOqzY8yW
-dcj3HUwAAP9lsZgE1YQfaS9xfVOSi3f91lbq13+U9FPdwxfiET0+bBFrtC9BcHRs
-eSBTZWNvbmRhcnkgU2lnbmluZyBLZXkgPGFwdGx5QGV4YW1wbGUuY29tPoiWBBMW
-CgA+FiEEruFt8Bg1T2f+X1xyu/ThlDTpHk4FAmd2AkYCGwMFCQPCZwAFCwkIBwIG
-FQoJCAsCBBYCAwECHgECF4AACgkQu/ThlDTpHk4nfwD/QJCDJ9qiOU6mYM65z7e0
-jdelb6TKaT29h9JtD+pJ0CkA/Ax3C3K6gJdnI3BLp7b++YDpxL5jwwDukta3PFIH
-FnUE
-=IXTY
-----END PGP PRIVATE KEY BLOCK-----
@@ -20,7 +20,7 @@ func main() {
 	if err != nil {
 		log.Fatalf("Error opening DB %q: %s", dbPath, err)
 	}
-	defer func() { _ = db.Close() }()
+	defer db.Close()

 	keys := db.KeysByPrefix([]byte(prefix))
 	if len(keys) == 0 {
--- a/Show More
+++ b/Show More