Debup

🐧 debup v4.2.1 — Security Hardening & Reliability Release

A bridge between GitHub Releases and APT — now truly fail-closed.

v4.2.0 focuses on three pillars: security hardening, reliability fixes, and localization polish. No breaking CLI changes, no config migration — existing installations upgrade transparently.

---

🛡️ Security

• GPG verification is now fail-closed. The key is downloaded to a temp file, fingerprint-verified, then atomically moved to /etc/apt/keyrings. Previously the key was written to disk before validation.
• SHA-256 verification is now fail-closed. A missing checksum asset or a missing sha256sum/shasum utility now aborts installation instead of silently skipping.
• dbp -r no longer purges without confirmation. Interactive [y/N] prompt by default; -y / --yes required for automation.
• dbp -r no longer vulnerable to regex injection via crafted package names (sed-based filtering replaced by Bash-native line filtering).
• </dev/tty failures fixed in CI/cron. New prompt_read helper falls back to non-interactive defaults with an explicit warning.
• Single-request HTTP probe for the GPG URL (%{http_code} + %{content_type} in one HEAD), with reliable detection of HTML 404 pages masquerading as 200 OK.

---

🐛 Reliability fixes

• Temp dir leak on success — /tmp/debup-install.* and /tmp/debup-build.* were never cleaned on nominal runs. New cleanup_tempdir_now helper: rm -rf then reset.
• .deb loss on install-skip — option 3 (build from source) produced the .deb inside /tmp/debup-build.* and lost it when the user answered n. Build output now goes directly to the user's CWD.
• Duplicate tracking entries — grep -qF "^debup|" treated ^ literally and never matched, causing duplicates in /etc/debup/sources.list on every re-install.
• Self-tracking now works for options 2 and 3 — dbp -u was silently a no-op for GitHub-release and source builds.
• Root-owned source tree crash — build no longer fails with Permission denied when a previous sudo dpkg-deb --build left root:root files behind; clear chown hint provided.
• Missing build dependencies — git / dpkg-deb now auto-installed in option 3.
• $HOME pollution — option 3 now builds in a dedicated mktemp -d instead of ~/debup.
• Post-install PATH verification — all three options confirm dbp/debup are reachable.
• GitHub tag normalization — new normalize_gh_tag handles release-, app-v, cli-v0.5.0-linux-amd64, v1.2.3-beta.1, dpkg epochs (1:1.2.3-1), etc.
• GitHub search URL encoding — &, #, %, +, ?, / in queries are now safely encoded via jq -sRr @uri.

---

🎁 Added

• dbp (no argument) now runs a quick update check — non-destructive summary across APT + tracked GitHub packages. Perfect for cron / MOTD hooks.
• --non-interactive / -y / --yes documented in installer.sh, with automatic fallback to APT-repo install when no TTY is available.
• git clone --depth 1 in option 3 — faster, less disk usage.
• .deb preserved on install failure — option 3 keeps the built package in your CWD even when apt-get install fails; apt-get install -f suggested.
• --dry-run now surfaces version normalization (latest_tag → normalized_ver).

---

🌍 Localization

• 6 languages aligned: en, fr, de, es, it, pt.
• Missing keys added: MSG_HELP_INSPECT, MSG_PROMPT_REMOVE_CONFIRM, MSG_ERR_UNKNOWN_OPTION, MSG_NO_TTY, MSG_ERR_NO_TTY, MSG_VERSION_NORMALIZED.
• Typos fixed:
  • de.sh: einenGPG → einen GPG, Installationwird → Installation wird, [y/N] → [j/N].
  • pt.sh: [y/N] → [s/N].
  • fr.sh: [y/N] → [o/N].
• en.sh duplicate MSG_ERR_NO_ELEVATE removed.
• MSG_USAGE_REMOVE now shows [-y] in all 6 languages.

---

🔧 Changed

• installer.sh: per-option traps replaced by a single global accumulating trap (_cleanup_all).
• installer.sh: apt-get update -qq is non-blocking in option 1 (|| warning).
• installer.sh: checksum asset resolution is prioritized (<deb>.sha256 → checksums.txt → *.sha256).
• README.md: the "Search informations" section now uses dbp -f <owner>/<repo> (was incorrectly -i, which installs).
• README.md: GitHub token storage is documented as user-level ${XDG_CONFIG_HOME:-$HOME/.config}/debup/token (default) + root-level /etc/debup/debup.conf.

---

🗑️ Removed

• debup: dead variable ARCH_REGEX (assigned, never read).
• installer.sh: redundant second curl -sIL call for Content-Type.
• Locales: MSG_ERR_CMD_REQUIRED (replaced by MSG_CMD_REQUIRED_SUFFIX).

---

📦 Installation

Fresh install (recommended — APT repository)

curl -sSL https://raw.githubusercontent.com/Ruraam/debup/main/installer.sh | bash

Automated / CI

curl -sSL https://raw.githubusercontent.com/Ruraam/debup/main/installer.sh | bash -s -- -y

Upgrade from v4.1.x or earlier

If you installed via the APT repository (option 1):

sudo apt update && sudo apt upgrade debup

If you installed via latest release (option 2) or build from source (option 3):

dbp -u

debup

🚀 Changelog — Release Notes

This release focuses on system permission integrity, rock-solid simulation accuracy (--dry-run), and overall execution safety. More control, zero surprises! 🛡️✨

---

🛡️ Permissions & System Integrity

•🔑 Fixed APT Sources Permissions: The generated sources.list file is now systematically granted 644 permissions after being copied. Normal users can now read APT sources without running into permission hurdles!

•⚙️ Cleaner Config Handling: Hardened permission enforcement across all dynamically generated configuration files.

---

🧪 Bulletproof Dry-Run Mode (Simulation Engine)

•🧹 clean --dry-run 100% Respected: The cleanup pipeline now strictly abides by dry-run mode. It displays the exact cleanup actions scheduled to happen without modifying a single byte on the system.

•🔍 Safe search --dry-run: APT package installations triggered directly from the interactive search menu are now correctly simulated - no accidental package installs!

•🎯 Unified APT & GitHub Behavior: The --dry-run flag now behaves with consistent logic across both native APT workflows and GitHub Release asset operations.

•💬 Clearer Simulation Output: Enriched console feedback so you always know exactly what is being tested versus what is being executed.

---

🔄Compatibility & Reliability

•✅ Zero Breaking Changes: Existing commands, workflows, operational paths, and syntax remain completely untouched. Dropit in and let it rip! 🎯

---

Crafted to keep your package operations clean, safe, and fully transparent. 🐧⚡

debup

What's Changed in v4.0.1 🛠️

• Smart Dependency Resolution: Automatically detects missing sibling .deb packages (like keyring packages) directly from GitHub releases and installs them alongside the main package.
• Root Environment Fix: Fixed command not found bug with DEBIAN_FRONTEND when running directly as root.
• Security Check: Clear warning when an asset is going to install a GPG keyring on your system.

debup

Debup v4.0.0 — Changelog

⚡ Unified Experience (yay / paru style)

•Default execution (dbp): Refresh both your Debian core system (APT)and your installed GitHub releases in a single command.

•Interactive Hybrid Search (-s): Combined results from APT repositoriesand GitHub Releases with multi-selection support (1 3, 1-3) and star counts .

•Modern TUI: Clean, stylized real-time output for APT operations (run_apt_styled).

Enhanced Security & Auditing

•Pre-install Inspection (-I): Perform a surgical audit of any .deb packagewithout installing it (inspect directory structure, file permissions, and critical scripts like preinst/postinst).

•Integrity Checks: Automated verification of SHA-256 checksums before package processing.

System Dashboard & Insights

•System Telemetry (-S): Instant overview of your package ecosystem:

•Total installed APT packages

•Managed GitHub release packages

•Pinned/locked packages

•Local API cache size•Remaining GitHub API rate limit & reset countdown (e.g., $5000 / 5000$, resets in 1h)

•Repository Info(-f): Fetch and inspect repository metadata (stars, license, topics, description) directly from the terminal.

Core Engine & Reliability

•Self-Updating: Built-in self-update mechanism directly from GitHub releases alongside standard APT repository support.

•Network & Cache: Strict curl timeouts, TTL-based caching to conserve API quotas, and smooth progress tracking.

•POSIX & TTY Hardening: Resolved terminal stream lockups (/dev/tty handling vs file descriptors).

•i18n Support: Full internationalization (en, fr, es, de, it, pt).

Easter Egg

•-Syu flag: Because Arch muscle memory never trulyfades..."I use Debian btw."
"All the stability of Debian, all the speed and comfort ofArch."

debup

What's Changed in v3.4.1

🌐 Internationalization (i18n)

• Added native CLI translations for:
• 🇫🇷 French (locales/fr.sh)
• 🇪🇸 Spanish (locales/es.sh)
• 🇧🇷 / 🇵🇹 Portuguese (locales/pt.sh)
• 🇩🇪 German (locales/de.sh)
• 🇮🇹 Italian (locales/it.sh)
• Automatic language detection based on the user's system $LANG environment.
• Improved fallback mechanism ensuring 100% string coverage across all languages.

debup

[3.4.0] - 2026-03-29

🚀 Added

• Release tag targeting (@tag): Query, inspect, and install any release tag instead ofbeing forced to use the latest release:
• Supports version pins on installation: dbp -a owner/repo@vX.Y.Z
• Supports release targeting during search & info inspections: fetch and query exact tags directly via GitHub API's /releases/tags/... endpoint.
• Dry-run simulation mode (--dry-run / -d): Safely test and preview any workflow (search, download, install, upgrade, untrack) without modifying the system or the sources.list index.
• Short CLI flag aliases: Standard single-letter POSIX flags for streamlined terminal workflows:
• -a : add / install
• -u : update / upgrade
• -r : remove
• -p : pin
• -n : unpin
• -s : search
• -i : info / show
• -l :list
• -t : token / auth
• Native Bash completion:Autocompletion support for both debup and the dbp alias, featuring context-aware dynamic package suggestionsfor remove, pin, and unpin.

🛡️ Changed

• Network download resilience(curl --retry): Configured --retry 3 --retry-delay 2 on .deb asset downloads to handle transientnetwork hiccups and API packet drops reliably.

🐛 Fixed

• Fixed broken variable substitution syntax ($[CYAN} $\rightarrow$ ${CYAN}) in debup_search preventing unexpected EOF parse crashes.

debup

Release v3.3.1 — UI Fixes for Pinned Packages

Small patch release focusing on output consistency:

• Unified Status Display: Pinned packages now appear correctly in the update list with their current version and (pinned 📌) tag before being skipped.
• Output Formatting: Refined information order in the package inspection header.

debup

Release v3.3 — Package Pinning, Smart Arch Detection & Upgrade Summary

This release brings tighter control over your installed applications with package version pinning, a clear post-upgrade summary counter, and a major overhaul of the hardware architecture detection engine.

🛡️ Package Pinning (apt-mark hold)

•Freeze package updates: Lock specific packages to their current version using the new pin (or hold) command to prevent unwanted updates.
•Unfreeze updates: Restore automatic updates anytime with unpin (or unhold).
•Native APT integration: Relies directly on Debian's standard apt-mark mechanism under the hood, ensuring 100% consistency with native APT tools.

📊 UX & Upgrade Insights

•Upgrade Counter: Displays a clear, concise summary of how many packages were successfully upgraded at the end of the run.
•Refined Terminal Output: Cleaner status messages during repository scanning and package installations.

🎯 Surgical Architecture Detection (Multi-Arch Engine)•Double-Pass Regex Filtering:
Strictly resolves asset matching and completely eliminates false positives (e.g., ARM assets mistakenly selectedon x86_64 machines, and vice versa).

**•Universal Package Support: Fully supports architecture-agnostic .deb packagesmarked as _all.deb.

•Distro Prioritization (DISTRO_PREF): Automatically prefers Debian-specific overUbuntu-specific builds (or vice versa) when multiple flavor assets are attached to the same release.

💡 Usage Examples:

Prevent an app from updating

dbp pin <package-name>

Allow an app to update again

dbp unpin <package-name>

Upgrade your packages and get a summary counter

dbp upgrade

debup

🚀 debup v3.2 —Interactive Search & Package Inspection

This release brings major usability improvements, making package discovery, validation, and architecture handling much smarterand seamless.

✨ What's New

• 🔍 Interactive Repository Search (debup search <query>):

• Discover GitHub projects providing Debian packages directly from your terminal.

• Filters results on-the-fly to only display repositories with actual .deb releases.

• Direct, one-click interactive installation workflow.

• ℹ️ Package Inspection (debup info<owner/repo>):

• View detailed repository metadata (latest tag, release date, stars, license, description).

• Automatically inspects release assets and checks hardware compatibility against your system architecture.

• 🧠 Refactored Architecture Engine:

• Unified, centralized architecture regex & filtering logic (AMD64 vs ARM64/aarch64 vs all).

• Better cross-architecture disambiguation to prevent mismatched .deb downloads.

• Distro-preference engine prioritization (Debian / Ubuntu).

🛠️ Fixes & Polish

• Fixed terminal prompt handling (/dev/tty) across interactive piped sessions.
• Fixed syntax quirks in metadata parsers.
• General clean-up of temporary files and API call workflows.

Debup

🚀 Initial Release

The first stable release of debup - a lightweight, Obtainium-like CLI tool to manage and update .deb packages directly from GitHub Releases.

✨ Features

• Self-updating (debup tracks its own repository by default)
• Architecture-independent (all)
• Minimalist: pure Bash, uses curl, jq, and standard apt
• Clean configuration handling (/etc/debup/sources.list)