Aptly Release 1.6.3 🎉

[neolynx]

Dear Aptly Community,

We are excited to share that Aptly 1.6.3 is now available! 🎉

Install from https://github.com/aptly-dev/aptly/releases/tag/v1.6.3 (Binary, freebsd, macOS) or https://www.aptly.info/download (Debian/Ubuntu).

🆕 New Features

• Google Cloud Storage (GCS) publish backend (#1550)
  New storage backend for publishing to Google Cloud Storage.
• JFrog Artifactory publish backend (#1553)
  New storage backend for publishing to JFrog Artifactory.
• dput-compatible file upload API (#1436)
  New API endpoint supporting dput-ng package uploads.
• AppStream (DEP-11) mirror support (#1543)
  Support AppStream metadata through mirrors, snapshots, and publish endpoints.
• Multiple GPG keys support (#1479)
  Supports multiple signing keys via CLI and REST API.
• GPG key list & delete API (#1558)
  New API endpoints to list and delete GPG keys.
• Edit mirror API endpoint (#1535)
  New REST API endpoint to edit mirror configuration.
• NumPackages in list responses (#1559)
  Mirrors, repos, and snapshots list API responses now include a NumPackages field.
• Mirror latest packages (#1513)
  Allow mirroring only the latest package versions.
• Reproducible builds / SOURCE_DATE_EPOCH support (#1537, #1542)
  GPG signers now respect SOURCE_DATE_EPOCH for reproducible publish timestamps.
• Release file Version field support (#1533)
  Parses and exposes the Version field from Debian Release files.
• InRelease file Signed-By field support (#1518, #1519)
  Honor the Signed-By field in InRelease files.
• GCP / Google Artifact Registry authentication (#1505)
  Support for mirroring from Google Artifact Registry using the ar+https:// scheme with GCP auth.
• Update publish label & origin (#1484)
  Support updating the Label and Origin fields.

🐛 Bug Fixes

• Race condition & concurrency fixes for the REST API (#1574)
• Fix empty line in Package-List for source packages (#1588)
• Publish: check storage exists before publishing (#1587)
• S3 publish race condition (#1594)
• Repo edit name optionally (#1593)
• Fix crash in aptly db recover (#1565)
• Fix deadlocks in task list (#1529)
• Fix S3 re-upload issue (#1480)
• Fix aptly repo edit API (#1493)
• Fix out-of-disk-space error handling (#1504)
• Fix aptly mirror update removing unrelated params (#1466)
• Fix concurrent pool linking race condition (#1481)
• Fix dpkg-compliant version comparison (#1509)
• Fix Swagger property casing and spec errors (#1510, #1498)
• Remove useless nil check (#1482)
• Format Go code with gofmt (#1483)

🧪 CI & Documentation Improvements

• Various fixes for system-test and docker integration (#1492)
• Fix errors and coverage (#1531, #1552)
• Remove Launchpad test dependency (#1568)
• Update docs (#1472, #1524, #1561, #1567)
• Ubuntu 26.04 / resolute builds (#1571)
  CI pipeline for building Ubuntu 26.04.

🔧 Dependency Updates

• Go toolchain → 1.25.0
• go.opentelemetry.io/otel → v1.41.0 (#1586)
• go.opentelemetry.io/otel/sdk → v1.43.0 (#1584)
• github.com/go-jose/go-jose/v4 → v4.1.4 (#1585)
• github.com/go-git/go-git/v5 → v5.19.1 (#1590)
• github.com/ulikunitz/xz → v0.5.15 (fixes 32-bit build failures)
• golang.org/x/crypto → v0.45.0 (#1506)
• google.golang.org/grpc → v1.79.3 (#1546)
• github.com/aws/aws-sdk-go-v2/service/s3 → v1.97.3 (#1554)
• github.com/cloudflare/circl → v1.6.3 (#1461, #1541)
• requests (Python, system tests) → 2.33.0 (#1460, #1547)
• github.com/ProtonMail/go-crypto → v1.4.0
• golang.org/x/net → v0.48.0

Full list of changes: https://github.com/aptly-dev/aptly/releases/tag/v1.6.3

Many thanks to all issue reporters and contributors!

🚀 Looking Ahead

Aptly needs your help!

If you can, please consider helping to:

• Triage/reproduce/fix issues
• Bring pull requests to merge readiness
• Update documentation or the website
• Answer questions on discussions
• Cover the hosting costs by becoming a GitHub Sponsor

Cheers,
The Maintainers Team

[j1mc]

Congrats and thanks on / for the release. When publishing to the new artifactory back-end, do we know whether mirroring an existing repo (e.g., ubuntu 'noble') would require us to maintain our own pgp keys, or can clients just use the upstream ubuntu archive key?

[neolynx]

Thanks !

A aptly mirror is a full debian repository with it's own signing keys, for using the original keys, you could setup a caching proxy like apt-cacher-ng, which also suports transparent proxy mode, iirc.

With aptly, it is relatively easy to setup signing keys, and have them distributed to your clients. This gives you the full flexibility of choosing what goes into the mirror.

[j1mc]

Thank you for the reply and for your continued work, neolynx. :)