BREAKING CHANGE: Starting with v0.72.0, APT repository publishes deb packages only to the generic distribution

[DmitriyLewen]

Motivation

Trivy ships as a single static binary, so the .deb package is identical for every Debian/Ubuntu release — there was never a reason to maintain a separate distribution per codename. The install docs have recommended the codename-agnostic generic distribution since #6606, so per-codename distributions are already legacy.

Starting with v0.72.0, the official Trivy APT repository publishes new releases only to the generic distribution. Per-codename distributions (jammy, noble, bookworm, focal, …) are no longer updated.

Who is affected

Only users whose /etc/apt/sources.list.d/trivy.list points at a specific codename instead of generic, e.g.:

deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb noble main

You can check your current configuration with:

cat /etc/apt/sources.list.d/trivy.list

If the output contains a codename (noble, bookworm, focal, …), you are affected: such setups will not break — apt update keeps working — but they stay frozen at the last version published before v0.72.0 and will not receive any further updates.

If your source line already uses generic, no action is needed.

What to do

Update your repository source to use the generic distribution:

echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee /etc/apt/sources.list.d/trivy.list
sudo apt-get update
sudo apt-get install trivy

The existing codename distributions are left in place (frozen), so nothing breaks immediately — but switch to generic to keep receiving updates.