All Versions
Latest Version
Avg Release Cycle
175 days
Latest Release
1837 days ago

Changelog History

  • v1.4.0 Changes

    July 05, 2019

    ๐Ÿš€ This is regular release of aptly.

    GnuPG 2.x compatibility

    ๐Ÿ‘ aptly should support transparently GnuPG 1.x and 2.x via gpg PGP provider. Internal PGP provider only supports GnuPG 1.x keyring format (as openpgp Go library doesn't support GnuPG 2.1+ kerying format).

    • aptly can sign and verify without issues with GnuPG 1.x and 2.x
    • aptly auto-detects GnuPG version and adapts accordingly
    • aptly automatically finds suitable GnuPG version

    ๐Ÿ”ง Configuration parameter gpgProvider now supports three values for GnuPG:

    • 0๏ธโƒฃ gpg (same as before, default): use GnuPG 1.x if available (checks gpg, gpg1), otherwise uses GnuPG 2.x; for aptly users who already have GnuPG 1.x environment (as it was the only supported version) nothing should change; new users might start with GnuPG 2.x if that's their installed version
    • gpg1 looks for GnuPG 1.x only, fails otherwise
    • gpg2 looks for GnuPG 2.x only, fails otherwise

    (#779 and related issues)

    ๐Ÿ‘Œ Support for mirroring non-package installer files

    ๐Ÿ†• New -with-installer flag was introduced for aptly mirror create. When updating and publishing mirror it will include installer files.


    Repo include API

    ๐Ÿ“ฆ aptly repo include command is now available via included packages from uploaded directory API.


    ๐ŸŽ Performance improvements

    ๐ŸŽ Performance improvements around loading collections of snapshots, mirrros, repos, etc. Now aptly does lazy loading which should improve both performance and memory footprint, which should be noticeable in commands which load whole contents of the db (aptly db cleanup).

    (#762, #765, #766)

    ๐Ÿ”„ Changes

    ๐Ÿ— aptly is now build with Go 1.12, support for Go 1.9 was dropped (#842)

    Stanza.WriteTo: Sort extra fields alphabetically (#803)

    ๐Ÿ‘Œ Support for non-armored detached signatures (#780, #773)

    ๐Ÿš€ Nightly builds, release builds moved to Travis CI and fully automated.

    ๐Ÿ›  Bugfixes

    ๐Ÿšš Don't remove API file socket if it exists and usable (#806, #807)

    ๐Ÿ›  Fix apt-file on newer distributions to work with aptly-published repositories (#756, #760)


    ๐Ÿ“ฆ Debian packages and binary distributions for various platforms are available at

  • v1.3.0 Changes

    May 14, 2018

    ๐Ÿš€ This is regular release of aptly.

    ๐Ÿ‘Œ Support for "legacy" Contents indexes

    ๐Ÿ“ฆ Ubuntu up to and including 16.04 is using "old" layout for Contents indexes for package repositories, while Debian has already switched to the new layout. Now aptly generates both "old" and "new" Contents indexes to allow apt-file to work with repositories published with Ubuntu <= 16.04 (#667, #729)

    Fall back to gpg1

    0๏ธโƒฃ aptly has two ways to sign published repositories: via external gpg command and using internal openpgp provider. Both of them support only GPG v1.x. To make it easier to support modern systems with GPG 2.x being installed by default, aptly tries to find GPG v1.x distribution by attempting to launch gpg1 binary if gpg is version 2.x (#734).

    ๐Ÿ”„ Changes

    ๐Ÿšš aptly repository has been moved to the org aptly-dev, and it's now being maintained by a team ( repository key has been rotated (#717)

    โฌ†๏ธ AWS SDK & other libraries were upgraded (#728)

    Speed up Contents indexes generation (#707)

    ๐Ÿ‘ aptly binaries are built with Go 1.10, aptly drops support for Go 1.7

    Shell completion function for zsh was added to the repo (#703)

    ๐Ÿ›  Bugfixes

    ๐Ÿ›  Fix error message truncating endpoint name in aptly publish drop (#711, #713)

    ๐Ÿ›  Fix Acquire-by-Hash index cleanup (#705, #706)

    ๐Ÿ›  Fix setting Acquire-by-Hash in the publishing API (#696)

    ๐Ÿ›  Fix Acquire-by-Hash in S3 publishing mode (#692, #697)

    ๐Ÿ›  Fix data race in API mode (#686, #688)

    ๐Ÿ›  Fix reading of long fields in Package stanzas (#738)


    ๐Ÿ“ฆ Debian packages and binary distributions for various platforms are available at

  • v1.2.0 Changes

    December 07, 2017

    ๐Ÿš€ This is scheduled regular release of aptly (a bit late according to planned to schedule).


    ๐Ÿš€ aptly supports by hash layout for published repositories ( This fixes a race when apt is downloading Release file while it's being updated to match new package indexes.

    โšก๏ธ Acquire-By-Hash mode is backwards compatible with clients which do not support it. Feature should be enabled when repo or snapshot is first published, subsequent operations (update, switch) would have acquire-by-hash mode enabled.


    aptly publish snapshot -acquire-by-hash snap-repo-20171205

    Thanks to @sliverc and @neolynx for the implementation of this new feature (#664, #381, #551).

    Dependency Resolution

    Several significant improvements were made to aptly internal dependency resolution engine. This specifically affects -dep-follow-all-variants, but there are some other changes improving compatibility.

    With 1.2.0 filters which have dependency resolution enabled might produce a bit different results (which should be more correct anyway).

    Refs: #615, #618, #643, #644

    ๐Ÿ”„ Changes

    ๐Ÿ‘ aptly is more flexible in terms of .deb format support, including recent dpkg changes (#658, #665, #635, #632)

    ๐Ÿš€ aptly supports SHA512 checksums in Release files (#668, #660)

    ๐Ÿ“ฆ aptly searches package pool when importing packages in aptly repo include (#278, #407)

    ๐Ÿ— aptly cleans up *.buildinfo files after importing packages (#682, #679)

    ๐Ÿ“ฆ Duplicate packages are being reported correctly in aptly package show/search commands (#446, #623)

    ๐Ÿ‘ Allow editing mirror URL (#677)

    Cleanup might be skipped while publishing (#620)

    โšก๏ธ goleveldb vendored library was updated to mitigate some bugs fixed upstream (#665)

    โšก๏ธ Go HTTP framework gin-gonic (used in aptly API) was updated to the latest version (#646)

    โฌ†๏ธ AWS SDK was upgraded (#648)

    ๐Ÿ‘ aptly binaries are built with Go 1.9, aptly drops support for Go 1.6 (#624)

    ๐Ÿ›  Bugfixes

    โšก๏ธ When mirror update fails or if it's canceled, aptly keeps already downloaded files (bug introduced in 1.1.0) (#683, #651, #641)

    S3 publishing with prefix was incorrectly cleaning up files (#673) and re-uploading all the files on every upload (#622, #619)

    S3 publishing was dropping SSE parameters when copying files (#649, #647)

    ๐Ÿ“ฆ Package names starting with uppercase latter are now handled correctly in queries (#636)


    ๐Ÿ“ฆ Debian packages and binary distributions for various platforms are available at

  • v1.1.1 Changes

    August 11, 2017

    ๐Ÿ›  This is bugfix release for aptly 1.1.0 series.

    โšก๏ธ aptly 1.1.0 contained bug (#600) with aptly mirror update - if package files are already downloaded, aptly mirror update was clearing fields in internal package database, which resulted in failures for subsequent publishing.

    โšก๏ธ If you are running aptly 1.1.0 upgrading to 1.1.1 and running aptly mirror update once again should be sufficient to mitigate that issue.

    ๐Ÿš€ For more information on new features in 1.1.x, please see 1.1.0 release notes.


    ๐Ÿ“ฆ Debian packages and binary distributions for various platforms are available at

  • v1.1.0 Changes

    August 09, 2017

    ๐Ÿš€ aptly 1.1.0 release is following (a bit late) scheduled every 3 months release of aptly.

    โฌ†๏ธ Upgrading

    โฌ‡๏ธ There're no steps required to upgrade from any version to 1.1.0, but downgrading from 1.1.0 to 1.0.x (or previous versions) is not supported due to changes in internal package pool layout.

    Custom Filesystem Publishing

    ๐Ÿ”ง aptly supported configuring number of S3 and Swift publishing endpoints for a long time, but local filesystem publishing was limited to default directory ~/.aptly/public and hardlinking files. There was number of requests to allow use of symlinks or file copy to support publishing to different filesystems and shared locations like NFS.

    ๐Ÿ‘€ With PR #521 from @seeraven aptly supports configuration of custom filesystem endpoints. Each endpoint has its own filesystem root, it might support either hardlinks, symlinks or simple file copy to reference files from aptly internal package pool.

    ๐Ÿ“ฆ Internal Package Pool

    ๐Ÿ— aptly stores package files deduplicated internal package pool (under ~/.aptly/pool by default). MD5 checksum was used to build file path in the pool, which had two consequences:

    ๐Ÿ‘ 1. MD5 checksum was required to pick location, so mirrors without MD5 checksums were not supported (#228, #442). ๐Ÿ“ฆ 2. In unlikely event when two different package files with same filename had same first two bytes of MD5 checksum, aptly would fail to import file (#329).

    ๐Ÿ“ฆ In order to overcome those problems, package pool and internal package file storage was changed. Now aptly always recalculates checksums on files being downloaded or imported, making sure each file has full set of checksums (including SHA512). Location of package files in the pool now includes more bytes of SHA256 making conflict unlikely.

    โฌ‡๏ธ When upgrading from previous version, aptly would be able to find and use previously downloaded or imported package files, but new files would be stored in new locations. This means that downgrading from aptly 1.1.0 to previous versions is no longer supported (it's not advised to do that for any version of aptly, but with package pool changes this would make aptly loose track of package files). There are no special actions to upgrade aptly to 1.1.0.

    Database Locking

    ๐Ÿ”’ There were several issues with aptly api serve with -no-lock which got fixed (#431, #582). With 1.1.0 every aptly command on startup performs 10 attempts to reopen DB if database is locked. This makes easier to use CLI from cron or in CICD environments (#401). Number of attempts is configurable with -db-open-attempts flag for every command. If you want to go back to pre-1.1.0 behaviour, use -db-open-attempts=0.

    PGP Providers

    ๐Ÿ‘ GPG implementation is changing a lot in 2.x series, it's becoming harder and harder to support reliable interface to gpg command-line tool. aptly now supports pluggable PGP providers. Two providers are implemented:

    0๏ธโƒฃ 1. Previously used gpg provider (default for 1.1.0), which is invoking gpg command-line tool.

    1. Internal PGP implementation based on

    ๐Ÿ‘ Internal implementation is not as feature full as gpg, but it has better integration when signing repos, it doesn't require gpg to be installed. Key management (public/secret keyring) still requires gpg.

    ๐Ÿ”ง PGP provider could be changed with -gpg-provider=[gpg|internal] command-line flag or via gpgProvider configuration value.

    ๐Ÿ”„ Changes

    ๐Ÿ“ฆ aptly sorts search results and package lists (#135, #214) with respect to correct version ordering.

    It's allowed to create snapshots of empty repos (#288).

    aptly now correctly matches checksums for indexes while mirroring (#376).

    ๐Ÿ“ฆ aptly packages from now correctly list xz-utils in dependencies (#395).

    aptly doesn't abort execution if Contents generation fails (#451, #533).

    ๐ŸŒฒ aptly generates detailed log while resolving dependencies with -dep-verbose-resolve flag (#508).

    ๐Ÿ“ฆ aptly can now optionally skip checking package files while downloading from the mirror (#520).

    โฌ†๏ธ aptly supports setting and inheriting from the mirror values for Origin, NotAutomatic, BadAutomaticUpgrades while publishing (#577, thanks @sliverc).

    ๐Ÿ›  aptly trims slashes on publishing prefixes (#613, #607).


    ๐Ÿ“š Development documentation is now available.

    ๐Ÿ‘• aptly code is verified with set of linters both for Go source code and Python functional tests.

    Files for back completion are now part of aptly source repository for easier packaging and PRs.


    ๐Ÿ“ฆ Debian packages and binary distributions for various platforms are available at

  • v1.0.1 Changes

    April 11, 2017

    ๐Ÿ›  Bugfix release for 1.0.0, contains single fix (#543) to make aptly cleanup temporary directories created while publishing.


    ๐Ÿ“ฆ Debian packages and binary distributions for various platforms are available at

  • v1.0.0 Changes

    March 27, 2017

    ๐Ÿ”„ Changes

    Contents index generation was re-implemented to use temporary DB instead of keeping index in memory which should lower memory requirements a lot during publishing.

    ๐Ÿ“ฆ Debian package reader was enhanced to guess correct archive type even if filename is incorrect (e.g. data.tar.gz while it's regular tar archive).

    ๐Ÿ‘ .xz compression format is supported for mirrors (index files).

    ๐Ÿš€ aptly mirror create supports new flag -force-architectures which disables validation of supplied architectures in Release file (for mirrors with broken Release files).

    โšก๏ธ aptly mirror update supports download retries via new flag -max-tries.

    ๐Ÿ“ฆ aptly search * family of commands allows query expression to be missing which means "display all the packages".

    ๐Ÿ†• New command aptly publish show to display detailed information about published repository.

    ๐Ÿ†• New command aptly repo create ... from snapshot ... to initialize local repository with snapshot contents.

    ๐Ÿ‘ aptly api serve supports systemd activation, listening on UNIX sockets and it bails out quickly if root dir is not writable.

    ๐Ÿ“ฆ aptly now supports -dbgsym packages while processing aptly repo include.

    aptly snapshot show output was enhanced to include information about snapshot sources (and its current names).

    ๐Ÿ‘ aptly graph supports rendering to output files instead of launching viewer, viewer is now custom per platform. Also additional vertical layout is supported which might be useful to get better-looking diagrams.

    Repo edit API doesn't touch repo fields which are not specified in the request.

    ๐Ÿ— aptly version command now reports correct version for nightly builds.

    ๐Ÿ‘ Extended support for OpenStack environment variables in Swift publisher.

    ๐Ÿ”– Versioning

    ๐Ÿ›  From now on, aptly release should happen every 3 months. For every release minor version would be bumped (e.g. next release would be 1.1.0). Bugfix-release will bump patch version (e.g. 1.0.1).

    ๐Ÿš€ Nightly builds versioning has changed, now version format is following git describe --tags format: x.y.z+<N>+<hash>, where x.y.z is previous aptly release (important, before it was next version of aptly) followed by monotonically increasing N and git commit hash.


    aptly stopped using gom for vendored dependency management. From now on aptly has all the deps committed to the source tree under vendor/ directory (standard Go vendoring). Vendored dependency are managed using dep tool.

    ๐Ÿš€ Go source code is checked using gometalinter, with only some most important checks enabled, more checks to be enabled in the next releases. Use make check to check your source code for problems.

    ๐Ÿ“ฆ aptly packages are built with Go 1.8.


    ๐Ÿ“ฆ Debian packages and binary distributions for various platforms are available at

    Previous versions

    ๐Ÿ”„ Changelog for previous version could be found at aptly website.

  • v0.9.7

    April 18, 2016
  • v0.9.6

    January 24, 2016
  • v0.9.5

    March 13, 2015