APT, the package management system used by Debian, Ubuntu, and their derivatives, has been updated to version 3.3.4.
One notable addition is support for SHA3-256 and SHA3-512 in APT’s hashing library. These algorithms expand options for verifying package repository metadata and generating checksums.
However, it’s worth noting that SHA3 checksum generation remains disabled by default, so existing behavior is unchanged unless the new algorithms are explicitly enabled.
The release also tightens download verification. APT now rejects downloads when a required hash cannot be calculated instead of allowing the operation to proceed without the expected integrity check. Additionally, failures reported by OpenSSL during hashing are now properly surfaced, making it easier to identify problems.
Another fix addresses incorrect checksums in Sources indexes when MD5 hashing is disabled. The hash-handling code has been simplified, with supported algorithms defined in one place and cached hash results limited to those requested.
On the usability side, APT 3.3.4 expands command-line help to cover the remaining apt commands. Options are organized into named groups, making the help output easier to navigate.
Bash autocompletion has been improved as well. Instead of maintaining completion definitions separately, APT now generates them directly from its declarative command-line parser.
Rounding out the release are updated Portuguese manual page translations, refreshed Irish translations, and a new SECURITY.md file providing information about reporting security issues.
For more details, see the changelog.
APT 3.3.4 is part of the development series targeting Debian unstable. Users running Debian stable or Ubuntu should not expect the update to appear in their regular repositories.
