-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 02 Nov 2026 14:41:34 +0100
Source: apt
Binary: apt apt-dbgsym apt-utils apt-utils-dbgsym libapt-pkg-dev libapt-pkg7.0 libapt-pkg7.0-dbgsym
Architecture: riscv64
Version: 3.0.4
Distribution: trixie-security
Urgency: medium
Maintainer: riscv64 Build Daemon (rv-manda-01) <buildd_riscv64-rv-manda-01@buildd.debian.org>
Changed-By: Julian Andres Klode <jak@debian.org>
Description:
 apt        - commandline package manager
 apt-utils  - package management related utility programs
 libapt-pkg-dev - development files for APT's libapt-pkg and libapt-inst
 libapt-pkg7.0 - package management runtime library
Closes: 1111554
Changes:
 apt (3.0.4) trixie-security; urgency=medium
 .
   * SECURITY UPDATE: Download verification bypass
     - methods/*.cc: Open target files exclusively
     - CVE-2026-109518
   * SECURITY UPDATE: Out-of-bounds accesses
     - deb: guard against unsigned underflow when trimming control newlines
     - gpgv: don't advance past the null terminator in PushEntryWithKeyID
     - debDebFileParser: reject .deb without a Version field
     - srvrec: reject res_query answers bigger than our buffer
     - tagfile: fix unbounded backward scan in Fill()'s trailing-newline check
     - solver: Ensure workLess is a strict weak ordering
   * Memory exhaustion during download
     - Move "Tried to start delayed item […], but failed" to debugging
      (Closes: #1111554)
   * Test suite reliability:
     - test: Limit valgrind to 1024 open files
     - .gitlab-ci.yml: Point at debian:trixie
Checksums-Sha1:
 d7d61feb3f569512403428b34f19ec0052c311b5 6141960 apt-dbgsym_3.0.4_riscv64.deb
 6dfe90d2d8fb7a00b92ef1a901529eabf138ef42 1260312 apt-utils-dbgsym_3.0.4_riscv64.deb
 4924f3ea118bdbe78fe4b372e30ef4ca3a748333 324576 apt-utils_3.0.4_riscv64.deb
 2aa82b0d1f5152c5375b8dbfad208ecf31c2a754 9488 apt_3.0.4_riscv64-buildd.buildinfo
 d26b3ac1f146dbb7f2de49866df8e8ae97ef7168 1380232 apt_3.0.4_riscv64.deb
 67e00906e4a61096a7c7a83830d3964d353c0557 135396 libapt-pkg-dev_3.0.4_riscv64.deb
 057d93042e34f26c15c2af1e56003d8e5fbdfc84 9004748 libapt-pkg7.0-dbgsym_3.0.4_riscv64.deb
 e59b6656d7fa408f90c4018e6e25b66c580a49d3 1065600 libapt-pkg7.0_3.0.4_riscv64.deb
Checksums-Sha256:
 7503260286626074c418afc94d7ff7fd23b8af0a4727746eb8cb71e169bc8c31 6141960 apt-dbgsym_3.0.4_riscv64.deb
 218ec7746649ae58faa0659de8773d68abbf0e83fc3ceaba0f1035d4595dd8ed 1260312 apt-utils-dbgsym_3.0.4_riscv64.deb
 9121eed4894d2f50565573bacd7bbf7814a871666a98977609e2405c9f5292e2 324576 apt-utils_3.0.4_riscv64.deb
 e33a19e5e3b130edf32d2c052bae09b6201abb18038085d83ed484bbea5ec534 9488 apt_3.0.4_riscv64-buildd.buildinfo
 29ab8a349640160e1bde8ac86db3648d18e9b2f28efa85b50349b0fc11212091 1380232 apt_3.0.4_riscv64.deb
 81d3ba9ccf88156cb77fd1eb0305b116b5316ed2c4c97a7b92492a2b4564cbb0 135396 libapt-pkg-dev_3.0.4_riscv64.deb
 40e762290a0815a329a7667a12e832d0368835039faee0e9a2ff448f467ba75a 9004748 libapt-pkg7.0-dbgsym_3.0.4_riscv64.deb
 d2653b6ac9402b22c9ae047f71b8ce7131f71b32e5bd0452f3829fdcdf3730a8 1065600 libapt-pkg7.0_3.0.4_riscv64.deb
Files:
 2169f308fea5d085ddbed3ab07e8a4d8 6141960 debug optional apt-dbgsym_3.0.4_riscv64.deb
 54ea05962af534844c75f7a641b9ffd6 1260312 debug optional apt-utils-dbgsym_3.0.4_riscv64.deb
 cbdd4b1577311e63dd01f399adf924a3 324576 admin required apt-utils_3.0.4_riscv64.deb
 d447dbfbb6b6d18d51aba5d43312fe93 9488 admin required apt_3.0.4_riscv64-buildd.buildinfo
 ad825fc6685f279ea96d88d807fe064f 1380232 admin required apt_3.0.4_riscv64.deb
 e70c11109a6145852a0d4b1995f0528e 135396 libdevel optional libapt-pkg-dev_3.0.4_riscv64.deb
 448fbed8444f3e8f7f17a15b875e23de 9004748 debug optional libapt-pkg7.0-dbgsym_3.0.4_riscv64.deb
 c045e59c81732e49de17b8174813cdbe 1065600 libs optional libapt-pkg7.0_3.0.4_riscv64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEwN+C+Bc8deN4UliX50ghctvtZFQFAmro3McACgkQ50ghctvt
ZFSdCg//TRI6IfnK/Rv07Plo+NcBUvV1mR59gbLDeTnjfodBhHWZw8tKRQNh3s8p
z323xEuZW/iOsUTmVqaF2m1sduQoMxt9FYJtgYgWr6S/zuHZKo1CKIimv1t+XFY5
IV/6GOEsEFoheZWKTzsqKmrO2ZX0beMurYHyEfHOEHMNo+EGlKQn8eSFLTZCh+5v
UdvnTOhr58AOg//e9mku0kaTMqN9WR62Rn8zbA2On6JSg3CAFrtnF4J/V3hRoI1M
/TVvZFrX3djqV8Gb3bqEvhIvnxHgxMhkZcx0e5KmH/J4ec1shu0Bw904axZb2aQX
PaCfB/tmDpqVV8PdygJImXMhRlNi8Fa+RD0c8O+rF4teh09RHkW+IsZcmKQXfUdv
E3n8K6lZNJNgjZ9PRffHCFK3qP8OucNY3nP0iDmN0d5y6jPQs6ZUH8kLPmc+/BbJ
jILwAybPez0i+MeL7yaIL9v6iJl/XU8EGgxFpwCalVjuJhRFt14r8YADgmH9ukhm
zMcncrE2YxtLWWlg+3odJJZhBU5LKGdgYm0foQoagHxp5gZq0hHprPLO8j/eTrhh
lR3jWBdkkDWL6U6p87LvjxFHreTgarPi8qmtGjBuX3Mo07zh8eU2JzKZVX4vtWSb
VBc6CqbP2JBmIKzcvaUCZGx7O5uH6KLexY3iJ1t4GYWGwVi/yGc=
=6ncH
-----END PGP SIGNATURE-----