APT 3.3.4 adds SHA3-256/512 hashing and tightens download verification

APT 3.3.4, the development release of Debian's package manager, adds SHA3-256 and SHA3-512 to its hashing library for repository metadata verification. The release tightens security by failing downloads when integrity checks cannot be performed, rather than proceeding without verification. Command-line usability improvements include expanded help coverage, grouped option display, and bash autocompletion generated from APT's own parser.

What changes in APT 3.3.4

• SHA3-256 and SHA3-512 added to APT's hashing library for checksum and repository metadata verification; disabled by default
• Download verification hardened: downloads now fail when a required hash cannot be calculated, rather than continuing unchecked
• OpenSSL hashing errors now surfaced to users instead of being silently ignored
• Sources index fix: corrects incorrect checksums when MD5 is disabled
• Hash code refactored: supported algorithms defined centrally, cached results restricted to requested algorithms
• Bash completion now auto-generated from declarative CLI parser, eliminating separate maintenance

Why it matters

The SHA3 addition prepares APT for future cryptographic transitions, though its default-disabled status means immediate impact is limited to early adopters. The verification hardening closes a gap where incomplete integrity checks could silently pass, benefiting all users once the release reaches stable distributions.