# APT 3.3.4 adds SHA3-256/512 hashing and tightens download verification

> **Key takeaway:** APT 3.3.4 introduces SHA3-256 and SHA3-512 support for package verification and now rejects downloads when required hashes cannot be calculated.

**Published:** 2026-10-19T19:29:54+00:00 
**Source:** Linuxiac 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/apt-334-adds-sha3-256512-hashing-and-tightens-download-verif.html 

## Summary
APT 3.3.4, the development release of Debian's package manager, adds SHA3-256 and SHA3-512 to its hashing library for repository metadata verification. The release tightens security by failing downloads when integrity checks cannot be performed, rather than proceeding without verification. Command-line usability improvements include expanded help coverage, grouped option display, and bash autocompletion generated from APT's own parser.

## What changes in APT 3.3.4
- **SHA3-256 and SHA3-512** added to APT's hashing library for checksum and repository metadata verification; disabled by default
- **Download verification hardened**: downloads now fail when a required hash cannot be calculated, rather than continuing unchecked
- **OpenSSL hashing errors** now surfaced to users instead of being silently ignored
- **Sources index fix**: corrects incorrect checksums when MD5 is disabled
- **Hash code refactored**: supported algorithms defined centrally, cached results restricted to requested algorithms
- **Bash completion** now auto-generated from declarative CLI parser, eliminating separate maintenance

## Why it matters
The SHA3 addition prepares APT for future cryptographic transitions, though its default-disabled status means immediate impact is limited to early adopters. The verification hardening closes a gap where incomplete integrity checks could silently pass, benefiting all users once the release reaches stable distributions.