scutarius-apt-config (2.7+scutarius.harma) adam; urgency=medium

  * The migration's backup no longer lives in /etc/apt/sources.list.d, and the
    strays 2.6 left there are cleaned up. apt scans that directory and prints
      N: Ignoring file 'X' in directory '...' as it has an invalid filename extension
    for any name outside Dir::Ignore-Files-Silently (~ .disabled .bak .dpkg-*
    .ucf-* .save .orig .distUpgrade -- read from `apt-config dump` on two hosts
    rather than recalled). ".scutarius-bak" is outside that list, so every
    machine that migrated printed that warning on every apt-get update,
    forever. Reported from brain-cell-g4 on 2026-09-08, the first day any
    machine migrated. Backups now go to /var/backups/scutarius-apt-config,
    mirroring the original path.
  * The same change fixes a worse bug it was hiding: THE SECOND RUN DESTROYED
    THE BACKUP. The migration loop walked every file in sources.list.d, and
    after run 1 the backup legitimately contains the old URL -- so run 2 found
    it, rewrote it to the new URL, and backed THAT up again as
    <file>.scutarius-bak.scutarius-bak. postinst runs on every upgrade and
    every reconfigure, so a machine only had to be configured twice to lose the
    only record of its pre-migration sources. The loop now walks *.list and
    *.sources only, which is what apt reads; a file apt ignores is not a source
    and rewriting it changes nothing apt will ever look at.
  * The scratch file used during the rewrite moved out of sources.list.d too:
    an interrupted run would have left it there and apt would have warned about
    it on the same grounds.
  * Strays already on disk are MOVED, not deleted -- that file is the machine's
    only record of what it had before the rename -- and only our own suffix in
    that one directory is touched, so an admin's own foo.list.bak is left alone.
  * Migration harness grown from 20 assertions to 29, including a positive
    control proving the "nothing noisy is left behind" check can actually
    detect a noisy file. A check whose safe answer is "found nothing" is
    indistinguishable from a broken one without it.

 -- Kristof Csillag <kristof.csillag@deai-labs.com>  Tue, 08 Sep 2026 20:30:00 +0200

scutarius-apt-config (2.6+scutarius.harma) adam; urgency=medium

  * Archive rename migration. The org publishes its archive under a new name,
    and ARCHIVE_URL now says so; new artifacts pick that up automatically, but
    machines already installed do not -- their sources line was written once,
    at install time, and nothing has ever revisited it. postinst now rewrites
    any URL listed in the new optional org value ARCHIVE_URL_LEGACY to
    ARCHIVE_URL.
  * That migration is not cosmetic and doing nothing was not the safe option.
    The 2.5 safety net writes the canonical source when it finds none matching
    ARCHIVE_URL; after a rename an upgraded machine's old line no longer
    matches, so the net would have fired and ADDED the new source beside the
    old one, leaving every machine fetching the same indices twice under two
    names. Rewriting makes the rename a move rather than a duplication.
  * Scope is deliberately narrow: only URLs the org has actually published, and
    ACTIVE lines only. A source that merely shares the old domain is left alone
    -- rewriting it into a hostname that may not exist would break it silently.
    A commented-out line is left alone too: it is history or a deliberately
    disabled source, and changing what an admin gets back when they uncomment
    it would be a surprise.
  * Every file the migration touches is copied to <file>.scutarius-bak first.
    Duplicates are collapsed when a machine already carried both names, the
    whole thing is idempotent, and it can never fail dpkg configure -- a
    machine that cannot be rewritten still has a working source on a name that
    is still served, so it warns rather than aborts.
  * The 2.5 safety net now backs up before it writes. It replaces
    /etc/apt/sources.list.d/scutarius.list wholesale with ">", and that file
    CAN exist while still not matching ARCHIVE_URL -- an org that renames
    without listing the old name reaches exactly that path -- so an admin's
    component list, lane and options were being destroyed silently. Found by
    scripts/pkg/tests/apt-config-migration-harness.sh, which runs this postinst
    against synthetic /etc/apt trees; the case expected a no-op and got a
    rewrite.
  * The old archive name is NOT retired by any of this. It is in the
    sources.list of every machine ever installed and must go on being served.

 -- Kristof Csillag <kristof.csillag@deai-labs.com>  Tue, 08 Sep 2026 18:49:47 +0200

scutarius-apt-config (2.5+scutarius.harma) adam; urgency=medium

  * Release-agnostic (spec 2026-09-06-release-channels-design.md, R6, sec. 4):
    the sources line is no longer shipped -- the installer writes it for the
    release/lane a machine is installed on (finish-install hook), the image
    builder likewise. The scutarius-apt-config-testing variant is gone with it.
    Upgrades keep their line: dpkg leaves the obsolete conffile in place, and
    postinst writes one only if none names the archive (from os-release).
  * Dropped the "freia never-auto" pin: the merged views decide what a release
    sees; a machine has no other source.
  * Version carries the org token (+scutarius.<ORG_TAG>): the keyring and the
    archive URL inside are this org's, so the version must say so (sec. 8).

 -- Kristof Csillag <kristof.csillag@deai-labs.com>  Tue, 08 Sep 2026 00:31:46 +0200

scutarius-apt-config (2.4) adam; urgency=medium

  * CORRECTION to the 2.3 entry, which named the wrong root cause. 2.3 is
    published and its source is immutable, so the record is set straight here
    rather than by rewriting history.
    The testing variant displaced the production one because the stale 2.0
    BINARY in adam carried "Priority: important": debootstrap installs every
    required/important package, so it arrived uninvited and its Conflicts
    removed the production package that base-installer/includes had asked for
    BY NAME. Evidence: the 2.0 stanza as dpkg recorded it on an installed
    guest carried Priority: important AND Provides, and /var/log/dpkg.log
    shows the production package unpacked on its own account in the same
    transaction -- so Provides was never needed to satisfy the request and
    cannot explain the testing variant's presence.
    The Priority: optional fix had existed in source since 2.2 but had never
    reached adam for that binary. What fixed the defect was a corrected binary
    reaching adam (the 2.3 promotion), not the Provides removal.
    Dropping Provides remains worth keeping as hygiene: a testing variant
    should not impersonate the production name.

  * 52scutarius-unattended-upgrades: Unattended-Upgrade::Origins-Pattern
    "origin=Scutarius,label=Scutarius" (both lanes carry these), no automatic
    reboot, unused dependencies removed. Owner ruling 2026-09-05
    (docs/milestone-pure-apt.md): the distro ships its own unattended-upgrades
    configuration following the merged view; cluster choreography stays on
    the site side. The file is inert until unattended-upgrades is installed,
    which d-i now proposes by default (pkgsel/update-policy, installer
    scutarius5). Shipped by both variants.

 -- Kristof Csillag <csillag.kristof@gmail.com>  Sat, 05 Sep 2026 23:32:06 +0200

scutarius-apt-config (2.3) adam; urgency=medium

  * scutarius-apt-config-testing: drop "Provides: scutarius-apt-config".
    Conflicts/Replaces already make the two mutually exclusive; the Provides
    let the testing package satisfy a request for the PRODUCTION name, so
    d-i's base-installer/includes pulled both and the testing variant won --
    every installed system tracked adam-testing. Found by the qemu install
    test on a2, 2026-08-25.
  * The archive URL and the maintainer now come from ORG CONFIG (org.schema:
    ARCHIVE_URL, MAINTAINER) via *.org.in templates rendered at build time;
    the tree in git no longer carries either.

 -- Kristof Csillag <csillag.kristof@gmail.com>  Tue, 25 Aug 2026 09:07:21 +0200

scutarius-apt-config (2.2) adam; urgency=medium

  * Both variants Priority optional: image builders and the installer name
    the wanted variant explicitly; "important" auto-selection pulled the
    production config into testing images (and vice versa) -> Conflicts.

 -- Kristof Csillag <csillag.kristof@gmail.com>  Sun, 23 Aug 2026 09:30:00 +0000

scutarius-apt-config (2.1) adam; urgency=medium

  * scutarius-apt-config-testing: Priority optional (an image builder's
    "important" variant pulled BOTH variants and they conflict).

 -- Kristof Csillag <csillag.kristof@gmail.com>  Sun, 23 Aug 2026 09:00:00 +0000

scutarius-apt-config (2.0) adam; urgency=medium

  * ONE source: the merged Scutarius view on genesis (spec
    2026-08-22-merged-archive-design.md); the Devuan/Debian lines are gone --
    nodes talk to genesis only. deb-src added. Pins kept as belt and braces.
  * New binary scutarius-apt-config-testing (adam-testing lane).

 -- Kristof Csillag <csillag.kristof@gmail.com>  Sat, 22 Aug 2026 14:30:00 +0000

scutarius-apt-config (1.3) adam; urgency=medium

  * /etc/apt/apt.conf.d/90scutarius: no automatic Recommends/Suggests
    (minimality; linux-image's apparmor Recommends was being pulled).

 -- Kristof Csillag <csillag.kristof@gmail.com>  Sat, 22 Aug 2026 10:00:00 +0000

scutarius-apt-config (1.2) adam; urgency=medium

  * Archive components: main contrib non-free-firmware non-free (Policy 2.2
    placement of the closed NVIDIA pieces and what depends on them).
  * Ban upstream (Devuan/Debian) kernel packages via pin -1 (o=Devuan);
    Scutarius ships its own linux-image-scutarius-arm64 / linux-image-gb10.

 -- Kristof Csillag <csillag.kristof@gmail.com>  Sat, 22 Aug 2026 08:00:00 +0000

scutarius-apt-config (1.1) adam; urgency=medium

  * Converted to a native source package built with sbuild; content unchanged.

 -- Kristof Csillag <csillag.kristof@gmail.com>  Sat, 22 Aug 2026 00:00:00 +0000
