New Distributions Added

• Added Linux Mint 19.1
• Added Linux Mint 19.2
•  Added Linux Mint 19.3
• Added Ubuntu Disco Dingo (19.04)
• Added Ubuntu Eoan Ermine (19.10)
• Added Ubuntu Focal Fossa (20.04)
• Added Fedora 30
• Added CentOS/RHEL 8.0
• Added Debian Bullseye

2.0.8 (released April 19, 2019)

Bug fixes

• Attempting to install packagecloud:enterprise on AWS Linux 2 resulted in an error due to improper OS detection by the installer. This OS is not officially supported, but this bug has now been fixed.

2.0.7 (released April 12, 2019)

New Features

• CloudFront support for package downloads.

Bug fixes

• Timezone tables for the embedded MySQL server are only inserted once or when needed, instead of on every reconfigure.
• Allows uploads of xbstream backups to S3 greater than 5GB.
• Old xbstream backups are now properly rotated.

2.0.6 (released March 28, 2019)

Bug fixes

• Better support for improperly padded ZIP archives.
• Allows uploads of backups to S3 greater than 5GB.
• Updated Rails version which addresses CVE-2019-5418, CVE-2019-5419, CVE-2019-5420

2.0.3 (released September 6, 2018)

Bug fixes

• Fixed XSS vulnerability.
• HSTS is now set when HTTPS is enabled.
• Cookies are now set to Secure: True when HTTPS is enabled.

2.0.2 (released May 20, 2018)

New Features

• Ability to migrate embedded MySQL to Amazon RDS.
• Using external MySQL databases with SSL is now supported.
• SHA256 checksum of package added to all API responses (other checksums are still available via the package details API).
• Additional error checking for malformed Rubygem archives.
• Admins can now clear a specific type of queue.
• Improved error checking/handling for NPM packages' "engines" field.

Performance improvements

• packagecloud-ctl reconfigure command performance greatly improved.
• Optimized code paths around Read Token authentication.

Bug fixes

• API "limit" pagination parameter is now respected in all cases.
• Indexing of Python repositories no longer occasionally deadlocks the database.
• Fixed RPM versions API for SUSE packages.
• Embedded MySQL no longer listens on 127.0.0.1:3306 (only uses a socket file now).
• Add GPG key endpoint that lets Zypper verify repository metadata signatures.
• pkg_gpgcheck set to 0 for Zypper repository configurations to work around Zypper bug where gpgkey= urls are not respected. More details available in the SUSE bug reports 1088037 and 954274.
• Descriptions of packagecloud-ctl queue management commands fixed.

New Distributions Added

• Fedora 28
• SLES 12.3
• Elementary OS "loki" 0.4

2.0.1 (released March 22, 2018)

New Features

• Additional information about Node.js packages is now displayed on package pages.

Performance improvements

• YUM indexer efficiency increased significantly for large repositories.
• APT indexer efficiency increased significantly for large repositories.
• Deletion of large repositories is now much more efficient.
• Unnecessary queries removed from repository pages, resulting in faster load times.

Bug fixes

• A feature added to recent versions of Bundler (1.14 and higher) to warn about an unwritable home directory was resulting in this warning being written out for all bundle-related tasks, including dumping the GPG public key. This issue has now been resolved.
• A bug in an open source library prevented GPG signatures of repositories with UTF-8 strings in the repository description. This has now been fixed.
• Python repositories previously incorrectly returned 404s for valid HEAD requests. This has now been fixed.
• A bug preventing users from manually updating the 'latest' distribution tag for a package has been fixed.
• Accessing private NPM repositories with the wrong authorization scheme (e.g. Basic instead of Bearer) previously returned a 500. This has been fixed to return a 401.
• Prevent Debian packages with severely broken version strings from being uploaded.
• Prevent RPM packages with missing version or release strings from being uploaded.

2.0.0 (released February 26, 2018)

New Distributions Added

• Fedora 27
• Ubuntu 18.04
• LinuxMint Sylvia

New Features

• Redesigned UI.
• Support for NPM registries and Node.js packages.
• Add support for Android Java packages (APK) files and the binary manifests contained within.
• Allow promote and delete when using package search.
• Bump all libraries, frameworks, and Ruby to the latest versions.
• Add support for additional download URLs like: download.rpm to make package managers which string match file extensions happy.
• Allow user to select master token on repo install pages so the install scripts will use the desired token.
• Add detection of gnupg to repository install scripts.
• Handle requests for 6Server and 7Server routing them to el/6 and el/7, respectively.
• Extended Python License field to allow more verbose License files.
• Add structured data so that links from packagecloud pasted into chat apps look much nicer :)
• Improved performance of Debian indexer for "all" arch.

Bug fixes

• RubyGems with different platforms (but the same version) were unable to be uploaded due to a buggy database constraint. This is now fixed.
• Fix a bug introduced by certain versions of dpkg on Debian systems which generated malformed version strings in package metadata.
• Parsing debian package metadata may have parsed control.swp files (generated by vim and erroneously included a debian package). Fix this by explicitly checking the filename.
• Require all debian binary packages to have at least: version, maintainer, and description fields.
• Fix an issue when uploading JAR packages with no pom.xml file.

1.0.55 (released September 17, 2017)

New Distributions Added

• LinuxMint 18.2 (sonya)
• openSUSE LEAP 42.3
• Fedora 26

New Features

• All repository indexer jobs now log a lot more useful information.
• Java package API response now include a download_url field.
• Link to enterprise documentation added to footer.
• Improved error-handling for packagecloud-ctl reset-password command.
• Adds configuration options for tuning Garbage Collection parameters for application and job workers, new defaults should increase performance overall. See the Garbage Collection page for more details.

Bug fixes

• Fixed bug around handling of Debian DSC packages containing a '+' character in the filename.
• Fixed bug with Search API pagination.
• Fixed promotion of Debian DSC packages and Java packages.
• Fixed a bug around stale repository indexes when all packages have been promoted out of a repository.
• Names for Master Tokens and Read Tokens have been increased to 255 characters and slashes are no longer allowed. (Slash characters in token names will automatically be replaced with a dash). See Release Notes for instructions.
• You can no longer accidentally delete web-dl read tokens.
• Size field is now properly stored for Debian DSC packages.
• Fixed race condition in Debian Indexer jobs that would cause Release files to occasionally return 404 while they were being generated.
• Fixed packagecloud-ctl backup-all command.
• Fixes packagecloud-ctl bootstrap-database command when database does not exist.

1.0.54 (released July 24, 2017)

New Features

• Adds Java WAR support.
• API for managing package signing GPG keys. Install the latest package_cloud gem to use (v2.0.43).

Bug fixes

• Fixes installation instructions for Java SNAPSHOT versions.
• Improved error handling for package uploads.
• Fixes bug preventing reliable logged-in sessions from working for deployments with multiple frontends (see the Session Secret documentation for more information).
• Fixes bug where proxied requests to S3 from python/pip would fail.
• The bootstrap-database command now returns the correct exit status for all cases.

1.0.53 (released June 7, 2017)

New Features

• Allows upload of GPG package signing keys to repository (supported only for yum/rpm, for now).

• Support for using an external GPG agent for keys that need a passphrase, see documentation for External GPG Agent.
• Better error handling for malformed debian file uploads.

Bug fixes

• Hitting ESC key now closes modals.

• Fixes issue where sometimes copy/paste button would copy incorrect text.
• Fixes issue around zypper configuration file generation.

1.0.52 (released May 12, 2017)

New Features

• Allow search of Java packages by group.

• A `destroy_url` field is now included in all API responses.

Bug fixes

• Fixes Maven uploads from Microsoft Windows platforms.

• Fixes issue where package promotions from private repositories to private repositories could not be downloaded from the web. (See Release Notes for more information).
• Adds stricter HTML escaping/sanitization to more parts of the interface.
• Better error messages for Java package uploads.
• Better error messages for Python package uploads.
• Various Stats API fixes for Python and Rubygems packages.

1.0.51 (released May 5, 2017)

Bug fixes

• Adds extra CSRF protection to critical endpoints for increased security.

1.0.50 (released May 4, 2017)

Bug fixes

• Fixed XSS vulnerability.

1.0.49 (released April 19, 2017)

Bug fixes

• Fixed XSS vulnerability.

1.0.48 (released March 28, 2017)

New Features

• Added support for SLES 42.2 and SUSE 12.2.

• Add support for Android AAR Java libraries.
• Added tips for logged in users with links to documentation for common actions.
• New rubygems may include checksums with stronger SHA algorithms. Support for verifying RubyGems with stronger checksums has been added (previously these gems were simply rejected on upload).
• Added a way to filter repository pages by package type.
• Bumped the bundled redis up to 3.2.6. 

Bug fixes

• Adjusted APT contents query to more efficiently generate Contents file metadata.

• UI adjustments (colors, positioning, etc).
• Add an additional check to install scripts for a second SSL-related error code that curl can return (code 60).
  
  

1.0.47 (released January, 2017)

New Features

• Added support for Linux Mint 18.1.

• Added packagecloud-ctl reset-password <user> <password> command.

Bug fixes

• Minor angular app fixes.

• Forgot password page will now show a warning if SMTP is not configured.
• Handle RPMs that have ghost files present in the archive when they should not. This is caused by a buggy librpm that is shipped with CentOS 6.
• Minor updates to the mirroring instructions tab.
• Cosmetic updates to the package delete button.
• Remove the scheme (e.g., http:// or https://) from the origin when generating a release file. Apt's unattended-upgrades cannot handle '://' and crashes when pointed at repositories with this character set in the Release file.
• Better handling of buggy JAR packages
• Better handling of malformed Debian packages
• Fix package promotion for SUSE packages

1.0.46 (released December 2, 2016)

New Features

• Added support for package promotion to easily move packages between repositories. Read more about this feature here:
  https://blog.packagecloud.io/eng/2016/11/21/announcing-package-promotion/.

• Added an API for working with repository README files. Read more here: https://packagecloud.io/docs/api#resource_repository_readme.

• Major refactor of the UI for a faster and nicer looking UI.
• Added support for Fedora 25.
  
  

1.0.45 (released November 22, 2016)

New Features

• Support for external Redis, see: High Availability Setup (AWS)

1.0.44 (released November 14, 2016)

Bug fixes

• Extremely long package descriptions are now truncated before save

• Fixes gpg.key URL in Proxy Configuration

1.0.43 (released November 4, 2016)

New Features

• New architectures for RPM: cortexa9hf_vfp_neon, snarc_soca9

• New architectures for Debian: arm64

• SBT and Scala support

• Acquire-by-hash support for APT repositories. You can take advantage of this feature right away using our back ported APT clients for ubuntu/precise and ubuntu/trusty, see our post for details: http://blog.packagecloud.io/eng/2016/10/17/apt-by-hash-backport-ubuntu-trusty-precise/

• OpenSuse support (zypper)

• Yocto Linux support (Poky)

Bug fixes

• Better error handling during uploads
• Python repositories are now reindexed when renamed

1.0.42 (released October 17, 2016)

New Features

• Minor tweaks to better support http/https proxying, such as when using Amazon Elastic Load Balancer.

1.0.41 (released October 5, 2016)

Bug fixes

• Skip the on-boarding process for users listed in users.yml that aren't already in the database by adding action: 'delete' to individual the user entry.

1.0.40 (released September 22, 2016)

Bug fixes

• Upgraded openssl to 1.0.1u, addressing CVE-2016-6304.

1.0.39 (released August 10, 2016)

New features

• Added a dialog for creating master tokens and read tokens from the web UI.

Bug fixes

• Fixed a bug preventing certain RubyGem packages from being uploaded.
• Fixed a bug preventing certain RubyGem packages from being deleted.

1.0.38 (released August 3, 2016)

New features

• Java JAR support added.
• Repository pages can now have markdown READMEs.
• Package dependencies are now returned for each package when using the package show API.
• Statistics API URLs are now returned for each package when using the package show API.
• Allow the log level to be adjusted to prevent excessive logging. The default log level has been set to 'error' unless otherwise specified with packagecloud_rails['log_level'] in /etc/packagecloud/packagecloud.rb.
• Add support for Linux Mint 18.
• Add support for Fedora 24.
• Add support for the ppcel64 architecture for Debian packages.

Bug fixes

• Fix rendering of package descriptions
• Fix bad query that occasionally caused MySQL deadlock errors when marking packages as being indexed.
• When a user on packagecloud:enterprise is disabled, all collaborations that user had are now deleted.
• Allow python wheels with periods in the name to be uploaded.
• Fix handling of ARM-architecture RPM packages.
• Strip 4-byte UTF-8 characters from description fields to prevent a MySQL error on insertion.
• Debian packages with unknown architectures are now rejected.

1.0.37 (released May 10, 2016)

Performance improvements

• Performance improvement for Debian package indexer. Reindex times are significantly reduced for large (> 2000 package) repositories.
• Improve performance of all package servers. The latency between making a request for a package via apt-get, yum install, pip install, and gem install and receiving a 302 has been reduced by 40-60%.
• Improve performance of RPM indexer significantly. Repositories with large numbers of packages (> 2000 packages) will have the most noticeable speed increase.

New features

• Search was rewritten from the ground up to be much faster and easier to use.
• Added a badge to repository pages to indicate if a package is currently being indexed. Once the package is indexed, the badge disappears.
• Added an "indexed" attribute to package API results.
• Added "download_url" to package API results.
• Added a delete button to package pages.
• Enabled SHA256 GPG signatures for Debian Wheezy and above (previously was only Debian Jessie and above).

Bug fixes

• Fix some broken javascript includes preventing certain front end panels from displaying properly
• Fix a bug in the RPM indexer where noarch RPM would queue a reindex of the SRPM packages.
• Fix authentication bug for the RubyGems dependency API. This (and only this) endpoint must be accessible with read tokens and not normal API tokens so that bundler can properly use the endpoint.
• Fix a small bug for APT Empty Indexes.

1.0.36

• Updates OpenSSL to 1.0.1t

1.0.35

• Add repository collaborations to new and existing users by passing a list of repository paths (:user/:repo) to a user entry in the users seed file /etc/packagecloud/users.yml:

users:
   - { email: 'tester@test.com', name: 'tester', password: 'encrypt_me', collaborations: ['user/repo'] }

1.0.34

• Fix reindex_debs rake task (additional specs were added to prevent future breakage of this task)
• Fix a very rare bug when rending RPM Package details pages

1.0.33

• Embedded install instructions
• Better error messages for web uploads
• Display checksums on package pages
• Remove XZ support (see the Release Notes)
• Add SHA256 GPG signatures for recent Ubuntu and CentOS distributions
• Allow users to remove themselves as collaborators from repositories
• Fix a race condition in the Debian indexer for packages with architecture type all
• Support RubyGems dependencies API endpoint
• Added support for S3 Transfer Acceleration (see the S3 guide)
• Ruby bumped to 2.1.9 with back-ported patch to avoid rare segmentation faults

1.0.32

• Fix timezone SQL table import bug affecting new installs (upgrades are unaffected).
• Fix typos in config and users.yml files.

1.0.31

• Cosmetic changes for displaying long package descriptions, additional package info (like size), website footer, page tiles, and more.
• Stats API for getting download stats and repository installation stats and docs.

1.0.30

• Updates openssl to 1.0.1s (https://www.openssl.org/news/secadv/20160301.txt)

1.0.29

• Python support

1.0.28

• CentOS 6 support
• Fixes bug around mysql not starting up if mysql was already installed on host vm (in some cases)

1.0.27

• Updates openssl to 1.0.1q (https://www.openssl.org/news/secadv/20151203.txt)

1.0.26

• Fixes regression introduced in 1.0.25 for private source file downloads

1.0.25 (yanked)

• Support for storing packages and repository metadata on the local hard disk instead of AWS S3
• Add support for Elementary OS
• Fix bug for subdomain in private repository bundler install scripts

1.0.24

• Add Bundler tab to install page
• Fix rubygem installation scripts for private repos
• Safeguards to prevent partially downloaded install scripts from running

1.0.23

• Fix a bug in the Fog library preventing users from issuing HEAD requests
• Rearrange Debian package indexer to avoid race condition for packages with architecture type 'all'
• Add Ubuntu Wily support
• Add LinuxMint support
• Add Raspbian support
• Add mirroring information to repository pages
• Several updates to install bash script, remove hostname use for public repos, provide os overrides
• Update the manual install instructions to make them easier to read and follow
• Fix minor bug in web-based package upload

1.0.22

• Add tcmalloc - reducing the memory use baseline by approximately 20%
• Refactor and reorganize most of the javascript code in the app
• Performance improvement for buffering large packages (> 350 mb)
• Performance improvement for processing and storing data about large packages (> 350mb)
• More error checking when generating config files used by installation scripts

1.0.21

• Fix NGINX route to prevent certain APIs from hitting the non-API worker processes
• Pass through NGINX read timeout variable so users can adjust as needed
• Update disallowed username list
• Modify repository deletion to not queue a reindex
• Minor performance enhancements in libraries that process Debian and RPM packages

1.0.20

• Modify enterprise installer to deal with fixing permissions on previous installations of enterprise
• Add a set of bootstrap tasks to separate database creation and installation

1.0.19

• Fix bug in background delete jobs
• Add buildkite documentation

1.0.18

• Bump openssl version

1.0.17

• Fixed some logging bugs affecting background job processing
• Fix minor permissions bug during enterprise installation
• Refactor background delete job
• Add additional packagecloud-ctl commands for queue status and deletion
• Bump openssl version