Dear Maintainer,

I found that configuration fragments in /etc/apt/listchanges.conf.d/ are loaded in a nondeterministic order.

This caused different effective configurations on two Debian 13 systems even though they had the same apt-listchanges version and identical configuration files.

The relevant code in apt_listchanges/ALCConfig.py is:

    configs = [conf]
    configs += glob(os.path.join(conf_d, '*.conf'))
    self.read(configs)

Python's glob() does not guarantee any particular ordering. Therefore the order in which configuration fragments override each other depends on the directory enumeration order.

I reproduced this on two OpenMediaVault systems running Debian 13 and apt-listchanges 4.8.

Both systems contained these files:

    /etc/apt/listchanges.conf.d/95openmediavault.conf
    /etc/apt/listchanges.conf.d/98openmediavault-mail.conf

95openmediavault.conf contains:

    [apt]
    which=both
    email_address=none
    email_format=html
    headers=false
    reverse=false
    titled=true

98openmediavault-mail.conf contains:

    [apt]
    email_address=root

On the affected system, glob() returned:

    /etc/apt/listchanges.conf.d/98openmediavault-mail.conf
    /etc/apt/listchanges.conf.d/95openmediavault.conf

The resulting effective configuration was:

    frontend        = 'pager'
    which           = 'both'
    email_address   = None
    email_format    = 'html'

As a result, apt-listchanges did not send email because can_send_emails() returned False.

On another system with the same apt-listchanges version and the same configuration files, glob() returned:

    /etc/apt/listchanges.conf.d/95openmediavault.conf
    /etc/apt/listchanges.conf.d/98openmediavault-mail.conf

The resulting effective configuration was:

    email_address   = 'root'

and apt-listchanges email notifications worked correctly.

I tested the following one-line change on the affected system:
--- a/apt_listchanges/ALCConfig.py
+++ b/apt_listchanges/ALCConfig.py
@@
-        configs += glob(os.path.join(conf_d, '*.conf'))
+        configs += sorted(glob(os.path.join(conf_d, '*.conf')))

After applying this change, the effective configuration became:

    email_address = 'root'
    which         = 'both'
    email_format  = 'html'

I then performed a normal APT upgrade. The apt-listchanges hook ran normally and the expected apt-listchanges email was successfully sent.

Therefore, sorting the configuration fragment filenames before passing them to ConfigParser appears to fix the issue and makes the override order deterministic.

The problem was reproduced with apt-listchanges 4.8 from Debian trixie. I have not tested whether 4.8+nmu3 in testing/unstable is affected.

Regards,
Kenichiro Kakizaki

Good catch, and good fix. I will apply it. Do you want credit in the
changelog, and if so, how would you like to be credited?

Hi Jonathan,
Yes, please. I'd be happy to be credited as "Kenichiro Kakizaki".
Thank you for applying the fix!
Best regards,
Kenichiro Kakizaki

Ken1R Kakizaki

We believe that the bug you reported is fixed in the latest version of
apt-listchanges, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150230@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jonathan Kamens <jik@kamens.us> (supplier of updated apt-listchanges package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 08 Oct 2026 09:58:58 -0400
Source: apt-listchanges
Built-For-Profiles: noudeb
Architecture: source
Version: 4.8.1
Distribution: unstable
Urgency: medium
Maintainer: Jonathan Kamens <jik@kamens.us>
Changed-By: Jonathan Kamens <jik@kamens.us>
Closes: 1145641 1150230
Changes:
 apt-listchanges (4.8.1) unstable; urgency=medium
 .
   * Remove debconf from pip dependencies in setup.py, since it's not
     actually a pip module. This fixes spurious warnings about
     apt-listchanges and debconf from `python3 -m pip check`.
     (Closes: #1145641)
 .
   * Load config file fragments in /etc/apt/listchanges.conf.d in file name
     order so they are loaded deterministically. Fix courtesy of Kenichiro
     Kakizaki. (Closes: #1150230)
Checksums-Sha1:
 b9fbb96a87f91a522fa58bc62837148351b61294 2049 apt-listchanges_4.8.1.dsc
 7993517eaf64c84b449f3407bcbe17e882d96e71 488164 apt-listchanges_4.8.1.tar.xz
 ce33756886b77a2c45ba2ebd91e621d4eed243dc 8093 apt-listchanges_4.8.1_source.buildinfo
Checksums-Sha256:
 49678d63f39939933f6de49bbc145aae3640f958128de47f4af03ae9a07568eb 2049 apt-listchanges_4.8.1.dsc
 e7f18b595e3b13c407771e90f42c4755b3644309ff601780707423f4229c0022 488164 apt-listchanges_4.8.1.tar.xz
 5a9558b712eefd2ae67d58bb7d5397ffdf1cc105d879d4f8c5aa898953166ff0 8093 apt-listchanges_4.8.1_source.buildinfo
Files:
 e4e40823edd1ff417c7c72848cc80b08 2049 utils - apt-listchanges_4.8.1.dsc
 bb45c01b378a261afc9a2e43b9c80719 488164 utils - apt-listchanges_4.8.1.tar.xz
 210ed31681602ecc5a5711f9ee2fe452 8093 utils - apt-listchanges_4.8.1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEd8lhnEnWos3N8v+qQoMEoXSNzHoFAmrR+ccACgkQQoMEoXSN
zHqGFxAAqKEqmvOowECaaPmxluiW3+wz5v0GDmvoOM+zsLrbjHHJIc8An8Itlg0M
XkYZrd8i9eL1RqgHWeas7zLv6SOuNIZx9Uhul354p2Y2mkVM9bJr+mZr7EE/cTjX
W9ZelKlmf6OhSFC1fOvZF5z4RB9LxrTNUskNQ5NUccF1OxtkvOkuSVZtr/AykjhN
+ZzNdKlFJKLXk3/uR80pum3qcrrq3tFw/4hrdY/CB53vzI+r1EW9NbVtuDUMp69O
Mw7/kXbMUcF6JeLNudmwRG0Xa1nZxgPSiNXS6D6oOtGOmF2vGocQjGQ6SlL/gHi6
qr20T97cTBPGfII5VTk44UGX133eH0aT5Lb9YViQ+YTpT4QfN+A/HoNqh81rRTUH
ZzItzerfcPULRapZXdFGylf+O2ylFZSxWoa8s0ARUh/MsZqBufpvZvnX/NSJ0w2P
G5O1jdlApUpgay5sXXHMq6Izp3OrHvHYuXUHe0K8JODDVZG26N8LgOFgAlgjKRYi
UB8L/1NGOeEcuTv0e2OmPHitkZIuo/B2qlA/4h3AHCX0zyM7fRn4yr4zSQWGPptc
sR+N97dBaEU+4fe/YS9R1e0hQvuAchQAfsBDpg2NZMR8Cb2HHAN27DXyBq6vQyiu
JnYEGf0qupPwmdkYFSDHDkUKJMkSob6F971/dbeuEOwIQEEJkzU=
=RtQ8
-----END PGP SIGNATURE-----