Re: sources.list 's security line

From	Greg Wooledge <greg@wooledge.org>
Newsgroups	linux.debian.user
Subject	Re: sources.list 's security line
Date	2021-09-08 21:20 +0200
Message-ID	<CVbh0-616-1@gated-at.bofh.it> (permalink)
References	<CUjzY-5az-13@gated-at.bofh.it> <CUqi6-1gS-7@gated-at.bofh.it> <CUwdQ-4P2-5@gated-at.bofh.it> <CV7dp-3le-3@gated-at.bofh.it> <CVaNX-5Cb-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Wed, Sep 08, 2021 at 08:28:18PM +0200, Ulf Volmer wrote:
> On 08.09.21 16:50, Lee wrote:
> 
> > Are you using a dnssec validating resolver?
> > 
> > It'd be nice of somebody that understands dnssec would double-check,
> > but it looks like name lookups for security.debian.org has dnssec
> > enabled and not enabled for deb.debian.org
> 
> deb.debian.org is a CNAME and this CNAME is correctly DNSSEC validated.
> But this CNAME points to an A record outside of debian.org which is not
> secured by DNSSEC.

Apt uses SRV records, so:

unicorn:~$ dig +short SRV _http._tcp.deb.debian.org
10 1 80 debian.map.fastlydns.net.

It still points outside of *.debian.org, but the CNAME part doesn't
matter.  At least, not for apt in a recent Debian release in the
absence of a proxy.

Thread

sources.list 's security line riveravaldez <riveravaldezmail@gmail.com> - 2021-09-06 12:00 +0200
  Re: sources.list 's security line "Andrew M.A. Cater" <amacater@einval.com> - 2021-09-06 12:10 +0200
    Re: sources.list 's security line Brian <ad44@cityscape.co.uk> - 2021-09-06 12:30 +0200
      Re: sources.list 's security line Brian <ad44@cityscape.co.uk> - 2021-09-06 13:40 +0200
  Re: sources.list 's security line Brian <ad44@cityscape.co.uk> - 2021-09-06 12:50 +0200
    Re: sources.list 's security line Toni Mas Soler <antomassol@protonmail.com> - 2021-09-06 13:00 +0200
    Re: sources.list 's security line Greg Wooledge <greg@wooledge.org> - 2021-09-06 14:40 +0200
      Re: sources.list 's security line Brian <ad44@cityscape.co.uk> - 2021-09-06 15:20 +0200
      Re: sources.list 's security line Brian <ad44@cityscape.co.uk> - 2021-09-06 19:10 +0200
  Re: sources.list 's security line Steve Dondley <s@dondley.com> - 2021-09-06 19:10 +0200
    Re: sources.list 's security line Jim Popovitch <jim@k4vqc.com> - 2021-09-07 01:30 +0200
      Re: sources.list 's security line "Andrew M.A. Cater" <amacater@einval.com> - 2021-09-07 09:30 +0200
      Re: sources.list 's security line Lee <ler762@gmail.com> - 2021-09-08 17:00 +0200
        Re: sources.list 's security line Ulf Volmer <u.volmer@u-v.de> - 2021-09-08 20:50 +0200
          Re: sources.list 's security line Greg Wooledge <greg@wooledge.org> - 2021-09-08 21:20 +0200
            Re: sources.list 's security line Ulf Volmer <u.volmer@u-v.de> - 2021-09-08 21:40 +0200

csiph-web