Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #268114

Re: distribution archives became unusable

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On 06/03/2024 08:09, Harald Dunkel wrote:
> Hi folks,
>
> the repositories listed on https://www.debian.org/distrib/archive have
> been signed using expired keys. Unfortunately this page doesn't deal
> with this problem.
>
> Do you think this could be improved?

No, I wouldn't have said so. The packages were signed with keys that 
were valid before they were archived. The archive then provides a 
bit-for-bit copy of what was in the repository at that point in time.

If the keys that signed the packages didn't have an expiry, then there'd 
be an opportunity for someone to update (and validly) sign packages 
retroactively.

The fact that the keys /have/ expired should reassure you that the 
archive hasn't been tampered with.

>
>
> Regards
> Harri
>

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

distribution archives became unusable Harald Dunkel <harald.dunkel@aixigo.com> - 2024-03-06 09:30 +0100
  Re: distribution archives became unusable Darac Marjal <mailinglist@darac.org.uk> - 2024-03-06 20:10 +0100

csiph-web