Re: distribution archives became unusable

Path	csiph.com!fu-berlin.de!bofh.it!news.nic.it!robomod
From	Darac Marjal <mailinglist@darac.org.uk>
Newsgroups	linux.debian.user
Subject	Re: distribution archives became unusable
Date	Wed, 06 Mar 2024 20:10:02 +0100
Message-ID	<If4Om-eRBG-5@gated-at.bofh.it> (permalink)
References	<IeUOZ-eLxe-1@gated-at.bofh.it>
X-Original-To	debian-user@lists.debian.org
X-Mailbox-Line	From debian-user-request@lists.debian.org Wed Mar 6 19:00:59 2024
Old-Return-Path	<mailinglist@darac.org.uk>
X-Amavis-Spam-Status	No, score=-10.21 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=2, LDO_WHITELIST=-5, PGPSIGNATURE=-5, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
X-Policyd-Weight	using cached result; rate: -4.6
MIME-Version	1.0
User-Agent	Mozilla Thunderbird
Content-Language	en-GB
Content-Type	multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="------------tDu4H1MqKL02SWzN2XAbtFUS"
X-Clacks-Overhead	GNU Terry Pratchett
X-Clacks-Overhead	GNU Stephen Hawking
X-Clacks-Overhead	GNU Nora Bane
X-Mailing-List	<debian-user@lists.debian.org> archive/latest/810045
List-ID	<debian-user.lists.debian.org>
List-URL	<https://lists.debian.org/debian-user/>
List-Archive	https://lists.debian.org/msgid-search/22cae71d-b164-473e-a222-49db085123f7@darac.org.uk
Approved	robomod@news.nic.it
Lines	118
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Date	Wed, 6 Mar 2024 19:00:32 +0000
X-Original-Message-ID	<22cae71d-b164-473e-a222-49db085123f7@darac.org.uk>
X-Original-References	<be13645e-b814-4490-8ad2-b9742d5b719f@aixigo.com>
Xref	csiph.com linux.debian.user:268114

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

On 06/03/2024 08:09, Harald Dunkel wrote:
> Hi folks,
>
> the repositories listed on https://www.debian.org/distrib/archive have
> been signed using expired keys. Unfortunately this page doesn't deal
> with this problem.
>
> Do you think this could be improved?

No, I wouldn't have said so. The packages were signed with keys that 
were valid before they were archived. The archive then provides a 
bit-for-bit copy of what was in the repository at that point in time.

If the keys that signed the packages didn't have an expiry, then there'd 
be an opportunity for someone to update (and validly) sign packages 
retroactively.

The fact that the keys /have/ expired should reassure you that the 
archive hasn't been tampered with.

>
>
> Regards
> Harri
>

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

distribution archives became unusable Harald Dunkel <harald.dunkel@aixigo.com> - 2024-03-06 09:30 +0100
  Re: distribution archives became unusable Darac Marjal <mailinglist@darac.org.uk> - 2024-03-06 20:10 +0100

csiph-web