Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #268083 > unrolled thread

distribution archives became unusable

Back to article view | Back to linux.debian.user

Contents

  distribution archives became unusable Harald Dunkel <harald.dunkel@aixigo.com> - 2024-03-06 09:30 +0100
    Re: distribution archives became unusable Darac Marjal <mailinglist@darac.org.uk> - 2024-03-06 20:10 +0100

#268083 — distribution archives became unusable

Hi folks,

the repositories listed on https://www.debian.org/distrib/archive have
been signed using expired keys. Unfortunately this page doesn't deal
with this problem.

Do you think this could be improved?


Regards
Harri

[toc] | [next] | [standalone]

#268114

[Multipart message — attachments visible in raw view] — view raw

On 06/03/2024 08:09, Harald Dunkel wrote:
> Hi folks,
>
> the repositories listed on https://www.debian.org/distrib/archive have
> been signed using expired keys. Unfortunately this page doesn't deal
> with this problem.
>
> Do you think this could be improved?

No, I wouldn't have said so. The packages were signed with keys that 
were valid before they were archived. The archive then provides a 
bit-for-bit copy of what was in the repository at that point in time.

If the keys that signed the packages didn't have an expiry, then there'd 
be an opportunity for someone to update (and validly) sign packages 
retroactively.

The fact that the keys /have/ expired should reassure you that the 
archive hasn't been tampered with.

>
>
> Regards
> Harri
>

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web