On Mon, Mar 27, 2017 at 12:54:18PM +0100, Ian Campbell wrote: > > > One can always use http://snapshot.debian.org/ as one's mirror and > > specify a dated URL that matches the ISO's creation date. > I think (based on the last few paragraphs in the "Usage" section of > that URL) that one would also need to preseed some stuff to cause it to > accept the expired signatures on that repo (with all that implies wrt > security), not sure if/how that can be done in practice though. if accepting expired signatures in this case were made the default, I'd consider this as much worse than the status quo. if there was a question explaining this is dangerous and this question has a "proceed (y/N)" question default to "no" it might be acceptable in my book… -- cheers, Holger
Attachment:
signature.asc
Description: Digital signature