Re: Packages and signatures
On Sat, Jan 27, 2001 at 03:19:36PM -0600, JP Sugarbroad wrote:
> On Sat, Jan 27, 2001 at 02:41:54AM -0500, Matt Zimmerman wrote:
> > Also, once the key is revoked, older packages (e.g., from previous releases)
> > signed by that key can no longer be verified.
>
> They can be verified... you just get a warning about their being signed
> with a revoked key.
What I meant was that they can no longer be _trusted_, as the key has been
compromised.
The Debian archive should be as secure as the current state of the systems
running it. All packages everywhere would be at the mercy of a key compromise
that had occurred at any point in time.
--
- mdz
Reply to: