Re: The Difference between debcheckout and dgit and what they try to accomplish
Russ Allbery writes:
> Colin Watson writes:
>> Is it at all likely that the ftpmaster api service might migrate away
>> from Let's Encrypt at this point? I would assume probably not. In that
>> case, you could at least make the situation substantially better with no
>> further DSA work required by pinning the appropriate LE root certificate
>> in dgit.
>
> debian.org already publishes a CAA record, which conveys that information
> (although has its own verification concerns, but I think debian.org is
> using DNSSEC so you can verify the record that way). It says that all
> debian.org hosts will only use certificates from either LE or Amazon:
The CAA record does not indicate a future commitment and could change at
any time. If you want to rely on debian.org to use some specific CAs,
you would have to ask DSA.
(Nor does the CAA record indicate that all currently valid certificates
must come from the listed CAs; the CAA record could have been different
when those were issued.)
Ansgar
Reply to: