Re: Pre-approval for apt 0.7.21: 'Valid-Until' feature and proxy changes
I've removed some CC's.
On Mon, January 19, 2009 12:47, Eugene V. Lyubimkin wrote:
> 1) insert apt-transport-https and all its deps into base system (libcurl,
> kerberos etc.)
I'm not sure if we need kerberos for this to work. Just like apt uses a
small version of gnupg to verify signatures, we can use a small version of
the https transport that satisfies our needs?
> 2) Release and Release.gpg, installed on
> security.debian.org, should be somehow synchronized with at least all
> official Debian mirrors, I don't know how hard it would be to insert this
> move into archive infrastructure (ftp masters CC'ed)
> 3) needs some hardcoded black magic in APT - if user has an entry
I think it's essential to note that the scheme is in principle only
required for the security mirrors, because the attack scenario is based on
withholding security updates. As we fully control the security mirrors, I
think we need not consider mirrors to solve the problem adequately, and
have a reliable way to know which sources.list entry it applies to.
cheers,
Thijs
Reply to: