Re: Bug#664654: apt-offline: gpg signature verification is failing

[Ritesh Raj Sarraf <rrs@debian.org>]

On Thursday 29 March 2012 07:33 PM, Ritesh Raj Sarraf wrote:

Somewhere down during the development, apt has changed the way it verifies the gpg signatures.

For apt-offline, up till now, I had been using the Release.gpg files. Could someone explain what the new approach is? Or if it is documented, I can try that.
I see no Release.gpg files in apt/lists/partial/ anymore.

I've looked at http://wiki.debian.org/SecureApt but didn't find any new information.

Further investigation shows that `apt-get --print-uris` no more prints urls for the Release file. Now, there's a newer file, InRelease.
I checked the web archives and Release{.gpg} files are still present. Is there any documentation on how do I interpret InRelease files?


Please CC me in replies. I am not subscribed to this list.

-- 
Ritesh Raj Sarraf | http://people.debian.org/~rrs
Debian - The Universal Operating System

Attachment: signature.asc
Description: OpenPGP digital signature