summaryrefslogtreecommitdiff
path: root/debian/NEWS
diff options
context:
space:
mode:
authorJulian Andres Klode <julian.klode@canonical.com>2018-01-29 16:15:41 +0100
committerJulian Andres Klode <julian.klode@canonical.com>2018-02-19 16:05:01 +0100
commit9e5899cac1a6367e3769af52a724821880e538f6 (patch)
tree4c7add81aeb5f851ce764697b03e3778391f9cbc /debian/NEWS
parent38d444af2632219ab399dabadaaefaa4dcdd6ebf (diff)
Check that Date of Release file is not in the future
By restricting the Date field to be in the past, an attacker cannot just create a repository from the future that would be accepted as a valid update for a repository. This check can be disabled by Acquire::Check-Date set to false. This will also disable Check-Valid-Until and any future date related checking, if any - the option means: "my computers date cannot be trusted." Modify the tests to allow repositories to be up to 10 hours in the future, so we can keep using hours there to simulate time changes.
Diffstat (limited to 'debian/NEWS')
-rw-r--r--debian/NEWS16
1 files changed, 16 insertions, 0 deletions
diff --git a/debian/NEWS b/debian/NEWS
index 132920b5d..a8cd8f7ad 100644
--- a/debian/NEWS
+++ b/debian/NEWS
@@ -1,3 +1,19 @@
+apt (1.6~alpha8) UNRELEASED; urgency=medium
+
+ APT now verifies that the date of Release files is not in the future. By
+ default, it may be 10 seconds in the future to allow for some clock drift.
+
+ Two new configuration options can be used to tweak the behavior:
+ Acquire::Check-Date
+ Acquire::Max-DateFuture
+
+ These can be overridden in sources.list entries using the check-date
+ and date-future-max options. Note that disabling check-date also
+ disables checks on valid-until: It is considered to mean that your
+ machine's time is not reliable.
+
+ -- Julian Andres Klode <juliank@ubuntu.com> Mon, 12 Feb 2018 12:53:18 +0100
+
apt (1.6~alpha1) unstable; urgency=medium
All methods provided by apt except for cdrom, gpgv, and rsh now