summaryrefslogtreecommitdiff
path: root/doc/dpkg-tech.dbk
diff options
context:
space:
mode:
authorDavid Kalnischkies <david@kalnischkies.de>2016-04-29 16:48:16 +0200
committerDavid Kalnischkies <david@kalnischkies.de>2016-05-01 10:50:24 +0200
commit89901946f936446f439b95f1a9a85ac942ac2c92 (patch)
treef74a7cf049fbfbda478c1fdeec05c1a45d552302 /doc/dpkg-tech.dbk
parent46e00c9062d09a642973e83a334483db1f310397 (diff)
support Signed-By in Release files as a sort of HPKP
Users have the option since apt >= 1.1 to enforce that a Release file is signed with specific key(s) either via keyring filename or fingerprints. This commit adds an entry with the same name and value (except that it doesn't accept filenames for obvious reasons) to the Release file so that the repository owner can set a default value for this setting effecting the *next* Release file, not the current one, which provides a functionality similar "HTTP Public Key Pinning". The pinning is in effect as long as the (then old) Release file is considered valid, but it is also ignored if the Release file has no Valid-Until at all.
Diffstat (limited to 'doc/dpkg-tech.dbk')
0 files changed, 0 insertions, 0 deletions