diff options
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/apt-get.8.xml | 10 | ||||
| -rw-r--r-- | doc/apt.conf.5.xml | 8 | ||||
| -rw-r--r-- | doc/sources.list.5.xml | 55 |
3 files changed, 58 insertions, 15 deletions
diff --git a/doc/apt-get.8.xml b/doc/apt-get.8.xml index 5b6788ed4..b0fe390df 100644 --- a/doc/apt-get.8.xml +++ b/doc/apt-get.8.xml @@ -531,9 +531,13 @@ </varlistentry> <varlistentry><term><option>--allow-unauthenticated</option></term> - <listitem><para>Ignore if packages can't be authenticated and don't prompt about it. - This is useful for tools like pbuilder. - Configuration Item: <literal>APT::Get::AllowUnauthenticated</literal>.</para></listitem> + <listitem><para>Ignore if packages can't be authenticated and don't prompt + about it. This can be useful while working with local repositories, + but is a huge security risk if data authenticity isn't ensured in + another way by the user itself. The usage of the + <option>Trusted</option> option for &sources-list; entries should + usually be preferred over this global override. Configuration Item: + <literal>APT::Get::AllowUnauthenticated</literal>.</para></listitem> </varlistentry> <varlistentry><term><option>--no-allow-insecure-repositories</option></term> diff --git a/doc/apt.conf.5.xml b/doc/apt.conf.5.xml index 7d5f7e9b3..103d0622c 100644 --- a/doc/apt.conf.5.xml +++ b/doc/apt.conf.5.xml @@ -301,6 +301,8 @@ DPkg::Pre-Install-Pkgs {"/usr/sbin/dpkg-preconfigure --apt";}; <literal>Valid-Until</literal> header, but if they don't or a stricter value is desired the <literal>Max-ValidTime</literal> option below can be used. + The <option>Check-Valid-Until</option> option of &sources-list; entries should be + preferred to disable the check selectively instead of using this global override. </para></listitem> </varlistentry> @@ -312,7 +314,8 @@ DPkg::Pre-Install-Pkgs {"/usr/sbin/dpkg-preconfigure --apt";}; the earlier date of the two is used as the expiration date. The default value is <literal>0</literal> which stands for "valid forever". Archive specific settings can be made by appending the label of the archive - to the option name. + to the option name. Preferably, the same can be achieved for specific + &sources-list; entries by using the <option>Valid-Until-Max</option> option there. </para></listitem> </varlistentry> @@ -324,7 +327,8 @@ DPkg::Pre-Install-Pkgs {"/usr/sbin/dpkg-preconfigure --apt";}; frequently updated archive with a <literal>Valid-Until</literal> header instead of completely disabling the expiration date checking. Archive specific settings can and should be used by appending the label of - the archive to the option name. + the archive to the option name. Preferably, the same can be achieved for specific + &sources-list; entries by using the <option>Valid-Until-Min</option> option there. </para></listitem> </varlistentry> diff --git a/doc/sources.list.5.xml b/doc/sources.list.5.xml index f87dcda23..aded8ecef 100644 --- a/doc/sources.list.5.xml +++ b/doc/sources.list.5.xml @@ -202,26 +202,26 @@ deb-src [ option1=value1 option2=value2 ] uri suite [component1] [component2] [. APT versions. <itemizedlist> - <listitem><para><literal>Architectures</literal> - (<literal>arch</literal>) is a multivalue option defining for + <listitem><para><option>Architectures</option> + (<option>arch</option>) is a multivalue option defining for which architectures information should be downloaded. If this option isn't set the default is all architectures as defined by - the <literal>APT::Architectures</literal> config option. + the <option>APT::Architectures</option> config option. </para></listitem> - <listitem><para><literal>Languages</literal> - (<literal>lang</literal>) is a multivalue option defining for + <listitem><para><option>Languages</option> + (<option>lang</option>) is a multivalue option defining for which languages information like translated package descriptions should be downloaded. If this option isn't set the default is all languages as defined by the - <literal>Acquire::Languages</literal> config option. + <option>Acquire::Languages</option> config option. </para></listitem> - <listitem><para><literal>Targets</literal> - (<literal>target</literal>) is a multivalue option defining + <listitem><para><option>Targets</option> + (<option>target</option>) is a multivalue option defining which download targets apt will try to acquire from this source. If not specified, the default set is defined by the - <literal>APT::Acquire::Targets</literal> configuration scope. + <option>APT::Acquire::Targets</option> configuration scope. </para></listitem> </itemizedlist> @@ -232,7 +232,7 @@ deb-src [ option1=value1 option2=value2 ] uri suite [component1] [component2] [. anomalies. <itemizedlist> - <listitem><para><literal>Trusted</literal> (<literal>trusted</literal>) + <listitem><para><option>Trusted</option> (<option>trusted</option>) is a tri-state value which defaults to APT deciding if a source is considered trusted or if warnings should be raised before e.g. packages are installed from this source. This option can be used @@ -245,6 +245,41 @@ deb-src [ option1=value1 option2=value2 ] uri suite [component1] [component2] [. as untrusted even if the authentication checks passed successfully. The default value can't be set explicitly. </para></listitem> + + <listitem><para><option>Check-Valid-Until</option> (<option>check-valid-until</option>) + is a yes/no value which controls if APT should try to detect + replay attacks. A repository creator can declare until then the + data provided in the repository should be considered valid and + if this time is reached, but no new data is provided the data + is considered expired and an error is raised. Beside + increasing security as a malicious attacker can't sent old data + forever denying a user to be able to upgrade to a new version, + this also helps users identify mirrors which are no longer + updated. Some repositories like historic archives aren't + updated anymore by design through, so this check can be + disabled by setting this option to <literal>no</literal>. + Defaults to the value of configuration option + <option>Acquire::Check-Valid-Until</option> which itself + defaults to <literal>yes</literal>. + </para></listitem> + + <listitem><para><option>Valid-Until-Min</option> + (<option>check-valid-min</option>) and + <option>Valid-Until-Max</option> + (<option>valid-until-max</option>) can be used to raise or + lower the time period in seconds in which the data from this + repository is considered valid. -Max can be especially useful + if the repository provides no Valid-Until field on its Release + file to set your own value, while -Min can be used to increase + the valid time on seldomly updated (local) mirrors of a more + frequently updated but less accessible archive (which is in the + sources.list as well) instead of disabling the check entirely. + Default to the value of the configuration options + <option>Acquire::Min-ValidTime</option> and + <option>Acquire::Max-ValidTime</option> which are both unset by + default. + </para></listitem> + </itemizedlist> </para> |