From 89901946f936446f439b95f1a9a85ac942ac2c92 Mon Sep 17 00:00:00 2001 From: David Kalnischkies Date: Fri, 29 Apr 2016 16:48:16 +0200 Subject: support Signed-By in Release files as a sort of HPKP Users have the option since apt >= 1.1 to enforce that a Release file is signed with specific key(s) either via keyring filename or fingerprints. This commit adds an entry with the same name and value (except that it doesn't accept filenames for obvious reasons) to the Release file so that the repository owner can set a default value for this setting effecting the *next* Release file, not the current one, which provides a functionality similar "HTTP Public Key Pinning". The pinning is in effect as long as the (then old) Release file is considered valid, but it is also ignored if the Release file has no Valid-Until at all. --- doc/sources.list.5.xml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'doc/sources.list.5.xml') diff --git a/doc/sources.list.5.xml b/doc/sources.list.5.xml index 07455735f..e8d88921d 100644 --- a/doc/sources.list.5.xml +++ b/doc/sources.list.5.xml @@ -291,8 +291,10 @@ deb-src [ option1=value1 option2=value2 ] uri suite [component1] [component2] [. (see apt-key fingerprint). If the option is set, only the key(s) in this keyring or only the keys with these fingerprints are used for the &apt-secure; verification of this - repository. Otherwise all keys in the trusted keyrings are - considered valid signers for this repository. + repository. Defaults to the value of the option with the same name + if set in the previously acquired Release file. + Otherwise all keys in the trusted keyrings are considered valid + signers for this repository. () -- cgit v1.2.3