3 ms·
They cover this - timestamps are embedded in the packages, and also signed. If they're too old it won't update and you'll know something is amiss.
by philjohn 8y ago
They cover this - timestamps are embedded in the packages, and also signed. If they're too old it won't update and you'll know something is amiss.
- na412 8y agoMore precisely, an expiration timestamp is embedded in the repository metadata. Packages in debian and derivatives are not signed. Instead, the manifest that lists all the available packages and their checksums is signed. That's also where the expiration data is stored.
- JdeBP 8y agoEven more precisely still, not even the lists of packages are signed. Only InRelease and Release are signed, and they only contain the list of Package files. It's FreeBSD that has the approach of just one signed file containing everything. APT has moved closer to it over the years, but it is not there yet. * https://unix.stackexchange.com/a/332441/5132 https://unix.stackexchange.com/a/332441/5132