[tor-bugs] #9810 [Tor Sysadmin Team]: use Valid-Until field to prevent downgrade attacks for deb.torproject.org

["Tor Bug Tracker & Wiki" <blackhole@xxxxxxxxxxxxxx>]

#9810: use Valid-Until field to prevent downgrade attacks for deb.torproject.org
-------------------------------+------------------------
 Reporter:  proper             |          Owner:  weasel
     Type:  defect             |         Status:  new
 Priority:  normal             |      Milestone:
Component:  Tor Sysadmin Team  |        Version:
 Keywords:                     |  Actual Points:
Parent ID:                     |         Points:
-------------------------------+------------------------
 To prevent downgrade and stale mirror attacks against deb.torproject.org,
 please use the [http://blog.ganneff.de/blog/2008/09/23/valid-until-field-
 in-release-f.html Valid-Until] field.

 Since you are using reprepro, you can add in your conf/distributions file

 {{{
 ValidFor: 2w
 }}}

 (Or ValidFor: 4w or 1m.) under every instance of "Label:" or so.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9810>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs