[ubuntu-hardened] Updates: re-synchronize the package index files via HTTP protocol.

[Marc Deslauriers]

On 13-11-01 11:53 AM, Seth Arnold wrote:
> On Fri, Nov 01, 2013 at 02:46:12PM +0100, Daniel Curtis wrote:
<snip>

> There is one weakness with the current APT mechanism -- a mirror site may
> stop updating, and offer only old and known-broken packages to clients.
> There is no easy way to fix this except requiring every client to connect
> to an Ubuntu-controlled machine periodically, but the steps involved in
> getting that correct would be substantial. (It might still be worthwhile.)
> 

There is functionality in apt to respect a "Valid-Until" tag in the Release
file, but we have not implemented that since a malicious mirror could simply use
the Release file for a previous Ubuntu release and prevent updates from being
installed.

Marc.