Re: CVE for Kali Linux

[Solar Designer <solar () openwall com>]

On Sun, Mar 22, 2015 at 04:48:51PM -0700, Russ Allbery wrote:
> Alexander Cherepanov <ch3root () openwall com> writes:
>
> > There are some attacks even if you verify signatures, e.g. serving old,
> > known-vulnerable versions. HTTPS can help here (until signatures start
> > to be widely accompanied by expiring timestamps or something).
>
> Debian is indeed moving in exactly that direction, using the Valid-Until
> attribute of the archive metadata.  This currently isn't (yet?) enabled
> for the main stable archive, but is for the unstable and testing archives,
> the security archive, and the backports archive.

How do you handle the case when a given package build remains the
recommended version in its branch beyond the signature's initial
Valid-Until date?  Do you issue a new signature for it?

Alexander