Hi folks,
the repositories listed on https://www.debian.org/distrib/archive have
been signed using expired keys. Unfortunately this page doesn't deal
with this problem.
Do you think this could be improved?
No, I wouldn't have said so. The packages were signed with keys that were valid before they were archived. The archive then provides a bit-for-bit copy of what was in the repository at that point in time.
If the keys that signed the packages didn't have an expiry, then there'd be an opportunity for someone to update (and validly) sign packages retroactively.
The fact that the keys have expired should reassure you
that the archive hasn't been tampered with.
Regards
Harri
Attachment:
OpenPGP_signature.asc
Description: OpenPGP digital signature