Skip to content

Draft: Remove the Debian distribution endpoints with detached signature

Mathieu Parent requested to merge sathieu/gitlab:debian_inrelease_only into master

What does this MR do?

We have 3 endpoints:

  • Release: plain (unsigned)
  • Release.gpg: detached signature
  • InRelease: inline signed

InRelease is the most used endpoint, the two others are for older* clients.

* By older, I mean:

  • apt (0.9.7.9~exp2) (released 03 Apr 2013) has re-enable InRelease by default (from changelog)
  • 0.9.8 was released in May 2013
  • Debian 7 wheezy, which was ELTS until June 2020, is the last release without support
  • Debian 8 jessie, which is still ELTS until June 2022, is the first release with support

Screenshots (strongly suggested)

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

Does this MR contain changes to processing or storing of credentials or tokens, authorization and authentication methods or other items described in the security review guidelines? If not, then delete this Security section.

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by Mathieu Parent

Merge request reports