[apt-build-devel] Bug#659015: apt-build disables apt's signature verification

[apt-build development list]

Hi Ansgar,

Axel Beckert wrote:
> Ansgar Burchardt wrote:
> > apt-build unconditionally passes -o Apt::Get::AllowUnauthenticated=true
> > to apt-get, that is it disables *all* signature checks allowing MitM
> > attacks to serve malicious data.
> 
> Thanks for the heads up. I'll have a look into it and will publish my
> proposed QA upload for review as git repo somewhere on Alioth, maybe
> collab-maint.

My proposed fix is at
https://anonscm.debian.org/cgit/users/abe/proposed-qa/apt-build.git/commit/?h=jessie&id=ca2653a8

I've though observed two possibly minor issues with it:

* An existing /etc/apt/sources.list.d/apt-build.list is not updated to
  add "[trusted=yes]".

* Upon purge and (re)installation, I had the "deb" line twice in
  /etc/apt/sources.list.d/apt-build.list and it's not clear to me why.

I've not yet done much testing, so any feedback is welcome. I'll
definitely do some more testing before uploading that fix.

		Regards, Axel
-- 
 ,''`.  |  Axel Beckert <abe at debian.org>, http://people.debian.org/~abe/
: :' :  |  Debian Developer, ftp.ch.debian.org Admin
`. `'   |  4096R: 2517 B724 C5F6 CA99 5329  6E61 2FF9 CD59 6126 16B5
  `-    |  1024D: F067 EA27 26B9 C3FC 1486  202E C09E 1D89 9593 0EDE