Hi, obligatory: https://knowyourmeme.com/sensitive/memes/we-need-to-go-deeper
Quoting Johannes Schauer Marin Rodrigues (2026-10-07 15:54:12) > Indeed it seems more is needed with modern versions of apt. In addition to > what the mmdebstrap man page says, these days you also must convince apt that > SHA1 is fine: > > --aptopt='APT::Hashes::SHA1::Weak "yes"' > > I have the man page adjusted accordingly in git. If you do this, you can go > back as far as 2009-05-23T21:38:52Z. If you try to go further back you get: > > W: > https://snapshot.debian.org/archive/debian/20090523T161634Z/dists/unstable/Release.gpg: > Signature by key A99951DAF9BB569BDB50AD90A70DAF536070D3A1 uses weak > algorithm (SHA1) > W: Signature verification failed: > https://snapshot.debian.org/archive/debian/20090523T161634Z unstable Release: > The following signatures were invalid: > A99951DAF9BB569BDB50AD90A70DAF536070D3A1 (untrusted public key algorithm: > dsa1024) > > I did not manage to find out how to convince apt that dsa1024 is okay. Maybe > it's impossible with modern apt. with the help of DonKult I managed to go another three years back to 2006-08-04. I updated the mmdebstrap man page with what is necessary to do so. Here is the current version: > Example: Create a chroot for Debian unstable from back in "2006-08-04" using > snapshot.debian.org. Snapshots before that are broken as the file sizes and > hashes recorded in the Release and Packages file do not match the files they > reference. > > $ mmdebstrap --arch=i386 --variant=minbase unstable /dev/null --aptopt \ > 'Apt::Key::gpgvcommand "/usr/libexec/mmdebstrap/gpgvnoexpkeysig"' \ > --aptopt='APT::Key::Assert-Pubkey-Algo "dsa1024,rsa4096"' \ > --aptopt='Acquire::AllowWeakRepositories "true"' \ > --aptopt='APT::Get::AllowUnauthenticated "true"' \ > --aptopt='APT::Hashes::SHA1::Weak "yes"' \ > --aptopt='DPkg::NoTriggers "false"' \ > --aptopt='Acquire::Check-Valid-Until "false"' \ > --aptopt='APT::Snapshot "20060804T000000Z"' \ > --keyring=/usr/share/keyrings/debian-archive-removed-keys.gpg \ > --hook-dir=/usr/share/mmdebstrap/hooks/maybe-jessie-or-older > > The "gpgvnoexpkeysig" script requires the gpgv utility and is no longer re‐ > quired for snapshots of Debian unstable of "2013-10-12T16:01:00Z" and newer. > Passing the "APT::Key::Assert-Pubkey-Algo" option is required for timestamps > before "2009-05-23T21:38:52Z" and can also be just the empty string. The > "DPkg::NoTriggers" option is necessary for Debian unstable timestamps before > "2008-04-10" with variants other than essential or otherwise apt errors out > with "dpkg: unknown option --no-triggers". The > "Acquire::AllowWeakRepositories" > and "APT::Get::AllowUnauthenticated" options are required to go back further > than "2006-08-10". Thanks! cheers, josch
signature.asc
Description: signature
