On Tue, Nov 10, 2026 at 12:40:07AM +0700, Max Nikulin wrote: > On 07/11/2026 7:09 pm, Andrew M.A. Cater wrote: > > On Sat, Nov 07, 2026 at 10:23:44AM +0000, Elven Inquisition wrote: > > > > > > Why was there no new ISO released following the cert compromise? Why is > > > there > > > still no installation media now, following the fix of this critical APT > > > vuln? > > > > You do realise that your network install from any existing .iso file > > will do the updates immediately before you even have the first reboot? > > Isn't getting updates the moment when the new system may be compromised if > an attacker may act as a MITM (unless the user adjusts APT configuration)? > GPG signature verification may be bypassed in default configuration. > Switching to a HTTPS mirror requires removing of weak TLS certificates, so > Acquire::Retries=0 looks like an easier workaround. >
Assume an attacker can put in a MITM - for example, bypassing deb.debian.org (compromising all of Cloudflare, for example). That attacker also has to regenerate all GPG signatures on the archive, and sign hashes and sizes accordingly. That takes it to the territory where you're likely to need a nation state or *very* signficant Debian compromise which vitiates the whole project. Given that the updated apt is installed at pretty much the earliest point, along with any other security updates - and this will work equally even for older .iso files that you may choose to use to bootstrap the install. Dodgy packages, non-matching signatures / mismatches in hashes and file sizes are all flagged up when apt installs packages - as you'll find out if there's an interruption in rsync or whatever. I hope this will reassure anyone. https://lists.debian.org/deity/2026/11/msg00005.html refers This is not an absolute guarantee but nothing is. > > if you *really* want new .iso images, you can wait for approximately > > two weeks from now and 13.8 software and images hsould be released > > on November 21st. > > The specified date is not bad (at least in comparison to some other > projects). My impression that the issues are rather ugly. Perhaps users > should be warned more loudly and the notice should include workarounds. > > > > [2]: https://ubuntu.com/blog/apt-vulnerability-fixes-available > > > [3]: https://security-tracker.debian.org/tracker/CVE-2026-109518 > Again - the point release wrapping up updates to this coming Friday 13th will be released on November 21st. Point releases have a regular schedule - the gang and I will be in Cambridge in approximately eleven days time. Nothing much to see here - the original release date scheduled for *next* week was put back by a week so that the release managers didn't have to rush things during the recent mini-DebConf which has just finished. Hope this helps somebody Andy Cater ([email protected])
