Sorry, allow me to be a bit more clear with the wording here: On 11/11/26 7:55 PM, monodev wrote: > So upgrading with Acquire::Retries=0 is not a necessity for new > installs. It is a necessity for any install that has not upgraded its > ca-certificates prior to upgrading apt. For any install that has > upgraded its ca-certificates prior to apt, both Acquire::Retries=0 and > using HTTPS are valid mitigations. So upgrading with Acquire::Retries=0 is not a necessity for new installs. It is a necessity for any install that has not upgraded its ca-certificates prior to the disclosure of CVE-2026-109518. For any install that has upgraded its ca-certificates prior to the disclosure of CVE-2026-109518, both Acquire::Retries=0 and using HTTPS are valid mitigations.
- monodev
