Skip to content

Fix expired Valid-Until bypass missing on second apt-get update in builder-buster #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hsbt merged 2 commits into from
Mar 4, 2026
Merged

Fix expired Valid-Until bypass missing on second apt-get update in builder-buster #24

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1e1debd
Initial plan
Copilot Mar 4, 2026
ffe5738
Fix missing Check-Valid-Until=false on second apt-get update in build…
Copilot Mar 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ RUN dpkg --add-architecture i386 \
&& echo "deb-src http://archive.debian.org/debian/ buster main" > /etc/apt/sources.list.d/deb-src.list \
&& echo 'Dpkg::Use-Pty "0";\nquiet "2";\nAPT::Install-Recommends "0";' > /etc/apt/apt.conf.d/99autopilot \
&& echo 'Acquire::HTTP::No-Cache "True";' > /etc/apt/apt.conf.d/99no-cache \
&& apt-get update \
&& apt-get update -o Acquire::Check-Valid-Until=false \
Copy link

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Disabling APT’s Valid-Until check via -o Acquire::Check-Valid-Until=false weakens the repository freshness guarantee and enables replay/freeze attacks on package metadata. A network attacker who can intercept HTTP traffic to the Debian archive can replay an older, still-signed Release file and package index, causing your build to pull stale or more vulnerable package versions than intended. Consider avoiding this override if possible (e.g., by using a maintained base image, pinned snapshot, or other mechanism) so that APT continues enforcing metadata expiration.

Copilot uses AI. Check for mistakes.
&& apt-get install \
build-essential \
gcc-multilib \
Expand Down