apt

> Cron has a bunch of this kind of thing built in At least Vixie Cron doesn't support anything like this. Each cron job that needs it has to implement it on its own, e.g.: https://github.com/Debian/apt/blob/2.5.1/debian/apt.apt-comp...

I kind of get why they did it that way (my guess: managing lots of dev keys was problematic, so they used one key to sign a list of "official-seeming" files). But then why wasn't the Release file's contents verified (assuming this doesn't involve generating collisions for those packages)? "The parent process will trust the hashes returned in the injected 201 URI Done response, and compare them with the values from the signed package manifest. Since the attacker controls the reported hashes, they can use this vulnerability to convincingly forge any package." Wtf? This sounds like Apt is just downloading a gpg file and checking if it matches a hash in an HTTP header, and if it does, it just uses whatever is specified, regardless of whether your system already had the right key imported? This makes no sense. Any mirror could return whatever

There is a second part above too: https://github.com/Debian/apt/blob/master/apt-private/privat...

The time-dependent part can be seen here: https://github.com/Debian/apt/blob/master/apt-private/privat...