Comment 1 for bug 804252

Revision history for this message
Colin Watson (cjwatson) wrote :

E-mail consensus appears to be:

 * It is quite possibly not safe to deploy anything that generates inline signatures with the primary archive key until we no longer support Ubuntu 11.04, which was vulnerable to bug 784473 at release time (since attacks using the clearsigned material would be possible against users who have performed a fresh install and are in the process of upgrading).
 * We should audit to make sure there are no other similar vulnerabilities in Ubuntu 11.10.

Thus, although I've written the code, we'll need to defer deploying this for the time being.