Bug#545905: pbuilder uses debootstrap in a potentially insecure way

Wed Sep 9 21:14:30 UTC 2009

Package: pbuilder
Version: 0.189
Severity: important
Tags: security

Hi.

debootstrap (unlike cdebootstrap IIRC) does not check signatures on  
any packages per default, but only when the "--keyring" option is used.

This

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.