* apt-pkg/contrib/fileutl.cc:

[apt.git] / doc / apt.conf.5.xml

diff --git a/doc/apt.conf.5.xml b/doc/apt.conf.5.xml
index fe005e0f174ffd5c9d7f55a1a70247b4dcd02379..0cf4bb663d639d17f658b758522736d10ec4e84b 100644 (file)
--- a/doc/apt.conf.5.xml
+++ b/doc/apt.conf.5.xml
@@ -230,6 +230,30 @@ DPkg::Pre-Install-Pkgs {"/usr/sbin/dpkg-preconfigure --apt";};
    and the URI handlers. 
 
    <variablelist>
+     <varlistentry><term>Check-Valid-Until</term>
+        <listitem><para>Security related option defaulting to true as an
+        expiring validation for a Release file prevents longtime replay attacks
+        and can e.g. also help users to identify no longer updated mirrors -
+        but the feature depends on the correctness of the time on the user system.
+        Archive maintainers are encouraged to create Release files with the
+        <literal>Valid-Until</literal> header, but if they don't or a stricter value
+        is volitional the following <literal>Max-ValidTime</literal> option can be used.
+        </para></listitem>
+     </varlistentry>
+
+     <varlistentry><term>Max-ValidTime</term>
+        <listitem><para>Seconds the Release file should be considered valid after
+        it was created. The default is "for ever" (0) if the Release file of the
+        archive doesn't include a <literal>Valid-Until</literal> header.
+        If it does then this date is the default. The date from the Release file or
+        the date specified by the creation time of the Release file
+        (<literal>Date</literal> header) plus the seconds specified with this
+        options are used to check if the validation of a file has expired by using
+        the earlier date of the two. Archive specific settings can be made by
+        appending the label of the archive to the option name.
+        </para></listitem>
+     </varlistentry>
+
      <varlistentry><term>PDiffs</term>
         <listitem><para>Try to download deltas called <literal>PDiffs</literal> for
         Packages or Sources files instead of downloading whole ones. True