In a Debian format repository, Valid-Until sets when the signed Release metadata expires, and Signed-By lists the key fingerprints future Release files must be signed with. Used together, they limit stale metadata replay and pin your signing key. The Signed-By field is ignored if Valid-Until is absent or expired.
Definitions
Apt reads an InRelease file, which is signed inline, or a Release file with a detached Release.gpg signature, from the dists directory for the distribution. The Release file lists index files with hashes. Servers should provide InRelease, and the format page lists required keys such as Suite or Codename, Architectures, Components, Date and SHA256.
Two optional fields matter for security.
| Field | What it does |
|---|---|
| Valid-Until | Date after which the Release file should no longer be trusted |
| Signed-By | Comma separated list of OpenPGP key fingerprints used to validate the next Release file |
For Signed-By, fingerprints are hex digits only, with no spaces. The fingerprint names either the key that must sign the file or the key the signing key must be a subkey of. Appending an exclamation mark disables the subkey match. If the field is present, a client should accept future updates only if signed with listed keys.
Compatibility to check
The format page says Signed-By arrived in APT 1.3 and required the exact signing key, including a subkey fingerprint if a subkey signs. APT 1.8 added automatic subkey support and the exclamation mark syntax. APT before 1.8 will choke on that syntax, so avoid it until your customers run recent clients.
Why Valid-Until helps
Without an expiry, an attacker who can serve files from a mirror can replay an old signed Release file that predates a security fix. With Valid-Until, a client has a reason to reject it. The tradeoff is that you must re-sign on a schedule. If your signing job stops, customers see errors when the date passes.
Steps
- Generate the Release file with the required fields and a Valid-Until date a few days to weeks ahead.
- Sign it, producing InRelease and, for older clients, Release and Release.gpg.
- Re-sign on a schedule shorter than the validity window, and alert if the job fails.
- Add Signed-By with your key fingerprint once you know your customer clients support it.
- Document the keyring setup using the signed-by option in the source list, as in signed-by instead of apt-key.
Trade-offs for air-gapped customers
A mirror that is frozen for months will see Valid-Until pass. Tell offline customers how often to refresh, or offer a longer window for a separate repository intended for them.
If you want a second look at what you ship, Safeguard can generate and scan an SBOM and run dependency scanning with reachability analysis, and you can try the free scan.
Quick check
Does Signed-By work without Valid-Until?
The format page says the field should be ignored if Valid-Until is not present or has expired.
What happens if my signing job stops?
Once Valid-Until passes, clients that honor it will refuse the metadata. Monitor the job.
Sources
Last reviewed: 19 October 2026.
