Refering to this issue, on Ubuntu 20.04, I know I could add a flag --allow-releaseinfo-change update to fix the issue when doing apt-get update but what would the cons be by using this flag? What would be the implication going forward? Does it introduce any security issue going forward?
1 Answers
Potentially - "Yes, it does add a risk."
This is evident from reading the documentation on the --allow-releaseinfo-change option in man apt-get. Specifically, man apt-secure describes and discusses its role in ensuring the integrity of the archives from which updates & upgrades are drawn. This risk applies to both signed and unsigned repositories.
The documentation further suggests that this risk may be mitigated through the use of speciality options that limit acceptable changes to certain fields (labels) in the repo; for example, suite. See the documentation for all the details.
Related