update: Add notice about missing Signed-By in deb822 sources

We want to gently steer users towards having Signed-By for each
source such that we can retire a shared keyring across sources
which improves resilience against configuration issues and
incompetent malicious actors.

1 files changed, 2 insertions, 0 deletions

diff --git a/apt-pkg/sourcelist.cc b/apt-pkg/sourcelist.cc
index 055cf4142..e11afceed 100644
--- a/apt-pkg/sourcelist.cc
+++ b/apt-pkg/sourcelist.cc
@@ -143,6 +143,8 @@ bool pkgSourceList::Type::ParseStanza(vector<metaIndex *> &List,	/*{{{*/
       Options["sourceslist-entry"] = entry;
    }
 
+   Options["sourceslist-entry-is-deb822"] = "true";
+
    // now create one item per suite/section
    auto const list_uris = FindMultiValue(Tags, "URIs");
    auto const list_comp = FindMultiValue(Tags, "Components");