I run a tails mirror on one of my VMs. Earlier this week there was a flurry of anxious comment on the tails forum suggesting that the service had been “hacked”. Evidence pleaded in support of that theory included the facts that file timestamps on some of the tails files varied across mirrors, one of the mirrors resolved to a Pirate Bay mirror, and the tails signing key had apparently changed.
Well, none of that is necessarily proof of hostile behaviour. In fact, good old cock-up wins out over conspiracy again. As can be seen from the tails admin comment over at the forum, human error (followed by panic reaction) is to blame.
I hold my hand up to a mistake which contributed to the problem. My rsync to the tails repository omitted the “-t” switch which would have preserved file modification times. In mitigation, I plead stupidity (and the fact that the tails mirror documentation also omitted that switch…..).
Now fixed.