To prevent downgrade and stale mirror attacks against deb.torproject.org, please use the [Valid-Until](http://blog.ganneff.de/blog/2008/09/23/valid-until-field-in-release-f.html) field. Since you are using reprepro, you can add in your conf/distributions file ``` ValidFor: 2w ``` (Or ValidFor: 4w or 1m.) under every instance of "Label:" or so.