updating from such a repository can t be done securely