Comment 1 for bug 255545

I may be slightly naive here (having not looked into the code yet), but can we not have apt-cdrom reuse the apt-get codepath to "unpack Packages.{bz2,gz} to /var/lib/apt" and then use the results for the Release file verification?

One could, of course, make the above conditional on the CD not having uncompressed Packages files, if you want to avoid populating /var/lib/apt and wasting local disk space when the CD *does* have those files.