Unfortunately I have found out about Arch not signing its packages afterwards. I had just expected that this feature would be featured by any modern Linux distro.

Not signing packages is definitely not acceptable for any distro, neither source nor binary ones.

If this is not going to be implemented in the near future I will have to leave Arch because I cannot live with this kind of bad conscience for a long time.

In the comments above there are some people complaining about sigs with very dump arguments. It seems to me that are quite many people without much knowledge about security and cryptography. If you need help implementing this, feel free to ask for certain support by e-mail. I am not the best programmer (as I had few time to relearn programming after switching from Windows to Linux) but I do know the underlying crypto techniques and general stuff.

Please implement this, everything could be so perfect!

1) Signed packages provide more security over non-signed. That’s a matematical and logical fact.

2) It is much harder to break into specific server and change keys (while planting malware onto a mirror), than to break into any of the many mirrors and plant malware, without having to break into specific server and hijack keys.

3) Trusting a signature that _may_ be hacked one day is not lowering any security of having no signature to begin with (see point 1).

4) Frequency, or absence thereof, of planted malware attacks in the past is not an argument. One time is enough to make serious damage, if only to one server or desktop. Do you want that one computer to be _yours_? I don’t.

Absence of known attacks does not mean there is no interest, it could mean ( and probably does) that the systems are secure enough to be (extremely) difficult to hack into.

5) Systems can be employed (ala snort) that monitor for any intrusion. This in fact leaves the majority of trust, then, into the admin who uploads keys manually. Hacking such a system is exponentially more difficult.

6) Subtle “attacks”, ie. planting backdoors silently, is more evil and more profitable than overt attack that might be discovered immediately. Short of building your packages from source (that you went through to see if the code is allright, there is no certainty that existing packages are not already infected by a backdoor or whatever.

6a) If I wanted to build my OS from source, I’d go Gentoo.

7) as Linux makes its way onto the Desktop you can rest assured more of such attacks will be attempted.