Re: [arch-general] [arch-dev-public] Can we trust our mirrors?

Am So, 30.11.2008, 00:24, schrieb Aaron Griffin:

All we'd need is to patch repo-add to include signature data in the DB. To do this properly, signatures should be uploaded with the package itself, from the packager's machine... hmmm

perhaps i missed something, but wouldn´t be the easiest way to download the db.tar.gz directly from ftp.archlinux.org or another trusted server and the packages from the mirrors? something like a decentralized system. vlad