[arch-general] Integrating Virus Scanning for Packages Handled by Pacman (Mark Lee)

[Martti Kühne]

No.

There is package signing now. You already verify that the guy who put
his package on the repo is the guy you trust as your binary source.
How do you know? Because you could build the exact same binary with an
archlinux source package and current devtools. The unholy mess gcc is
is entrusted with encoding our sources to machine executable format,
and how do you know you can trust it? You can't.
To say it with XKCD, there is no point in forcing teachers to wear a
condom in class, and there's no point in adding virus protection to
arch's repos.

Really, no.

cheers!
mar77i