until pacman version 4.0.0 arch linux's package manager lacked support for signed packages. packages and metadata were not verified for authenticity by pacman during the download-install process. without package authentication checking, tampered-with or malicious repository mirrors could compromise the integrity of a system. pacman 4 allowed verification of the package database and packages, but it was disabled by default. in november 2011 package signing became mandatory for new package builds, and as of 21 march 2012 every official package is signed.