waider waiderwaiderie brendan kehoe wrote workaround various distributions could use gpg singature verify correctness file since distributors secret key required create signature would add pretty significant step would taken make possible replace rpm apt file accompanying signature check local friendly red hat installation rootlocalhost up2date rpm checksig zsh4022srcrpm zsh4022srcrpm md5 gpg ok course useful say gpg keys distributed kernel tarballs ie dont actually bother checking sig open abuse entirely possible rpm configured require good signatures ive read part fine manual yet cheers waider waiderwaiderie yes personal irish linux users group iluglinuxie httpwwwlinuxiemailmanlistinfoilug unsubscription information list maintainer listmasterlinuxie tue 08 oct 2002 122334 0200 ilug packaging risks reputation linux distributions