• ZeSystem@programming.devOP
    link
    fedilink
    arrow-up
    1
    arrow-down
    1
    ·
    4 days ago

    It’s open source. Anyone can audit it. You can create your own sources.list, but if you distribute it, you must open the code. Also, “wid info <package_name>” shows the exact URL it downloads from. Example: wid info llvm shows the official GitHub release link.

    • CameronDev@programming.dev
      link
      fedilink
      arrow-up
      4
      ·
      4 days ago

      Thats how it works in theory, but in practice it comes down to trust more than anything else.

      Its more effort to read and validate your list than it is to just go and download the installer directly. So you need people to trust you.

      • ZeSystem@programming.devOP
        link
        fedilink
        arrow-up
        1
        ·
        4 days ago

        You’re absolutely right. Trust is the real challenge, and I’m just starting to earn it. That’s why I keep everything open and plan to add checksum verification. I know it takes time. I’m in it for the long run.