> Maybe it could check the signature everytime one downloads the bundle? Yes, that's probably the direction we're going to go. > So downstream developers+adm

> Maybe it could check the signature everytime one downloads the bundle? Yes, that's probably the direction we're going to go. > So downstream developers+admins need to set pretty liberal file permissions? (Or perhaps dig-up a way to use an alternative data directory?) Might be useful for the docs mention this. That's a good point. Another developer indicated they were writing a pull request to add composer post-install hooks, and I could easily add one that chmods this directory.