> Packages are signed, unless you're using a niche, insecure distro or package manager. You still need to get that signature from somewhere, likely a web serve

> Packages are signed, unless you're using a niche, insecure distro or package manager. You still need to get that signature from somewhere, likely a web server. If your threat model is that you don't trust web servers but do trust the packages and repositories they give to you, then I guess this is true but that seems a little crazy given that the attacker can just change the website you're visiting to host a malicious package, and change the signature it verifies against. > Of course, that signing key could also be compromised, but those are usually more tightly guarded than web servers, Why is it reasonable to assume that? I don't think it is, at all. If their SSL certs are comprised, all bets are off. > any reputable dev should have their key in a hardware enclave like yubikey or similar). I suspect you will be very very very disappointed at the number of people who publish software that meet the criteria you've outlaid here. Fundamentally, your argument is flawed right at the beginning because all the attacker needs to do is compromise the web server and change the installation instructions.