Yes, that's clear. I'm not very familiar with how quicklisp works. I thought that “updates once a month” implies a separate update channel (distribution, ...).

Yes, that's clear. I'm not very familiar with how quicklisp works. I thought that “updates once a month” implies a separate update channel (distribution, ...). Looking at the relevant issue, https://github.com/quicklisp/quicklisp-client/issues/167 https://github.com/quicklisp/quicklisp-client/issues/167 , it's not clear that even hashes are in place. I recently found out that most Nix fetchers use https, but do not actually do verification (`curl --insecure` or equivalent libcurl settings). Channel updates do verify and include hashes, so the overall chain is authenticated.