This is what the 0install command does (it's included in the Ubuntu repositories). It will: - Download the package metadata - Download the GPG key - Check th

This is what the 0install command does (it's included in the Ubuntu repositories). It will: - Download the package metadata - Download the GPG key - Check the metadata's GPG signature - Confirm the key with the user and/or check against a key information server - Download and unpack the archives - Check the tree digests against those in the metadata This page explains what it's doing behind the scenes: http://0install.net/walkthrough.html http://0install.net/walkthrough.html