Most distro's I know have some kind of repository functionality where new packages could be downloaded after installation. Which distros do this in a secure way and which doesn't do this in a secure way.
I'm especially thinking about attack vectors like man-in-middle and problems like breach of security on both the repository meta server and the repository file mirrors.
I have heard that both Slackware and Arch linux are very vulnerable because they lack package signing. Is this true? Are there any other major linux distro's that are vulnerable for simple man-in-middle attacks?