UPDATE: this question has, thankfully, been thoroughly answered over on infosecurity: https://security.stackexchange.com/a/139203/112311

I have struggled to find info on what kind of measures are in place, for the most popular distributions, before a package is added to a repository.

I understand that package integrity is verified from repository to user, but I am specifically wondering about when/how it is checked, from a security perspective, from developer to repository. Are there scripts run on new submissions ? Or machines that are frequently rolled back and used solely to test packages and what they do ?

Apple's App Store, for example, has accidentally hosted malware after developers used an unofficial source of xcode.

closed as too broad by Rui F Ribeiro, Jeff Schaller, Anthon, Eric Renouf, jasonwryan Sep 26 '16 at 18:07

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • There probably isn't a single answer, so this is likely too broad. here is the process for Fedora though, I assume you can find similar ones for whatever platform you like – Eric Renouf Sep 26 '16 at 15:43
  • i had a quick look though it seems to talk more about the process of adding a package, on a practical and orderly level, as oppose to much emphasis on security. – infinite-etcetera Sep 27 '16 at 11:28