UPDATE: this question has, thankfully, been thoroughly answered over on infosecurity: https://security.stackexchange.com/a/139203/112311
I have struggled to find info on what kind of measures are in place, for the most popular distributions, before a package is added to a repository.
I understand that package integrity is verified from repository to user, but I am specifically wondering about when/how it is checked, from a security perspective, from developer to repository. Are there scripts run on new submissions ? Or machines that are frequently rolled back and used solely to test packages and what they do ?
Apple's App Store, for example, has accidentally hosted malware after developers used an unofficial source of