No. There is package signing now. You already verify that the guy who put his package on the repo is the guy you trust as your binary source. How do you know? Because you could build the exact same binary with an archlinux source package and current devtools. The unholy mess gcc is is entrusted with encoding our sources to machine executable format, and how do you know you can trust it? You can't. To say it with XKCD, there is no point in forcing teachers to wear a condom in class, and there's no point in adding virus protection to arch's repos. Really, no. cheers! mar77i
