Trust

• Developers sign packages before upload

• • Checked against keyring

• md5 hashes stored in Packages.gz and Sources.gz

• Release file signed

• • Links together individual files, signed by the master archive key