Comment 26 for bug 125103

@alsuren:
Sorry, I've missed the part about chosen-message attack.
But still, key for each PPA would localize range of vulnerability to 1 PPA.
What about Martin Pool's idea of accessing ppa through https? Would it give protection from this type of attack?

> The whole point of signed archives is for users to place their trust in developers, so they don't *have* to individually check each package. If Debian didn't > consider this important, they would have opted for simple md5sums.
I didn't use Debian, but are their repositories open for anyone to upload like ppa?
And again: signing archive with your key means you are identifying yourself to build system, and signing the whole archive(repository) by server which holds it - is identifying integrity and source of data, as mentioned earlier.
You can make your own archive on own server and sign it - still, it wouldn't give you any trust, it would just verify that you are you.