As long as we don't have signed packages you don't have to worry about security; it just does not exist. It does not really matter if you install from a compromised iso image or install from a valid iso and update compromised packages later. :-)

Half OT: What's the benefit of metalink over torrents with webseed? I'd assume bittorrent clients are more common than metalink clients.

There are different levels of security and just because you can't attain perfect security doesn't mean that you shouldn't try to attain any at all. In this case the checksums are useful for checking file integrity after a download but they do add some level of assurance that the files have not been tampered with, provided those checksums come directly from the Arch devs, which I trust more than a checksum file from some random mirror. If they had no significance whatsoever, they would not even be added to the download page.

To answer your second question, there's no direct benefit per se. Some people just don't have one or the other and providing both is easy. I think your assumption of the scarcity of metalink clients is wrong though. DownThemAll and FlashGot both support metalinks and they are both very popular add-ons for Firefox, so they are very common. Also, in many cases it is far easier to install a browser plugin than install and configure a torrent client.

What you really seem to be asking is "why should I use metalinks instead of webseeded torrents?" and the answer is that __you__ probably shouldn't. Don't make the mistake of assuming that what's optimal for you is optimal for everyone else though. Simply because you yourself don't see the utility of something does not mean that it is not useful for others.

I did not say that providing metalink files is useless. I just asked for the benefit because I had never used it. I have no idea why you got upset by this.

For md5sums: they are only useful for checking the integrity after downloading and burning a CD. OK, it makes manipulating harder but not impossible.

I think all this can be solved in a more elegant way by just providing official metalink files by default. So, I suggest subscribing to the arch-releng mailinglist and discuss your proposal there; or we change this to a feature request for metalink files and move it to releng.

I prefer to keep this fully automated so that I don't have to keep track of releases and mirrors. I already expect it to be difficult to convince anyone to re-enable http access to those 2 files. Asking for anything beyond that seems like a waste of time to me.

As for "getting upset"... maybe there's something lost in translation there. I gave a full response though because you've asked me about this previously on the forum. Both times you phrased your question in a way that implies that this is only worthwhile if metalinks are somehow "better" than torrents (which can be taken to demean my intentions), but that was probably my own misinterpretation.

Well, I don't have a big problem with having those files on the web server. The point is that atm the isos/mirror are on a different server than the website. So its not that straigt forward to implement this; at least it has to be copied manually on each release.

Anyway, I am not here to accept or deny your request. I just wanted to point to an imho better solution.

FYI: Thomas implemented this a long time ago.