Arch Linux

With all packages being signed, the security risk here is little to none.

Signature doesn't make package trusted if it is outdated.
With signed index, you can be sure all packages are newest as of
{last modification time of index} (which should probably be a part of
signed index file).

Mirror can keep database with all upgrades, but with old vulnerable
version openssl. Signed, but vulnerable.

Furthermore, I just found out this:
[root@hopper tmp]# grep ^Server /etc/pacman.d/mirrorlist
Server = http://mirror.yandex.ru/archlinux/$repo/os/$arch
[root@hopper tmp]# rm /var/lib/pacman/sync/*.db*
[root@hopper tmp]# pacman -Syu
:: Synchronizing package databases...
core 121.6 KiB 1204K/s 00:00 [####################################################] 100%
extra 1741.6 KiB 1964K/s 00:01 [####################################################] 100%
community 2.7 MiB 2.13M/s 00:01 [####################################################] 100%
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...

Packages (1) file-5.24-1

Total Installed Size: 3.85 MiB
Net Upgrade Size: 0.00 MiB

:: Proceed with installation? [Y/n] y
(1/1) checking keys in keyring [####################################################] 100%
(1/1) checking package integrity [####################################################] 100%
(1/1) loading package files [####################################################] 100%
(1/1) checking for file conflicts [####################################################] 100%
(1/1) upgrading file [####################################################] 100%
[root@hopper tmp]# pacman -Q file
file 5.24-1
# good new file
[root@hopper tmp]# vim /etc/pacman.d/mirrorlist
[root@hopper tmp]# grep ^Server /etc/pacman.d/mirrorlist
Server = file:///tmp/$repo/os/$arch
[root@hopper tmp]# pacman -Syu
:: Synchronizing package databases...
core 118.3 KiB 0.00B/s 00:00 [####################################################] 100%
extra is up to date
community is up to date
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...

Packages (1) file-5.24-2

Total Installed Size: 3.85 MiB
Net Upgrade Size: 0.00 MiB

:: Proceed with installation? [Y/n] y
(1/1) checking keys in keyring [####################################################] 100%
(1/1) checking package integrity [####################################################] 100%
(1/1) loading package files [####################################################] 100%
(1/1) checking for file conflicts [####################################################] 100%
(1/1) downgrading file [####################################################] 100%
[root@hopper tmp]# pacman -Q file
file 5.23-2
# previous version of file
[root@hopper tmp]# gpg --verify /tmp/core/os/x86_64/file-5.24-2-x86_64.pkg.tar.xz.sig /tmp/core/os/x86_64/file-5.24-2-x86_64.pkg.tar.xz
gpg: Signature made Thu Jun 18 01:18:45 2015 UTC using RSA key ID 387A1EEE

The above issue is now fixed in pacman. (we still should do database signing...)

So far I haven't seen a good concept of how databases could be signed. I guess we either need some way to do remote signing or ensure that certain keys can only be used to sign databases.

Unassigning myself. As far as I am concerned, there is nothing to do from the pacman end.

This is an automated comment as this bug is open for more then 2 years. Please reply if you still experience this bug otherwise this issue will be closed after 1 month.