On Sat, 2006-12-09 at 20:32 -0500, Matthew Miller wrote: > I don't think it really is much of one, provided that your > package-installing application (pup, in this case) properly validates > package signatures. Only valid Fedora packages could be installed. For that scenario, I think you'd have to have a system which only used Fedora repos (no Livna, Dag, etc.). -- (Currently running FC4, in case that's important to the thread) Don't send private replies to my address, the mailbox is ignored. I read messages from the public lists.