Verify GPG signatures of repo.

[CRKatri]

Currently Zebra doesn't even require a Release file, but to increase security it should verify the signature of a repo, based off the keys in /etc/apt/trusted.gpg.d

[wstyres]

This is definitely something that is on our list to do. As for not requiring a release file, I was under the impression that Cydia allowed that. Some repos at the time when I made that decision didn't have release files so they didn't work at all with Zebra.

[CRKatri]

I don't know what Cydia does, but I know that APT requires a Release, I didn't know people make repos without a Release.

[CRKatri]

To ensure security, you'd want to check the signature of the Release and then verify the checksums of the Packages based off the information in the Releaee

[lodee77]

Ok