@solenepercent @Pol I thought mentionning reproducible builds but I forgot about it. This could help verifying if a mirror is serving trustable images but:

- you need to build reproducible images to verify if the registry is lying, at this point you do not need the registry
- if you trust 3rd party reproducible builds monitoring system, you would need to trust multiple independant peers. A wrong signature immediately reports an issue, not an async reproducible check

@passthejoe

@solenepercent great! I wasn't sure to write this because it was too simple, but my blog is my doc after all and it wasted too much time figuring a few things (like package name on ubuntu X_X)

@jackie

@solenepercent for me it just works perfectly, tried between peers using android, linux, iOS :)