[gentoo-user] Question about binary packages

[Jean-Christophe Bach]

Hi list,

I was wondering how it works for binary packages when they are compiled:

Are all binary packages compiled on Gentoo infrastructure after a source
upload from the maintainer, or are there any binary packages compiled on
maintainers computers and then uploaded on Gentoo infra?

In fact, we had lots of trolls^W discussions about this point with
friends and colleagues who use other distros. And there is a security
question: do we allow uploads from developers without being sure the
binary comes from the corresponding sources? (the maintainer may be
malicious, or his computer may be compromised) The « binary upload »
practice is very common in other distro communities such as Debian.
Therefore I would like to know if we also have this flaw in Gentoo.
(and what do you think about it)

Thank you,

JC