After arcee's comment I'm less worried. The probability of what I'm worried about happening was 0.001% and after arcee's reminder that the downloads page is get.cm
, it's more like 0.000001%, but if it did happen the results would be disastrous. Plus if it is who I think it is, I am not sure if they'd be able to pull off what I'm worried about.
When I meant I had to talk to the team, it's that I wanted to get answers like what +Ricardo Cerqueira
provided. I'm thinking we're fine now based on his answer. I've just been dealing with certain things for too long NOT to get immediately nervous about them. As it is, improperly merged code has been proven to do massive damage if not caught in time. What could be done maliciously if someone were able to create a fake build scares the shit out of me, fortunately it sounds like we still have reasonable protection against fake builds.