"You've likely heard this one already, but here it is again: over the weekend, the UnrealIRCd team discovered the 'Unreal3.2.8.1.tar.gz file on our mirrors has been replaced quite a while ago with a version with a backdoor (trojan) in it.'
"Still, from the looks of this news, mistakes were indeed made. The Unreal team have already 'fessed up to the fact that (until this happened), archived releases had not been PGP/GPG signed. Which means if the archived version of the software varied in any way from the actual source code, there's no sure way to tell. That's what signing is supposed to do.
"The team also admitted to not checking all of the mirrored files as often as they should have. Which means that while the true source code (in CVS) was clean as a whistle, the source archive files that people downloaded were not clean for a very long time."
