I don't have plans to buy the company. I realized from the replies I got that these questions are not common to ask proprietary businesses but I had more of an open source impression of raspberry pi and transparency is the standard then. Don't you think it's important to know if I'm downloading packages from an official source or if it's from an unofficial source? I've seen people in this forum calling the Foundation the dodgy cousin when talking about trust and think twice about downloading software from them.
So these two github organisations (https://github.com/RPi-Distro/ and https://github.com/raspberrypi/) are both employed by raspberrypi.com? They just split it up into different github organisations for not mixing unrelated repositories?
No one replied anything about security. Only one person said I was a bit off the mark without any explanation. I'm just asking for an overview, not to go in-depth into all the details. I'm sure this is something many other people will appreciate who is interested in getting started with RPI. Where are all the PGP keys? Every other OS does PGP signatures for their images. They clearly make the keys available directly next to the image download links.
Regarding rpi-imager: I have debian 12 installed and up to date and using the bookworm repository. When I search or list for rpi-imager I get no results. When I try to install the package it says it doesn't exist. I even tried adding the repository which includes non-free dependencies and then refreshing the lists and still no rpi-imager found.
Even if it was possible to install rpi-imager, does it use pgp signatures to verify the OS images it downloads? I suspect it doesn't based on what I've seen so far.
So these two github organisations (https://github.com/RPi-Distro/ and https://github.com/raspberrypi/) are both employed by raspberrypi.com? They just split it up into different github organisations for not mixing unrelated repositories?
No one replied anything about security. Only one person said I was a bit off the mark without any explanation. I'm just asking for an overview, not to go in-depth into all the details. I'm sure this is something many other people will appreciate who is interested in getting started with RPI. Where are all the PGP keys? Every other OS does PGP signatures for their images. They clearly make the keys available directly next to the image download links.
Regarding rpi-imager: I have debian 12 installed and up to date and using the bookworm repository. When I search or list for rpi-imager I get no results. When I try to install the package it says it doesn't exist. I even tried adding the repository which includes non-free dependencies and then refreshing the lists and still no rpi-imager found.
Even if it was possible to install rpi-imager, does it use pgp signatures to verify the OS images it downloads? I suspect it doesn't based on what I've seen so far.
Statistics: Posted by rpifunfun — Tue Jul 08, 2025 9:38 am