snowee then how does Solus ensure that the packages served by the CDN are exactly the same as those served by the main server
The CDN pulls data from our package server directly in the event of cache misses and merely stores them on their edge servers / network closer geographically to the user. We can perform cache invalidation at any point in time. Alongside this, eopkg will validate the shasum from the index. We do not have any security concerns related to the CDN.
snowee To remove all doubt, should users update directly from Solus servers?
Users should use the CDN and once RIT is syncing from us, I'll be pushing a modification to eopkg that will convert existing systems using RIT to the CDN automatically. Intentionally using the non-CDN will mean that not only are you hammering our server more for no reason (when that bandwidth could otherwise be soaked up by the CDN service, to a magnitude of a 97% reduction from the metrics I've seen), but you're doing it at the cost of a worse download experience.
presianbg now using the SerpentOS or a copy of it.
This is not correct. While our infrastructure is no longer hosted by RIT, what we are using is still the previous build infra tech (with various fixes) such as our build management scripts, ferryd, and solbuild. They haven't been replaced with summit and vessel from Serpent OS yet and we're likely quite far out from that as they are coupled closely to moss (Serpent OS package manager).
