What would prevent me from touching this however: ISO images are hosted via plain HTTP[1] and the only way to verify it is an md5sum that I have to fetch from the same domain. not only is there no transport integrity but I have no way of knowing if the binaries hosted on that server can be traced to a build upstream? Maybe I have to dig around their hg to find out or I'm missing something? Who built these images and where would be good to know before I would consider loading any of this on my hardware.
I could not make sense of the info in this page[2] linked to from [download] warning about spectre/meltdown. Also the suggested mitigation techniques were odd to say the least.
The project had a total of 7 contributors since 2012. Would be nice if this got more eyeballs and some serious refactoring on how they do security and build automation since this is a key element in a distribution (imho).
[1] http://mirror.slitaz.org/iso/rolling/slitaz-rolling.iso
[2] https://forum.slitaz.org/topic/-important-info-about-meltdow...