Recently, a yum update installed an update to R1Soft's server backup management software on a Redhat 7 server I am dealing with, and rkhunter is giving me a warning about a suspicious file. I've asked about the legitimacy of that warning in this separate question:
I strongly suspect it is a false positive, but I had a further question that this prompted me to think about, more generally speaking.
How confident can somebody be that mainstream yum repositories (such as this, or for example, the rhel-7-server-rpms) will be free of malware? Is my confidence misplaced? Do they go through a vetting and screening process strong enough that an administrator can feel comfortable running yum update freely?