On Sun, Sep 21, 2025 at 07:09:54PM +0200, Vincent Lefevre wrote:
With HTTP, connections can be redirected to a repository with obsolete, vulnerable packages.
No they can't, there's a signed timestamp in the metadata and apt will warn if the repository isn't up to date.