Apt repositories are typically PGP signed. Even in the case where you just obliviously add the repository&#x27;s PGP key, you are protected against the file server being compromised. Also if you find malicious things in a signed package, that takes away some deniability from repository principal.<p>Then there&#x27;s <a href="https:&#x2F;&#x2F;www.idontplaydarts.com&#x2F;2016&#x2F;04&#x2F;detecting-curl-pipe-bash-server-side&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.idontplaydarts.com&#x2F;2016&#x2F;04&#x2F;detecting-curl-pipe-b...</a>