Re:Ask HN: Which tools and methods do you use to check for m...
by jacoblambda on Sunday October 28, 2018 @01:30AM
(#18319311)
Well unless you or any software you use pulls packages from secondary sources like unverified git repos, npm, or pypi.
And, um, on Ubuntu, apt packages are signed, right?