[est31]

Weren't PGP signatures supposed to ensure integrity? How is this being bypassed?

[detaro]

The attack can inject fake hashes into the process, so it can pretend the file has the correct checksum: https://justi.cz/security/2019/01/22/apt-rce.html

[jwilk]

Discussed on HN:

https://news.ycombinator.com/item?id=18968370