I’ll just note that you had to go back more than 20 years to get that short list of complaints.

>How are you going to update if apt is compromised?

Download the package with your http client of choice, install with sudo dpkg --verify -i

many mirrors are also available over https, you can just change that

When Ian Murdock was alive, Debian had much better quality. I never believed it was a suicide, especially now, after such a long history of critical incidents like the ones you mentioned. They don't look random anymore and it feels like they were all introduced on purpose by the same people who wanted us to believe the suicide version.

[flagged]