A very clever exploit was found in apt.
tl;dr I found a vulnerability in apt that allows a network man-in-the-middle (or a malicious package mirror) to execute arbitrary code as root on a machine installing any package. The bug has been fixed in the latest versions of apt. If you’re worried about being exploited during the update process, you can protect yourself by disabling HTTP redirects while you update.
Source: Remote Code Execution in apt/apt-get
And a good remark on why HTTPS still matters even if your packages are signed.
If packages manifests are signed, why bother using https? After all, the privacy gains are minimal, because the sizes of packages are well-known. And using https makes it more difficult to cache content.
People sometimes get really passionate about this. There are single purpose websites dedicated to explaining why using https is pointless in the context of apt.
They’re good points, but bugs like the one I wrote about in this post exist.
Food for though.