Get:13 http://security.ubuntu.com/ubuntu bionic-security/main The irony of using insecure http for your security subdomain...
-
Actually it would. Imagine an exploit in apt or somebody giving you some exploitable daemon to install instead of your intended package
The root of the archive is what is signed, so you can't replace individual packages. What you *could* do is roll back or pin the entire package archive to an older, vulnerable version.
