My basic question is this:
When we are using the Linux / Debian apt-get or yum package system, we're placing a lot of faith in that the packages we're downloading and installing are secure. For that matter, even downloading Linux images from Ubuntu or Debian or Red Hat or whatever, we are assuming these servers are secure and the sources are trustworthy.
Given that there's a broad variety of distros, package managers, mirrors, and sites serving us this content, it seems worth questioning the security of this whole ecosystem.
How secure is this open-source software ecosystem from nation-state security department hackers?
As we know, our own "guv'mint" has already been responsible for compromising the servers and security standards of other open-source projects such as the SSL encryption standard, and implicated in hacking private corporate systems which we rely on (Google/Gmail), which gives me reason to consider how many possible attack vectors there could be in an ecosystem as complex as the open-source / unix / linux community is.
To give a concrete example:
If I use Ubuntu's apt-get package manager in the US (or another country), I am blindly downloading packages from servers hosted in that nation and assuming that the software I'm installing is safe. What is there to secure that the servers haven't been compromised, or had malicious code embedded in trusted software packages? It seems like a likely target for nations with Information security departments which have strong ambitions towards controlling cyberspace.