i have written a similar idea in a question yesterday. and from the "related" block/widget of my question i have found this question.
i answer only about apt (debian) system. text of my question answers this question, about apt system. i cite it and copy parts of it with modification.
InRelease files update like twice every day, in ubuntu
repositories and their mirrors. similarly in ubuntu and debian based
distros, and other apt repositories. these files are small text files
that contain hashes of other [fresh] text files, which contain hashes
of [fresh] package files. and these files are signed. so, these files
can prove that package has really come from the repository owner
unmodified. this system is used automatically by the apt scripts on
updating in order to prevent malware being installed in packages by
third parties like network providers or mirrors ( they are "man in the
middle" ) (and i think also can prevent from simple bit errors
in case some user has found malware in package, they may need to check
where from does it come and proof that in court.
ie this, the system described in that my question, can be named "delayed punishment" security system.
a malicious file may be sent only to a several/single user, in the
process of update, (if repository owners think that the user is not
going to catch them). third party archives are required also to
prevent this. to prevent this, users should check, after
apt upgrade, whether they has got the proper inrelease
files, they are saved in
/var/lib/apt/lists/, same as saved in one
or several third party/independent/witness sites, (which must have
[recently] downloaded the same file from other ips and with other
default ubuntu and debian installations are not secure:
they compel user to use their own (debian's and ubuntu's) servers for security updates. they are possible to change only via manual editing, but not via their software sources window. for me, by this, they look quite like the wolf in "Little Red Riding Hood". when 3rd party mirror is used, they cannot give malicious file to them, because mirrors are organisations and they may archive all that files for investigation. also, if mirror is used, repository owner does not know when user has connected to it. while user connects to distro's own server, they can identify user by his ip, in case they somehow know his ip, for example, they may know it when he visits their sites.
as i know, nowadays, all downloaded packages are automatically deleted by default. if saved, they can be used to investigate, what is in them. if there is malware in them, it cannot modify them, because that would require to keep their hashes not modified, but package installer runs as root and, i think, it can just delete this package... or all packages (.apt files) after installation. it is going to delete all packages, because if it deletes only one, it is indicating to the malicious package. but even if all packages are deleted by malware, if admin notices this, he can conclude that malware has come. when they are automatically deleted by itself, admin may not even know that his system is hacked and continue to use it.
InRelease files are rewritten automatically after every
apt update. seems, this is not configurable. this files could be saved for investigation piurposes. if they are saved, they still can be deleted by malware similar to above item #2.
but more advanced user can easily secure his ubuntu/debian system: there are 2 ways:
he can use a mirror for all repositories including security updates. only disadvantage is that mirror can hold updates not updated for some limited time, maybe that time can be configured in apt config. as i know, if the time is passed,
apt update reports a error message. update time can be checked manually with commands like
he can continue to use distro's own server for security updates, as configured by default, but after
apt update he should configure his browser to use a proxy server and download InRelease file via it and compare it with
diff with apropriate file in
these 2 ways are against when repo owners send a malware only to a single user.
what if they send malware not only single users, but publicly distribute them, to all mirrors? they may do that, if they hope that old package files and inrelease files and other files are not saved by mirrors and users. to fight that, user need to save all that files to separate computer, so that malware cannot manage it, before installing them, or have a trusted third party archive. saving all old packages requires many space.
debian already saves them on their own server, https://snapshot.debian.org/ , and this can be used, together with saving the small InRelease files in independent server, to check something... (i need to think about it before i can write). so... if you have signed inrelease files in simple server, if they are not too old, you can prove that they are indeed was signed by debian, even if same inrelease files are deleted from snapshot.debian.org. if you have signed inrelease file in blockchain, saved when it was fresh, you can prove it even after long time. but since you do not have package files saved, assuming they also are deleted on snapshot.debian.org, you cannot investigate them and check how exactly they worked. you can try to search for that files from users of debian.
about downloading isos, similarly, fighting 2 problems:
user should check hash of iso directly via https and via proxy server via https, or check that hash from a mirror via https. this is to fight that he gets specially crafted malicious iso only himself, while most users get normal iso.
and he should save signature of that iso in simple server, but better to a blockchain, or use what is saved by other users. this is to prove that iso was made by the distro, in case all users and mirrors (and distro itself) lost not only iso but even the hash of it, so they cannot witness in future. isos are typically saved many years in mirrors, so, blockchain is not needed. blockchain can be useful in case of using a very infamous distro. i think, probably, unlike inrelease file, iso signature is useless without iso file itself. inrelease file contains both signature and signed content within itself. so, you need to keep iso file, if you are afraid you cannot find it later somewhere in internet. if you lose iso file and only have hashes and signatures, and only you have these hashes and signatures, probably you cannot even prove, that this signature belongs to the distro without the iso file. if you have lost iso file, but other users have same hashes as you, they can witness that iso with this hash existed, but you cannot investigate, how did it work.