For example, if I install Ubuntu in Dubai or in Saudi Arabia, I'll probably get a local mirror. Is there a way I can make sure that the ubuntu packages I get when I do apt-get update are the 'real' ones?
Take a look at
man apt-secure, apt has done signature checks on release files for well over a decade. The release file contains a hash of all files in the package, and the release file gets signed by a trusted key that is included in the original installation media.
It looks like
md5 is still widely used here, which is concerning but not necessarily a deal-breaker (collision attacks on
md5 have been around for a long time, but preimage attacks aren't yet possible). It's not difficult to imagine a non-malicious file being included in a package that has the same
md5 hash as a malicious file, in which case the malicious version could be distributed instead, but a collision attack like this would require the package maintainer's cooperation, so while not impossible it seems less likely (and you're trusting the package maintainer quite a bit already anyway).