Scenario : I recently came across this issue using lubuntu. When I tried upgrading using terminal "apt upgrade", I got an error like you are using http which is not secure, so the default action was done to skip the upgrade. Without taking it seriously or reading it properly, I upgraded it using the app "Software upgrade", which does it all with click of button. It upgraded successfully, but that was the last goodbye session. It had corrupted everything on the os, not sure if it was malware or something else.
Question : While installing a fresh linux, we get sha or md5 hashes to verify the authenticity of the iso's downloaded. But most of the upgrades are done through HTTP and how to verify those packages are same as the source, or is there any other way to prevent MITM from sending me a corrupt package?