On debian/ubuntu you can detect modified packages with `debsums` - but the signatures seem to be MD5, for which it's possible to generate collisions with e.g. s

On debian/ubuntu you can detect modified packages with `debsums` - but the signatures seem to be MD5, for which it's possible to generate collisions with e.g. something like http://www.bishopfox.com/resources/tools/other-free-tools/md4md5-collision-code/ http://www.bishopfox.com/resources/tools/other-free-tools/md... .