I'm looking a bit deeper into apt and I've a question regarding security. Maybe you could help me and provide an answer.
A) As far as I understand if apt is downloading a package from some kind of source it verifies that this package has not been tampered with during transfer. That means: As soon as apt has received that package (and provides it for installation) its integrity has already been confirmed.
B) As far as I understand each apt package internally contains checksums for each file stored in the package itself. This checksum file itself is signed. That means: At the moment apt is installing the package all (internal) package files have been checked against these checksums as well.
It is perfectly clear that A) is required. My question is: Why B)? Isn't that a bit "too much" security? Don't get me wrong: You can't have too little security here, but I'm wondering: Isn't that a bit excessive? Assuming that a distro repository is maintained reasonably well the checks of B) should not be necessary, don't they? Or the other way around: If the process A) already confirms the integrity of the package, why should process B) verify the integrity again?
Don't get me wrong: I'm not questioning the security infrastructure used here. I'm just trying to understand all aspects of it, especially the threats this security infrastructure tries to address.