Recommend package manager hardening

Site Development Guide Suggestions
1

For example I use for apt this simple hardening:

sudo apt install apt-transport-https
sudo sed -i 's|http://|https://|g' /etc/apt/sources.list
sudo sed -i 's|http://|https://|g' /etc/apt/sources.list.d/*.list

This will force APT to use HTTPS.

If you are feeling extra paranoid, block port 80 in firewall.

Why: http is insecure and can be tampered super trivially.

Important: while most repos support https, some may not. You will need to manually rotete them to find out.

2

Do you have instructions for rpm based distros?

3
4

I think most distros sign their packages and enforce verification checks so https isn’t so important, but it could be good for some added privacy.