It is important to me that only sources that are authorized be used for package installation. Treating other sources as trusted should not happen with a dist-upgrade point release.
This appears to be related to sources.list.d/vscode.list which is also of concern but the primary concern is that the trust model of a running system is altered without my permission.
Hi,
After today's dist-upgrade, I found this file:
/etc/apt/trusted.gpg.d/microsoft.gpg
It is important to me that only sources that are authorized be used for package installation. Treating other sources as trusted should not happen with a dist-upgrade point release.
This appears to be related to sources.list.d/vscode.list which is also of concern but the primary concern is that the trust model of a running system is altered without my permission.