The bug is not trivial, I asked my AI friend to analyze.

To summarize, APT may have several download sessions in parallel, which may download the same "resources". To save bandwidth, disk storage, these same resources are downloaded only one, but given different names on the disk through hard links.

Because of HTTP retry, APT may be lured into downloading again a resource, but that was associated with a different package name, package that was already checked (hash verified). This is because of some differences between the package name / filename / URI, etc.

Anyway, the point is that hash are verified when a package is completed, but because of possible parallel downloads and hard links usage, a verified package can be rewritten.

What I find crazy though is that why packages are not first completely all downloaded, then every time a package is used, the hash be verified before being used. This would reduce even further the surface of attacks, and I don't care about any performance impact.