Comment by sczi

Nice work! A similar vulnerability in 2019 also found by you included the recommendation to update with:

  apt -o Acquire::http::AllowRedirect=false update
  apt -o Acquire::http::AllowRedirect=false upgrade

Since this also involves redirects, would that protect users while updating apt for this one also?