That's the neat part, it doesn't

Now that's just incorrect

Could have just kept using OSCP stapling

Basically OCSP stapling (more specifically must-staple) is isomorphic to short-lived certificates.

OSCP enables every website someone visits to be tracked; see https://news.ycombinator.com/item?id=46290033

OSCP stapling (which OP mentions) is supposed to fix that though.

Gitlab CI is leagues better

Not even close, that's still imperative package management

A single bit flip would mess up the block, and hopefully the rest of the stream and the padding, no?

Most unauthenticated encryption modes only mess up a few bits of a block, sometimes the following block too. A few only flip the exact bit in the plaintext.

> No "Find My Device" support.

I don't have any issues with it

That's why I build project specific images in CI to be used in CI. Running apt-get every single time takes too damn long.

Alternatively you can use a local cache like AptCacherNg

I'd contribute to free us from JavaScript

I'm using an HDD with SSD cache for /home all non stale will be cached by the SSD

What mechanism are you using to manage the cache ?

lvm

PayPal might be a bank but maybe PayPal accounts aren't bank accounts