it is not really a random pkg though, it's still signed and it's the same file you can find under the apt repository