Comment by chriswarbo

That's what the apt sources are for; point them to a snapshot of known-good packages (e.g. S3, AptOnCD, whatever), and disable everything else.

I remember doing such things (via .deb packages, rather than random scripts) a couple of decades ago.