In the "Why?" section he says that he is a CTF player. He should be very security-concernet, he shouldn't?

I've found that security skill in one area doesn't translate to others. Someone good at breaking things isn't necessarily good at building secure things.

While I haven't looked at the code and can't tell you if it's the case here, most package managers I've used use unencrypted http for the traffic.

Security is achieved by verifying the signature of the downloaded file.

An additional benefit is that you can easily put a http proxy in front of it.

Hi, I am the package maintainer for https://github.com/metis-os/hysp-pkgs (The default source that's shipped with hysp)

To address your concerns:

1. Hysp allows making request to http-only sites, because hysp doesn't care where you host your binaries. As long as you have sha256sum/blake3sum of the binaries, and they match, hysp will work.

2. The default pkg source that ships with hysp, is hosted on github itself, where's there's no need to use http. HTTP is simply a fallback, and meant for maximum compatibility.

3. As installing random binaries from random sources is not advisable due to security concerns, the pkg-source can be self-hosted by anyone and hysp can be configured to use that instead of the default source.

Good to know that checksums are being used... But are they signed at all? How do I get the checksum in the first place?

Sorry don't mean to heckle, just was skimming through the code and saw that line.

It's up to the pkg maintainer that's being used as the source.

The default PKGs, located at: https://github.com/metis-os/hysp-pkgs, are automated via GitHub actions. You can look at the workflow codes.

As to answer the signing question:

$BIN.TOML must contain either blake3sum or sha256sum of the binary specified as source. And once hysp downloads them, it checks if they match exactly as specified in the $BIN.TOML We prevent MITM or any other shenanigans by trusting whoever is hosting the pkg, isn't tampering both the binary and the checksums. So yes, not completely foolproof (an attacker could, in theory, tamper both the binary and the checksum), but that's why we have the self-hosting option for people who want to trust only themselves and their servers. The config allows you to specify different URL/Host for the TOML files and the actual binaries.

So unless, both the TOML files and source binaries are being hosted on an HTTP site, MITM is not possible.

And as already specified, the default source that ships with hysp, doesn't use HTTP anywhere.