I agree with parent, it doesn't make sense to host checksums on a plain HTTP site. Also grandparent's link states >HTTPS does not provide meaningful privacy f

I agree with parent, it doesn't make sense to host checksums on a plain HTTP site. Also grandparent's link states >HTTPS does not provide meaningful privacy for obtaining packages. As an eavesdropper can usually see which hosts you are contacting Which is untrue. An attacker can't tell which specific packages are being downloaded, which could be important depending on your threat model. (The argument can be made size of DL leaks info, but that's a lot of work, and multiple packages could have same size)