Isn't the whole point of this comment thread "vulnerabilities to supply chain attacks"? >> - Downloads binaries for use in build with no hash/signing verificat

Isn't the whole point of this comment thread "vulnerabilities to supply chain attacks"? >> - Downloads binaries for use in build with no hash/signing verification. > It downloads them using TLS. If the binary is updated to a shady version, sure, no one will be able to tamper with the download, they're certain to have received the correct shady stuff.