That says absolutely nothing if the page serving the expected md5 sum is also compromised. With HTTPS, everything is already checked in transit, so you don’t n

That says absolutely nothing if the page serving the expected md5 sum is also compromised. With HTTPS, everything is already checked in transit, so you don’t need to verify it again. On top of that, with git, all the revisions are inherently verified as sha1 hashes. In either case, what’s inside may still be malicious if you end up on a typosquatted repo.