The point is that a bad actor might be able to put themselves between your repository and the exact package version you’re attempting to download

Everyone agree on this too and OP clearly mentionned checksums after you suggested a check and that’s what should be implemented so that looks pretty fine too me. I like good endings :)

In my second reply I pointed out why even the asset store is not a source you can blindly trust.

We all agree on this, the engine does exactly this, do no click the “asset store” tab tho. Never download anything from it, could be insecure. You see what I mean?

In my third reply I meant to point out that deflecting with the project being free software is largely irrelevant, not to mention that OP asked for feedback.

OP accepted all relevant feedback from what I can read in this thread. What pikl wrote never happened, so same story to me.
There are still a few things missing from the project, but it does not look like a big deal, and I’d really like to see it finished.

Don’t let yourself be put off by negative comments people might make, keep up the good work on this, it’s a great start

You just pointed behaviors that never happened, like OP never said it does not matter. I can understand why that might be annoying so I wouldn’t call that neutral and well-meant feedback compared to your previous replies.

you say I don’t know, laugh and change the subject. Immediately moving on.

Where? I read a suggestion that one could hack the official registry and that’s exactly one of the point that @[email protected] raised afterwards

Then OP just says lock files and checksums are planned, can’t you read?