> Fundamentally, doesn't the security depend entirely on whether https is working properly? Even the standard package repos are relying on https right?

They should only need http. You don't need https at all if your package is signed. The package/installer/app/etc could come from anywhere, modified by anyone, at any level. But if it's not signed by the dev's private key (which only exists on their laptop [or hardware token], protected by a password/key manager), it's invalid. This avoids the hundred different exploits between the dev and the user.

What's actually crazy about this is, if you're already making the user do a copy and paste, it doesn't have to be one line. Compare that line above, to:

  (set -eu; tmpf="$(mktemp)"; [ -w "$tmpf" ] &&
  curl https://install.duckdb.org/ -o "$tmpf" &&
  echo "d5d91c69a874ef99c30cf36654f623ed9c423ed0e210dca229744ce4d3b273d0 *$tmpf" | sha256sum -c - &&
  bash "$tmpf")

The PHP primary package manager does this similar in what you write - https://getcomposer.org/download/

It is amazing that a duckdb could be worse than decade old PHP for something such as this.

  curl -f