You need to check hash of downloaded files

[yurivict]

Otherwise, they can be substituted by MITM attackers, and compromise systems which build FluidPlug.

[Kirtai]

Either that or use httpS

[yurivict]

Either that or use httpS

https provides weaker security compared to cryptographic fingerprint.

[Kirtai]

https provides weaker security compared to cryptographic fingerprint.

It's still much better than the nothing we have right now.
We can also use both.