[creshal]

> Ye sit is stupid to request a package manager that uses unsecured packages with disabled SSL and curl and wget to download packages and manage them so that any hacker could install any package it wants with a simple script.

That was not the demand. The demand was a package manager that works without requiring openssl as a dynamically linked dependency, so the package manager still works if those dependencies are broken or missing (due to e.g. a botched update) and can repair dynamic libraries for the rest of the system.