[midtake]

You can just download the zip over HTTPS

[necovek]

What if it's leveraging a zero day in your zip or https library?

[sroussey]

That would be super interesting to have such a large repo when zipped by GitHub then turn into a malicious file. It would be its own front page story.