HTTPS tells me that I am definitely downloading this package from GitHub. But what exactly am I downloading from GitHub? No clue.