HTTPS will not protect you from a bad/compromised mirror.
A compromised mirror cannot serve packages that aren't properly signed.
This attack used an HTTP redirect to serve a backdoored package after the signature has been verified. I'm not sure that HTTP redirect attack would work with an HTTPS repository!?