AFAIK this is how it worked with classical OS packages (think rpm/yum/apt/etc.)

Packages and metadata was all prepared for distribution over nothing more than static file hosting and http(s) to leverage as much existing infrastructure as possible.