@zicklag any ideas?

Not off the top of my head. @miliog is this the proxy you're using mitmproxy?

I might be able to take a quick look at it...

...

Yes, that's the software that I used. You can just start it inside a terminal without any configuration and it will create a proxy for you at http://localhost:8080. The certificate is under ~/.mitmproxy/, as shown in my screenshot.

I was able to download packages via compile with other proxies before, though, just not with mitmproxy. However, update definitely ignores any proxy that I've tried so far and just uses the regular Internet connection.

I just looked at the code and I found out the reason for update at least:

        match ureq::get(&url).call() {
            Ok(response) => response
                .into_json()
                .map_err(|err| eco_format!("unable to parse JSON response: {err}")),
            Err(ureq::Error::Status(404, _)) => {
                bail!("release not found (searched at {url})")
            }
            Err(err) => bail!("failed to download release ({err})"),
        }

When downloading the tag, the proxy agent isn't being used. Downloading the release itself should be fine as it uses the download_with_progress function from download.rs, but if your environment blocks any connections without the use of a proxy, you won't be able to self-update the Typst executable.

I still don't know why mitmproxy in particular doesn't work even though curl can do it just fine.

Oh.. well, it's an easy fix at least.

I still don't know why mitmproxy in particular doesn't work even though curl can do it just fine.

Yeah, I think that's the only mystery, now. I can confirm that downloading packages works through a squid proxy, so there must be some nuance in the format of the proxy request that is made by the ureq library that we use for making requests.

I think it might be an issue for the ureq crate, if we can double-check with a minimal reproducible example that ureq requests just don't go through the mitmproxy correctly.

I've changed the release fetching to use the agent, too, so the only remaining issue is the mitmproxy thing.