Installation via Homebrew

[nikolay]

Many of us try to keep off software installed via curl | sh.

[matthewmueller]

I'd like to add it to Homebrew soon! Though the recipe itself would still likely just do curl | sh under the hood (through homebrew's APIs). Does that work for you or is there a reason you avoid curl | sh?

[nikolay]

To prevent a supply chain attack. Homebrew uses checksums.

[matthewmueller]

Ah, we also use checksums to verify integrity of the downloads:

bud/install.sh

Line 44 in f0211fc

echo "$PREFIX: verifying checksums"

[nikolay]

@matthewmueller You can't have the checksum in the script itself - what you've done is only a consistency check, not a security check.

[matthewmueller]

@nikolay thanks for the info! Could you share a bit more details about what you mean by security check?