You can programmatically add as much verification into your shell script to verify it's not tampered. All the Attacker has to do is replace your shell script w

You can programmatically add as much verification into your shell script to verify it's not tampered. All the Attacker has to do is replace your shell script with their own to neuter everything you did. You will never escape the insecurity of this because you are connecting to another server and accepting whatever output it gives you to run under a bash process. They can poison your process via DNS cache; using a transparent proxy to replace the content. Don't assume that just because they are using HTTPS that it removes all attack vectors. This is lazy; and insecure. Ship a proper package in a proper repo that people can programmatically add using Chef or Puppet or whatever their moment inspires. P.S. don't create curl https://uninstall.sandstorm.io https://uninstall.sandstorm.io | bash