3 ms·
Assuming script being fetched by cURL is hosted using HTTPS that is reasonably well configured it basically provides the same guarantees. Unlike a distro packa
by jpgvm 10y ago
Assuming script being fetched by cURL is hosted using HTTPS that is reasonably well configured it basically provides the same guarantees.
Unlike a distro package you can also just -not- pipe it to the shell immediately and actually read it.
Even if you did unpack every distro package source before you installed it with the amount of crap and boiler plate you would almost never be able to work out -exactly- what it will do.
The way I see it the "curl | sh" people have found somewhat of a middle ground. It achieves similar convenience to "apt-get blah" but with simplicity level closer to binary tarball.
It's almost as easy to work out what it's going to do as the tarball but it will also do it for you automatically.
- semi-extrinsic 10y ago> Unlike a distro package you can also just -not- pipe it to the shell immediately and actually read it. IDK about other distros, but for the one I use (ArchLinux) it's trivial to inspect the install script, and they (PKGBUILDs) are usually well structured and easy to read.
- jpgvm 10y agoUnfortunately the majority of package managers are bloated and awful. Pacman/PKGBUILD and emerge/ebuilds are notable exceptions, though there is also Nix and many super simple based tarball systems that are also very good. But all of that is irrelevant when 99% of the Linux world is running RPM/APT.