yep, and that would be bad! If clone / build steps are separate, I can at least verify the hash looks sane, or mirror it locally, etc.. In the curl|bash approa

yep, and that would be bad! If clone / build steps are separate, I can at least verify the hash looks sane, or mirror it locally, etc.. In the curl|bash approach, all of this is lost.