It's not that curl isn't so bad, but that the lack of notarization is really bad. Distributing software safely is still a pain. Linux distributions have this k

It's not that curl isn't so bad, but that the lack of notarization is really bad. Distributing software safely is still a pain. Linux distributions have this kinda figured out a long time ago with signed packages - almost a requirement if you want to distribute your software on mirrors that you don't control. This is why it's safe to download a package from a Debian HTTP mirror and install it. The thing afaik any of them still don't do, and is really important too, is checking the signature with a revocation policy. I actually started writing about how I distributed a CLI for macOS, Linux, and Windows a few years ago but never finished it. If you are writing Go code you want to take a look at Equinox. I used it to distribute a CLI in my previous job, and it worked like a charm. One of the things I liked most was that I was finally able to push safe updates because I authenticated every release with my private key, and only allowed users to update if the key matched. If you have a primary and a secondary key, and a strategy to revoke it, this means you have a quite safe release process. Related: https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html https://developer.apple.com/library/archive/documentation/Se... https://equinox.io https://equinox.io https://developer.apple.com/macos/distribution/ https://developer.apple.com/macos/distribution/ https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution?preferredLanguage=occ https://developer.apple.com/documentation/xcode/notarizing_m... https://blog.jessfraz.com/post/why-open-source-firmware-is-important-for-security/ https://blog.jessfraz.com/post/why-open-source-firmware-is-i... https://docs.microsoft.com/en-us/windows/win32/seccrypto/cryptography-tools https://docs.microsoft.com/en-us/windows/win32/seccrypto/cry... https://docs.microsoft.com/en-us/windows/win32/seccrypto/signtool https://docs.microsoft.com/en-us/windows/win32/seccrypto/sig... https://www.mothersruin.com/software/SuspiciousPackage/ https://www.mothersruin.com/software/SuspiciousPackage/ https://successfulsoftware.net/2012/08/30/how-to-sign-your-mac-os-x-app-for-gatekeeper/ https://successfulsoftware.net/2012/08/30/how-to-sign-your-m... https://arstechnica.com/gadgets/2012/02/developers-gatekeeper-a-concern-but-still-gives-power-users-control/ https://arstechnica.com/gadgets/2012/02/developers-gatekeepe...