One option is to trust on first use, checksum the installation script and at least casually verify the diff each time the checksum changes[1]. Pros: - Protect

One option is to trust on first use, checksum the installation script and at least casually verify the diff each time the checksum changes[1]. Pros: - Protects against simple hijacking. - Reproducible as long as the installer doesn't also call out to a moving target, such as example.com/releases/latest. Cons: - Build breaks as soon as the installer is bumped. If it's bumped often (or just before an important release) this can cause pain. - TOFU may not be acceptable, but of course you could review the code thoroughly before even the first use. - The review of each version could be non-trivial. Usually installers are pretty simple and stable though, YMMV. [1] https://github.com/linz/geostore/blob/b3cd162605109da8a3a6885aa36e63d6f6828e5c/geostore/Dockerfile#L8-L12 https://github.com/linz/geostore/blob/b3cd162605109da8a3a688...