Well-written scripts I've seen also contain the hash of binaries that are downloaded. So as long as the hash function is good, checking the hash of the script s

Well-written scripts I've seen also contain the hash of binaries that are downloaded. So as long as the hash function is good, checking the hash of the script should still ensure that the binary downloaded is what you want. > you have no idea what that binary does when you verify that the checksum is correct. This isn't any different from using a package manager. You're still downloading a binary that could do anything and you have to have some level of trust in the source.