Just verifying that the release binary from github is actually the release binary from github you think it is, should be good enough. The problem with `curl |

Just verifying that the release binary from github is actually the release binary from github you think it is, should be good enough. The problem with `curl | bash` isn't that the upstream author might be malicious, or have had their working copy of the repo/compiler compromised. If that's where your problem is, yeah, you're kind of stuffed. The problem with `curl | bash` is that you're not verifying that the thing you've downloaded is the thing that the upstream author actually released, unmodified, and uncorrupted. Checking a hash is normally sufficient to accomplish this, and isn't overly burdensome or time-consuming. If you're particularly paranoid, you might want to check the hash against a copy you've obtained from somewhere other than the server you downloaded the release itself from. You should be able to find a separate copy of the hash from a release announcement either from the author's social media, or maybe on a mailing list archive. (If they're not posting hashes as part of their release announcements, start badgering them to do so.)