It's not theater. You're right that the hash could be compromised if the server is compromised, but it is one thing besides the code that you can use to check t

It's not theater. You're right that the hash could be compromised if the server is compromised, but it is one thing besides the code that you can use to check the integrity of your download. It is right in your face and obvious, so it is less likely to be faked. As I said, the download can be compromised, and it makes the most sense for it to be compromised in a way that is not obvious. When there's a hash you can check that the thing you downloaded is in fact what it was advertised to be. The hash can also be obtained outside the target environment and checked separately for an extra measure of security. People publishing exploits don't know if you are auditing or not. When you make them commit to a specific version of the code, then they can't randomly inject garbage as easily. I already explained how the code could end up not being what you thought it was. If a we server randomly serves exploits to 1% of requests, or intelligently detects non-interactive downloaders, you can get hacked that way. And if you don't even save the script, you can't even look at it if you have doubts.