2 ms·

Isn't uv like... a Rust binary? If that sh has any sense it just copies the binary and adds it to PATH.

• rieogoigr 1y ago
  but since you are curling a web URL straight to sh you will never know. which is the problem.
  • bmicraft 1y ago
    But it's not if you trust the url and curl has `--proto '=https' --tlsv1.2` as args
  • oblio 1y ago
    What about running a downloaded binary installer? What if the URL is HTTPS?
• dboon 1y ago
  If you look at the script, this is indeed more or less what happens. Except the folks over there are very clever about ergonomics, so the script is quite long so it can detect your architecture, OS, and even libc to give you an appropriate binary. There’s a tool that they use (which they wrote) which generates such install scripts for you It’s really excellent stuff