If you're bootstrapping an environment you created, checksum the download and verify the checksum before feeding it to the "unpacker". Another thought would be

If you're bootstrapping an environment you created, checksum the download and verify the checksum before feeding it to the "unpacker". Another thought would be to mutually authenticate the SSL session. The curl man page has good doco as to how to do this. It does involve mucking around with PKCS12 key material, but it's not bad. Best...do both.