283
Developers: I will never ever do that, no one should ever do that, and you should be ashamed for guiding people to. I get that you want to make things easy for end users, but at least exercise some bare minimum common sense.
The worst part is that bun is just a single binary, so the install script is bloody pointless.
Bonus mildly infuriating is the mere existence of the .sh TLD.
Edit b/c I'm not going to answer the same goddamned questions 100 times from people who blindly copy/paste the question from StackOverflow into their code/terminal:
WhY iS ThaT woRSe thAn jUst DoWnlOADing a BinAary???
- Downloading the compiled binary from the release page (if you don't want to build yourself) has been a way to acquire software since shortly after the dawn of time. You already know what you're getting yourself into
- There are SHA256 checksums of each binary file available in each release on Github. You can confirm the binary was not tampered with by comparing a locally computed checksum to the value in the release's checksums file.
- Binaries can also be signed (not that signing keys have never leaked, but it's still one step in the chain of trust)
- The install script they're telling you to pipe is not hosted on Github. A misconfigured / compromised server can allow a bad actor to tamper with the install script that gets piped directly into your shell. The domain could also lapse and be re-registered by a bad actor to point to a malicious script. Really, there's lots of things that can go wrong with that.
The point is that it is bad practice to just pipe a script to be directly executed in your shell. Developers should not normalize that bad practice.
I'll die on the hill that curl | bash is fine if you're installing software that self updates - very common for package managers like other comments already illustrated.
If you don't trust the authors, don't install it (duh).
Just because I trust the authors to write good rust/javascript/etc code, doesn't mean I trust them to write good bash, especially given how many footguns bash has.
Steam once deleted a users home directory.
But: I do agree with you. I think
curl | bashis reasonable for package managers like nix or brew. And then once those are installed, it's better to get software like the Bun OP mentions from them, rather than fromcurl | bash.There was a malicious website on Google pretending to be the brew package manager. It didn't leave any trace but when you ran the command it ran a info stealer and then installed brew.
If this was rare I could understand but it is fairly common.