It always icks me out when people recommend this. Like with `get-pip.py`... It's fine to download that and run it to install pip, but for the love of GNU please at least take a cursory glance at what you're running!
pip install this-or-that
In that sense curling is better as you can see the code beforehand just pipe it into a pager.
If "| curl" does this, it is basically normal to do anything. And root access is required in a lot of cases.
In practice, no. It is customary for "pip install" to not require root, and for "| curl" to require it.
"meteor.js" was a first relevant hit for curl|sh query on google. is javascript app platform. You are supposed to use "curl | sh" to install it ( https://install.meteor.com/ ). This file:
- Hardcodes install location to ~/.meteor (and removes previous location of it).
- Uses "sudo" to write to /usr/local/bin/meteor
Compare it with "scipy", which can be called a scientific app platform. It tells you to install via pip to user dir ( https://www.scipy.org/install.html ). It installs itself only to this dir, and nowhere else (I know it because I use it at work a lot, and we do pre-packaged virtualenv here). It is also using standard mechanisms -- if you want to have many version side-by-side, it is trivial.
Can you write |sh script so it minds its own business and only writes to a single directory? Yes. Do people do this? Not very often.
-----
When I wrote this, I thought: maybe I am biased towards curl|sh method because I don't know of one? So I want to HN front page, looked at last 210 entries, chosen every one which looks like a a software installable on a PC, and tried to evalalate the system impact:
- Dephell: curl | python, no side effects other than forced install location.
- neo.mjs: installed via node, presumably no side effects outside of node/project dir
- huginn: manual steps, all manual -- or docker. No surprises either way.
- ponylang: docker or PPA. No surprises.
- Poetry: installed via "curl|python", modifies my .bashrc to set PATH (to be fair, it told me about this afterwards...)
- Uni the unicode database: use "go get", no side effects
- Qt 5.1 -- commercial, "installer app".
- Virtualbox 6.1 -- installed via .deb file (system-wide but expected)
- event-driven-shell -- run from repo, optional "make install"
We've had 2 "curl |" apps. One of them was modifying my ~/.bashrc.
We've had 4 "traditional" apps -- which used "checkout repo and run command" method. None of them were writing stuff outside of their checkout dir. Some of them explicitly recommended that users change their .bashrc.
We've also had some docker apps and .deb-installed apps. Of them, virtualbox and Qt could write all over the places -- but they are much more "heavy weight" compared to other ones..
----
This is not a very big sample, but I think it is pretty representative. Once piping things into shell, it seems people cannot help but install stuff all over the place. It is just like "make install" was -- except it is not optional this time.