Not an answer to you're question, but do you feel safe doing (
https://github.com/jchilders/dotfiles/blob/main/Makefile#L34)
> sudo curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/in... | /bin/bash
piping the output of a curl command to sh without first checking the sha256 of the file you just got?
In a similar situation I would not be comfortable without at least getting a specific version of the tool I'm downloading and then hardcoding an hash of its content I computed after manually downloading and inspecting its content.