I think the bigger danger is that since you're instructing a direct pipe-to-sh over the network without regard to exit status, you're running the risk of executing truncated code that could trash your system state.

It's pretty rare for an app to need root privileges. You typically need root to write to the system dirs (/usr/* /bin etc). And in this particular case, the app has access (by design) to your terminal, so yeah, you need to trust the app a bit. But why would you need to demand all users of your system (even if that's just system users) also trust it?

Put it in ~/opt with xstow, and add ~/opt/bin to your path, ~/opt/man to your man-path, ~/opt/include, ~/opt/lib... to the various paths.

In this case, it seems like a lot of effort to get a tgz-archive just to download a single executable. I gather it's distributed as an archive in order for the Changelog, Readme and License to be available -- but as it's all downloaded from github anyway, it's hard to see why that really matters (rather than just have -h spit out a link or two).

As, if you're using a normal, full-featured web browser, there's no way of knowing if what you select, is what you copy and then paste -- it would probably be better to just link directly to the latest binary release for the various platforms (linux32, linux64, linux-arm, OSX 32bit, OSX 64bit) -- and let the user save the binary somewhere.

Limit the "command line instructions" to:

  go get github.com/asciinema/asciinema

rather than fighting idiomatic go practices.

If you really want to be clever, why not just use 0install?

http://0install.net/