Post #236853

@sethmlarson@mastodon.social @bagder@mastodon.social Couldn't that be achieved by replacing the "sh" pipe target with a (python) script that does the download, signature verification, and (assuming it passes) execs "sh". E.g.: $ curl http://... | safe-sh - Certainly, that could be PoC to see how practical it would be.