alt Hacker NewsI really wish people would mention their stack when they have these curl install scripts. I'd rather use a real package manager, but I'm not totally against installing a compiled binary this way. I am, 100%, not going to install some Java/Type-script nightmare like this though. How is it resolving the dependencies? Is it installing some version of node, bun... on my machine? How's that working with other versions I have installed?
Related: please don't write command line tools in non-compiled languages! Don't make the runtime your user's problem.
Replies
The source is prominently linked: https://github.com/gloom-sh/gloomberb
> please don't write command line tools in non-compiled languages!
Around 40% of Linux CLI tools are written in interpreted languages.
And in the GitHub release page they include compiled binaries anyway... Why would you advertise `curl | bash` as a way to install if there's a binary available?!
Download it, put it wherever you like (probably `~/.local/bin/`) and you're good to use it.
Sometimes I truly wonder...
I know where you're coming from. I've been worried about all the supply chain attacks on npm too. And I'm far from a security expert. However, if you're okay with installing binary packages via `curl somesite.com | sh` I don't think you are in a better position with regards to security.
you can test it out with
bunx gloomberbAgree. If you really want to know what's used here: probably uses bun single-file executables[0] so shouldn't clash with anything else on your system.
I really wish this was not the top comment on HN. It’s a cool project! Maybe try it??! Or just be silent!
I don't know man, seems like a cool project and is open source. I guess he could have just sat on it and used for himself exclusively. It's auditable and totally fine for an open source project and nobody is forced to use it. It's free to use under the MIT license, what else can you really ask for.