Our security team will not let anyone pipe a URL into a shell on a company laptop, and honestly I agree with them. I want to install SDODS but I need to be able to show someone what the script touches before I run it.
Is reading the script the only option, or does it have something better?
Accepted answer
It has --dry-run, which prints every step and writes nothing. Download it, check the checksum, read it, then run it in dry-run mode:
curl -fsSLO https://sdods.com/install.sh
curl -fsSLO https://sdods.com/install.sh.sha256
sha256sum -c install.sh.sha256
less install.sh
sh install.sh --dry-runOn macOS the checksum line is shasum -a 256 -c install.sh.sha256.
Every line of dry-run output that begins with "would" is a step that has not happened. Nothing is written, no shell profile is touched, no browser is downloaded.
--modify-path. Without it the installer prints the PATH line and leaves the editing to you, which is usually what a security review wants to hear.The full contract is at Reference → Installer — options, what it writes, and what it refuses to do.
Adding to that: --version-check is the other half. It detects what is on the machine and prints the paths it resolved, then exits without installing anything.
sh install.sh --version-checkI paste that output into the change ticket. It answers "what will this touch" in one block, which is the question the reviewer actually has.
Have the same question?
Ask it with the command you ran and the output you got, and it will be answered here.
Ask a question