Yes. Proper package manager usually proceeds to install only signed packages.
It means that usually OS maintainer has verified the purpose of the package.
It gives a quite lot more trust than running arbitrary content as shell script, without any third party verification.
I feel like "curl | sh is fine" has been explained so many times at this point idk how people still aren't on the same page. If you hate "curl | sh" so much I'm sure they can provide some other method of installation.
HL33tibCe7|2 years ago
nicce|2 years ago
It gives a quite lot more trust than running arbitrary content as shell script, without any third party verification.
insanitybit|2 years ago