shot

shot := a safer alternative to curl | sh installs.

replace sh with shot, and shot will:

• read the script and extract any SHOT_* variables (TODO)
• store those values in a local SQLite database (TODO)
• pass the script to a real shell for execution
• verify the script's integrity before running it (TODO)

try shot now, run curl https://todo | sh one more last time

now go install something, may i interest you in mise?

curl https://mise.run | shot

shot variables

#!/usr/bin/env sh
# /// shot
SHOT_AUTHOR = "rcastellotti"
SHOT_NAME = "shot"
SHOT_VERSION = "1.27.1"
SHOT_WEBSITE = "https://rcastellotti.dev"
SHOT_MINISIG_SIGNATURE = "https://blabla.com/shot.minisig"
SHOT_MINISIG_PUBKEY = "https://blabla.com/rcastellotti.pubkey"
# todo: add root/prefix to track where files are installed
# ///

• TODO: make shot verify script integrity (needs a server)
  • allow users to post minisign pubkey when registering
  • allow users to upload .minisig signatures whenever a version is released
• TODO: release binaries, start with shot_darwin_arm64
• TODO: add support for SHOT_SHELL to explicitly set the shell to use
• TODO: interactive mode -> see all variables and inspect script in editor