This is my opinion on curl | sh/bash type directions. If the maintainers don't provide a hash so I can confirm that is what they intended, there ain't much I can do unless someone slapped in a function named "totallyNotMalware" into the script. I've looked through scripts, seen what they do, but I'm not good enough to recognize anything funky.

Saving it to a file is actually a decent method, since you can be sure the script you're reviewing is the same one you're running.

Personally I often will just manually run the install steps in order if the script is simple enough. Half the time it's just a bunch of OS version checks followed by a tar -xf

If you just run the file you just created, it doesn't matter that they detected a redirect. I mean it would be a bit silly to download a script, check it, and then re-download it to pipe into bash.

Also piping to cat seems redundant but malicious hosts can detect whether the request is getting redirected, using some clever trick, so it’s not.

Just so you know, servers cannot detect piping to any arbitrary process. The trick you're talking about is detecting piping to an interpreter, for the lack of a better term. Piping sleep N to bash is observable behaviour, for example. Piping anything to cat is not.

https://web.archive.org/web/20250622061208/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/