We trust github.com and small-time publishers far too much. There’s a reason Debian packages software and runs mirrors.
I agree that github is uncomfortably large, but the problem isn't this tool, and the solution isn't something Debian can achieve on their own.
Good.
On a sidenote this is the same "but x is so much more convenient" mentality that is driving open source projects to lock all their documentation behind something like a Discord chatroom instead of having a proper docs page or wiki.
I'm against Github. I think that nuance got lost.
I prefer hard-coded hashes in my code so that when the file changes, I'm made aware. I've lost so much time chasing bugs back to a dependency which changed without a version bump and whose hash was checked by a script that just got the hash it was checking at runtime.
https://www.reddit.com/r/github/comments/1at9br4/i_am_new_to...
1. There's a catch-22. In order to fetch binaries you need to first install eget.
2. You need to trust eget to not be (or become) malicious.
Perhaps #1 can be resolved by providing it as a proxy service and not an executable. For example, "wget eget.net/gopls@latest" which then usings eget on the server to grab/cache the binary and send it back.
Then again, that would mean putting even more trust in eget.
ubi --project oalders/is --in ~/local/bin
