Piping a URL into a shell runs whatever the server returns at that moment. You can avoid that for the Safeguard CLI by downloading the installer to a file, reading it, and then running it. The installer also checks the archive against a published checksum file before putting anything on your PATH.
Why the one-liner deserves caution
A one-line install is easy to copy and hard to audit. Nobody sees the script, there is no record of what ran, and a compromised server or a mistyped domain would hand an attacker a shell on your machine. The Safeguard documentation says as much: it advises never piping a URL you have not read into a shell, and it says that applies to its own installer too.
That is a good habit for any tool, not only this one.
Read first, then run
Save the script instead of executing it:
curl -fsSL https://cli.safeguard.sh/install -o install.sh
less install.sh
bash install.sh
On Windows, the same idea works with the PowerShell installer: download it to a file, open it, then run the file.
Things worth looking for as you read: which hosts it contacts, where it writes files, whether it asks for elevated rights, and how it handles a failed checksum.
What the checksum step does
Each release publishes a checksum file, and both installers compare the downloaded archive against it. The two installers behave differently when that file is missing:
- The shell installer fails closed. It aborts if the checksum file is missing.
- The PowerShell installer warns and continues.
If you work in a sensitive environment on Windows, do not rely on the warning. Fetch the checksum file for the release you want from the releases path on the CLI site and compare it yourself.
A checksum from the same server as the archive proves the file was not corrupted in transit. It does not prove the server itself is trustworthy, which is why reading the script and pinning a version still matter.
Pin a version for repeatable installs
Add the version variable on the install line, and the installer fetches that release rather than the latest:
curl -fsSL https://cli.safeguard.sh/install | SAFEGUARD_VERSION=VERSION_HERE bash
Replace the placeholder with a release you have reviewed. Pinning means a pipeline run next month installs the same bytes you tested today.
Mirrors and air-gapped networks
If you host the archives on an internal mirror, the docs describe a variable that skips checksum verification on purpose. Treat it as a last resort. If you use it, run your own verification step against a checksum you trust and record where that checksum came from.
A short routine you can adopt
- Download the installer to a file.
- Read it, or diff it against the copy you reviewed last time.
- Pin the version.
- Run it.
- Confirm with the version command and check which copy is first on your PATH.
It takes two minutes and removes a whole class of surprise.
Quick check
Does the checksum check protect me from a compromised download server?
Not fully. It catches corruption and mismatched files, but if an attacker controls both the archive and its checksum file, the match still passes. Reading the script and pinning a reviewed version reduce that risk.
Which installer fails if the checksum file is missing?
The shell installer for macOS and Linux aborts. The PowerShell installer prints a warning and continues, so verify manually on Windows in sensitive setups.
For a first look without installing anything, the free scan at gold.safeguard.sh/scan runs in the browser.
Sources
Last reviewed: 19 October 2026.
