Fair enough, I have learned to live with curl first, then execute. Or going through the trustworthiness of the repository author (e.g. number of stars, contributors, etc.) More or less the same safeguard I take for packages I install from Arch User Repositories. I’m curious, tho, How do you feel about “docker pull”? Containerization has limits…