There are existing methods to avoid this hassle, for example, to have the server provide both script.sh and script.sh.asc (ex. gpg --verify script.asc) or checksums.txt (ex. sha256sum --check checksums.txt).
Package managers (with mirror-able index database) have similar functionality built-in.
There are existing methods to avoid this hassle, for example, to have the server provide both
script.shandscript.sh.asc(ex.gpg --verify script.asc) orchecksums.txt(ex.sha256sum --check checksums.txt).Package managers (with mirror-able index database) have similar functionality built-in.