Our security-checking software balks at the "curl | sudo bash" idiom.

After researching this a lot(!) online, the fix -- when people even acknowledge this needs fixing -- is to manually inspect the download file before allowing it to run each time you want to run the enclosing script.

The better answer, implemented here, is to download the file, check it for naughtiness, and then include it as part of the distribution (that is, add it to the repo). This doesn't magically get you updates, but it can be manually updated as necessary (I'm assuming the downloaded file rarely changes), which is probably the safest thing, anyway.