hsum.dev Wants to Put Install Scripts Under a Microscope

Field notes

The proposed archive follows watched script URLs, stores the raw response bytes, and exposes a SHA-256 digest for each observed version. Its example lookup for ollama.com/install.sh includes 17 versions, 26 stable days, a first-seen timestamp, and a previous digest. Planned comparison uses unified diffs, while digest pins could be committed to a repository and checked in a pipeline. The page explicitly separates provenance from safety review: hsum records what was served, not whether it should be executed.