[GH-ISSUE #3439] docs(install): only a main-branch curl | bash installer path is documented #1282

New issue

Closed

opened 2026-10-16 21:03:45 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-16 21:03:45 +00:00

Owner

Originally created by @GovinduSasanka on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3439

docs/installation.md documents curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash. That runs whatever main holds at fetch time, unsigned. install.sh itself is careful (HTTPS-only, truncation guard, no sudo, version check).

Expected: also document the reviewable path: download install.sh from a release tag (rea-agents-<version>), read it, and run it with --version <version>.

A PR follows.

Originally created by @GovinduSasanka on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3439 `docs/installation.md` documents `curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash`. That runs whatever `main` holds at fetch time, unsigned. `install.sh` itself is careful (HTTPS-only, truncation guard, no sudo, version check). **Expected:** also document the reviewable path: download `install.sh` from a release tag (`rea-agents-<version>`), read it, and run it with `--version <version>`. A PR follows.

bsakaguchi referenced this issue

2026-10-17 21:10:08 +00:00

[PR #1299] [MERGED] fix(mcp): advertise input patterns without look-around #2779

bsakaguchi closed this issue

2026-10-31 00:30:26 +00:00

bsakaguchi commented

2026-10-31 00:30:27 +00:00

Author

Owner

@morluto commented on GitHub (Oct 26, 2026):

Thanks for pointing out the need for a reviewable installer. docs/installation.md now documents downloading install.sh from the version tag, inspecting it, and running it with the matching --version; it also states that the script signature is not verified. This was added in 80bc0f5ed. I am closing the original documentation request as addressed. Please reopen if the documented steps miss an important part of the reported use case.

@morluto commented on GitHub (Oct 26, 2026): Thanks for pointing out the need for a reviewable installer. `docs/installation.md` now documents downloading `install.sh` from the version tag, inspecting it, and running it with the matching `--version`; it also states that the script signature is not verified. This was added in 80bc0f5ed. I am closing the original documentation request as addressed. Please reopen if the documented steps miss an important part of the reported use case.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1282

No description provided.

Rows
Columns