Is it safe to install a Mac app with curl | bash?

Updated October 20, 2026

You found a Mac app. The install instructions are one line in Terminal: curl -fsSL https://trycupola.com/app/install.sh | bash for Cupola, and something in you hesitates. Good instinct. Piping a script straight into bash means you're running code you haven't read, and that's worth understanding before you press Return.

The short answer: it's safe if the script is served over HTTPS from a domain you trust, and if the script itself verifies what it downloads before it touches your system. It's not inherently safer or riskier than downloading a .dmg and double-clicking it: it's just a different shape of trust. Below is what the command actually does, what can go wrong in general, how to check any script yourself, and exactly what Cupola's installer does.

What curl -fsSL URL | bash actually does

curl -fsSL URL fetches a file and prints it to standard output. -f makes curl fail silently on HTTP errors instead of printing an error page as if it were a script, -s suppresses the progress meter, and -L follows redirects. The | bash pipes that output straight into a new Bash process, which executes it line by line as it arrives.

There's no separate "download, then open the file in a text editor, then decide" step: the command does both the fetching and the running in one breath. That's the entire reason people pause before typing it.

What can actually go wrong

A few real risks, in rough order of how often they bite people:

You're trusting the server, not just the link. If the domain is compromised, or you mistype it and land on a lookalike, you're running whatever that server decides to send you.
A plain HTTP URL can be intercepted. Anyone on the network path (a shared Wi-Fi, a compromised router) can swap in a different script. HTTPS protects the transfer itself.
A script can behave differently depending on who's asking. A malicious server could, in theory, serve a clean script to browsers and a dirty one to curl. This is rare but it's the reason "I read it on GitHub" doesn't fully cover what curl actually received.
Scripts can be cut off mid-stream. A dropped connection partway through a naive script can leave it executing a half-downloaded command. Careful scripts guard against this (see below).

None of this is unique to curl | bash: a downloaded .app or .pkg can do all the same things once you open it. The pipe just removes the pause where you might otherwise glance at what you're running.

How to inspect a script before you run it

You don't have to trust blindly. Swap | bash for a look first:

curl -fsSL https://trycupola.com/app/install.sh | less

That downloads and displays the script without executing anything; page through it with less, or just open the URL in your browser, which will show you the raw text. Look for what it downloads, whether it uses https://, whether it verifies a checksum or signature before installing anything, and whether it needs sudo and why.

If a script refuses to show its source, or the maintainer can't explain in plain language what it does, that's your answer: skip it.

What Cupola's installer specifically does

Cupola's install.sh is readable at the URL above, and here's what it does, in order:

Checks you're on macOS with Apple silicon; refuses to run anywhere else.
Downloads a small latest.json over HTTPS (TLS 1.2+, pinned to https:// only) that lists the current version, download URL, and a SHA-256 checksum.
Confirms that download URL actually points at the expected update server before fetching anything from it.
Checks your macOS version meets the app's minimum requirement.
Downloads the app archive, then verifies its SHA-256 checksum matches what latest.json promised: if the download was tampered with or corrupted, the checksum won't match and the script stops.
Verifies the app's code signature with codesign --verify, and specifically checks it against Cupola's own signing certificate and bundle identifier, not just "is this signed by somebody," but "is this signed by the real developer."
Only after all of that passes does it copy the app into /Applications and open it.

The whole thing runs inside one function, called only on the last line of the file, so a connection that drops partway through downloads nothing partial and executes nothing partial either. If any check fails, the script prints an error and stops: it doesn't install over failed verification.

Where Gatekeeper and notarization fit in

Separately from the install script, macOS itself checks the app. When Cupola.app is first opened, Gatekeeper verifies its code signature and that it's been notarized by Apple, Apple's automated scan of submitted apps for known malicious content, which happens before a developer is allowed to distribute an app outside the App Store. Apple's own documentation on this is linked below. The install script's own checksum and signature checks happen before that, as an extra layer specific to Cupola's own distribution.

Why Cupola isn't on the App Store

If the installer can be this careful, why not just use the App Store and skip the whole question? Cupola reads and writes real checklists and tables in Apple Notes and talks to Reminders in ways the App Store's sandbox doesn't allow apps to do. That's a sandbox limitation, not a choice to avoid review; see the FAQ on trycupola.com for the exact wording. Terminal install plus self-updates is the trade-off.

The bottom line

curl | bash isn't dangerous by itself: a server you trust, served over HTTPS, running a script that verifies its own download before installing anything, is about as safe as any other way of getting software onto your Mac. The habit worth keeping is simple: if you can't easily read what a script does, or its maintainer can't explain it, don't pipe it into your shell. If you can, as with Cupola's install.sh, a one-line install is just a Terminal shortcut for the same download-and-verify steps you'd do by hand.

If you'd rather see the install in context, start at installing Cupola or check troubleshooting if something didn't go as expected.

Sources

Give your notch something to do.

Try Cupola free for 7 days, then pay once ($20) to keep it.

Install free trial