Import – A Simple and Fast Module System for Bash and Other Unix Shells
<p><pre><code>   # The URL is downloaded once, cached forever, and then sourced
   import &quot;https:&#x2F;&#x2F;git.io&#x2F;fAWiz&quot;
</code></pre>
Where is this program declaring the above content&#x27;s expected SHA256 to check that the expected content is being received, and not some altered version?<p>Think about it. You write the program with the above #import, and at the time, it fetches a certain piece of code. You see in your cache that it&#x27;s the right one.<p>Then you deploy the script to a fellow user. They run it, and the import fetches something different from the same URL. The script breaks. You&#x27;re scratching your head: hey, it works on my machine, why not yours? Or worse: the replacement code is <i>malicious</i> not simply <i>breaking</i>. The user&#x27;s files are gone or whatever.