deprecate installer script

[joemiller]

The install script used by the curl -sL https://git.io/autotag-install | sh instructions was generated by godownloader years ago and does provide a way to verify against a checksum provided as input. While it does verify checksums downloaded from github releases, this is not sufficient in the current era of increasing supply chain attacks. An attacker could compromise the github repo and replace any release binary along with checksums.

Recommend users manually (or using automation) retrieve version + checksum and hardcode both in their CI pipelines.

[threeiem]

Should we consider something like sigstore to keep the signatures safe from compromised maintainers as well.

[threeiem]

I'm plus one for alerting users in light of recent supply chain attacks. My nits and suggestions don't stop this from being merged though.

[joemiller]

Should we consider something like sigstore to keep the signatures safe from compromised maintainers as well.

good idea. There is also this, GA'd late 2025, I was not aware of it - https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases

[winmillwill]

👍 to moving on from godownloader, other benefits are gravy

[threeiem]

Should we consider something like sigstore to keep the signatures safe from compromised maintainers as well.

good idea. There is also this, GA'd late 2025, I was not aware of it - https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases

Seems like releases should have been immutable from the beginning. It is crazy to think you can release code and then rerelease different code as the same release. 😵