Bashka – static analyzer for bash install scripts (for safety and convenience)

A drop-in safety guard for the curl … | bash install pattern. Bashka parses the incoming script, scores it against many different checks, follows forwarded scripts so every layer is analyzed and if it found some unsafety it gives you an easy way to read a script or analyze using your AI agent.

Useage is simple as adding ka after the standard installation script

curl -fsSL https://pyenv.run | bashka

bashka.mp4 #

Install via bash. One last time.

curl --proto '=https' --tlsv1.2 -fsSL https://bashka.dmtrkovalenko.dev | bash

We guarantee absolute safety of this script! Read it yourself

Findings come in four kinds: 💀 💀 (critically malicious, blocks hard), 🚩 red (dangerous), 🟡 yellow (advisory, never changes the verdict), ✅ green (good-citizen signal).

Some of the additional commands

bashka list [--long]                 # table of software installed through bashka
bashka info <name>                   # everything recorded about one package
bashka update <name>                 # re-fetch the recorded installer and run it again
bashka remove <name> [--dry-run]     # delete every recorded binary and created directory, forget the package
bashka flags                         # list every registered flag with its options
bashka config init                   # print default configuration

bashka writes a lock file of everything it installed to $XDG_DATA_HOME/bashka/installed.toml (~/.local/share/bashka/installed.toml; BASHKA_LOCKFILE overrides the path). er that exits non-zero leaves no record.

bashka list prints package list, inspired by pacman -Q:

NAME  VERSION        INSTALLED   UPDATED     FILES          SOURCE
mise  2026..1       2026-0-15  -           1              https://mise.run
uv    0.9.2          2026-09-01  2026-09-15  2              https://astral.sh/uv/install.sh
demo  0.0.0-unknown  2026-09-15  -           2 (1 missing)  <stdin>

bashka info <name> (or bashka list --long for all) shows the full record in pacman -Qi style, with each binary and created directory on its own line and missing paths marked.

bashka remove <name> deletes the recorded binaries and created directories, then drops the entry. There is a possibility that bashka couldn't track where the file is installed (which is a red flag) but after your approval it will still be tracked but during the uninstall the binary files wouldn't be deleted.

bashka update <name> fetches the recorded URL again and runs it through the full review with the recorded options and shell arguments.

~/.config/bashka/config.toml is deep-merged over the embedded data/defaults.toml.

[flags]
strict_mode     = false
max_commands    = { limit = 200 }
trusted_domains = { additional_domains = ["get.example.com"] }

[interaction]
on_red        = "ask"      # ask | abort | proceed
follow_remote = "always"   # ask | always | never
descend       = "hybrid"   # hybrid | fetch_ahead | shim
max_depth     = 5

[ui]
icons      = "emoji"       # emoji | nerd | ascii
animations = true          # spinners while fetching forwards and on hand-off

• Bash is Turing-complete. Even though we try to detect obfuscation it can evade static analysis.
• The shim intercepts bash /sh resolved throughPATH but/bin/bash bypasses it.
• trusted_domains keeps a deliberately strict allowlist (GitHub only). Everything else is trusted only when it matches the domain the script was fetched from. Trusted domains can be modified via cofig usingtrusted_domains = { additional_domains = ["get.acme.io"] } .
• A server may serve different bytes at run time than at fetch-ahead.
• The install registry only sees executables that land in the watched directories. If bashka couldn't detect where the binaries went, but you still approved it - we won't be able to manage and uninstall the binary

MIT and opensource. Support my work at https://github.com/sponsors/dmtrKovalenko