Re --check, I suppose the way to do that would be to download the file to disk, which --check requires as fair as I can tell. So I could download the file to disk, --check, and then remove it. I think most of these installs scripts are trying not to leave any artifacts around from install, other than the resulting binary.
> $ s='1<space><space>2'
> $ printf %s\\n "$s" | shasum -a 256 > tmp.sum
> $ printf %s\\n "$s" | shasum --check tmp.sum
> -: OK
So you can just `printf '%s<space><space>-\n' "$c" > tmp.sum` and check with `printf %s\\n "$s" | shasum --check --status tmp.sum || { echo "checksum failed" > &2 ; exit 1 ; }`
Having to create temp files is a wrinkle (could probably avoid it by using process substitution if you want to give up on POSIX sh), but so is writing bash scripts in general.
I ended up trying with process substitution so no tmp file.
It works. Trying to decide if it’s more difficult to read