Every release signs the installers with an Ed25519 key. These lines download the installer and its signature, check it with Node (which the CLI needs anyway), and run it only if the signature checks out. The CLI’s own updates check the same signature.
Windows PowerShell
irm https://chainlayertwo.online/install.ps1 -OutFile install.ps1
irm https://chainlayertwo.online/install.ps1.sig -OutFile install.ps1.sig
node -e "const c=require('crypto'),f=require('fs'),n='install.ps1';const k=c.createPublicKey({key:Buffer.from('MCowBQYDK2VwAyEARNHc7QP7OkJ5EP6f9u+ivR4ifrFwCLVPg7LLVDDbe28=','base64'),format:'der',type:'spki'});const ok=c.verify(null,f.readFileSync(n),k,Buffer.from(f.readFileSync(n+'.sig','utf8'),'base64'));console.log(ok?'Signature OK':'BAD SIGNATURE - do not run it');process.exit(ok?0:1)"
if ($?) { Get-Content .\install.ps1 -Raw | iex }
macOS and Linux
curl -fsSLO https://chainlayertwo.online/install.sh
curl -fsSLO https://chainlayertwo.online/install.sh.sig
node -e "const c=require('crypto'),f=require('fs'),n='install.sh';const k=c.createPublicKey({key:Buffer.from('MCowBQYDK2VwAyEARNHc7QP7OkJ5EP6f9u+ivR4ifrFwCLVPg7LLVDDbe28=','base64'),format:'der',type:'spki'});const ok=c.verify(null,f.readFileSync(n),k,Buffer.from(f.readFileSync(n+'.sig','utf8'),'base64'));console.log(ok?'Signature OK':'BAD SIGNATURE - do not run it');process.exit(ok?0:1)"
[ $? -eq 0 ] && sh install.sh
The last line runs the installer only after Signature OK, so pasting the whole block is safe. The public key is the one built into the CLI.