Avoid using curl downloads because of the Supply Chain attacks.

[naveensrinivasan]

Avoid using curl downloads because of the Supply Chain attacks.

btcd/.github/workflows/go.yml

Line 21 in 31791ba

run: "curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.26.0"

Example https://blog.gitguardian.com/codecov-supply-chain-breach/

Possible Solution

• Use golang ci as go dependency in a separate go.mod with something like // +build tools https://github.com/ossf/scorecard/blob/main/tools/tools.go
• Use GitHub action https://github.com/golangci/golangci-lint-action

[vpereira01]

curl download removed with #1785
This issue can be closed IMHO.