@PeterSchafer @j-luong Have seen some checksum failed errors recently and it's not altogether clear why, which suggests that curl got an response from the remote server that indicated there was an error and saved it to the output file and returned zero as the exit code.

Should this script use --fail-with-body with curl to cause 4xx error codes to be considered failures as well?

The errors also highlighted than if there is an issue with the binary downloaded from downloads.snyk.io/cli due to the checksum, there is no fallback to static.snyk.io/cli. Only individual downloads will fallback, so could end up with a binary from https://downloads.snyk.io/cli and checksum from https://static.snyk.io/cli and not clear if that is a problem.

#150 Is a revert of this merged feature, for the record.

In my opinion, if the binary is downloaded from one of the sources, than the checksum file should also be downloaded from the exact same source. I'm thinking of a scenario where both are out of sync, for some reason, and they the are downloaded from different sources.