This function is flawed, containing unquoted variable interpolations:

  s=$(curl -fsSL $1)
  ...
  c=$(echo $s | shasum | awk '{print $1}')

what it means is that the checksum is being calculated on a whitespace-mangled version of the data that is pulled down from the web.

It appears to work because the author calculated the checksums with the same script and is just validating that they are not changing.

In other words, it's possible to make whitespace changes such that the hash won't change.

Here are two scripts: a harmless one and a malicious one, which produce the same whitespace-ignorant SHA256:

  $ foo='# this is a comment
  > # rm -rf /'

  $ echo $foo | sha256sum 
  8b87547d4d214038b153ce57d929be4c835b7690c930c1e83a25fc1509390cf9  -

  $ foo='# this is a comment #
  > rm -rf /'
  $ echo $foo | sha256sum 
  8b87547d4d214038b153ce57d929be4c835b7690c930c1e83a25fc1509390cf9  -

The first foo contains two comments. The "rm -rf /" command is commented out. The second foo moves the hash mark of the second comment into the previous line, uncommenting the command.

(I know about GNU Coreutils' safeguard in rm against removing / recursively, by the way.)