fix: document only the https one-liner

tests/test_site_bootstrap.py

@@ -154,11 +154,14 @@ class DocumentedCommands(unittest.TestCase):
         }
         self.assertEqual(found, {"wiki/installer.md": 2})
 
-    def test_typed_by_hand_without_the_scheme(self):
-        page = (REPO_ROOT / "wiki" / "installer.md").read_text(encoding="utf-8")
+    def test_no_command_drops_the_scheme(self):
+        """A first request in clear text lets anyone on the way serve another
+        script, which the installer's pin cannot catch: the pin is in it."""
         bare = INSTALL_BASE.removeprefix("https://")
-        self.assertIn(f"curl -fL {bare}/{sitebootstrap.SH_NAME} | sh", page)
-        self.assertIn(f"irm {bare}/{sitebootstrap.PS1_NAME} | iex", page)
+        for page in sorted((REPO_ROOT / "wiki").glob("*.md")):
+            text = page.read_text(encoding="utf-8")
+            with self.subTest(page=page.name):
+                self.assertNotRegex(text, rf"(?<![/\w]){re.escape(bare)}/")
 
 
 class NothingElseAtTheseAddresses(unittest.TestCase):
@@ -189,6 +192,10 @@ class NothingElseAtTheseAddresses(unittest.TestCase):
 
     @unittest.skipUnless((WEBSITE / "dist" / "index.html").is_file(), "site not built")
     def test_the_built_site_serves_files_at_the_addresses(self):
+        built = (WEBSITE / "dist" / "index.html").stat().st_mtime
+        written = [WEBSITE / "public" / name for name in self.NAMES]
+        if any(path.is_file() and path.stat().st_mtime > built for path in written):
+            self.skipTest("website/dist was built before these copies were written")
         for name in self.NAMES:
             path = WEBSITE / "dist" / name
             with self.subTest(name=name):

wiki/installer.md

@@ -37,18 +37,8 @@ curl -fsSL https://abdess.github.io/retrobios/i | sh
 irm https://abdess.github.io/retrobios/i.ps1 | iex
 ```
 
-Typed by hand, the address works without `https://`:
-
-```bash
-curl -fL abdess.github.io/retrobios/i | sh
-```
-
-```powershell
-irm abdess.github.io/retrobios/i.ps1 | iex
-```
-
-The `https://` form is safer, because without it the first request goes out
-in clear text and the redirect it gets back could be replaced on the way.
+Always type the `https://`: without it the first request goes out in clear
+text, and anyone on the way could answer with another script.
 
 `i` and `i.ps1` are `install.sh` and `install.ps1` as of the commit the site
 was built from, set to download `install.py` from that same commit. The