Thats how it works in theory, but in practice it comes down to trust more than anything else.

Its more effort to read and validate your list than it is to just go and download the installer directly. So you need people to trust you.

Sure, you might today, but tomorrow? How can anyone trust that you wont start serving malicious links?

Better is a wild claim.

You’re right, gists do seem to update with the static url, however that isnt necessarily better, it now means your gist is effectively under your control, and you can replace the installers with malware packed ones. Operating a software repository/installer requires that people trust you, and that is basically impossible for a no-name dev with no history.

You ideally should be doing checksum checks as well.

Updating the gist gives a new URL no?

Some feedback:

let remote_url = "https://gist.githubusercontent.com/ZeSystem-Inc/20ddc1ac41d73c6033cee3b4a5ab1a85/raw";

You have effectively hardcoded the list of software you support, ideally you should be able to dynamically update the list, otherwise you have no way to revoke or update versions if required. And if its hardcoded, why bother network requesting for it, just build it into the binary. Would be a little larger binary, but even faster.

No dependency resolution – eliminates fragility.

Meaningless, there is no dependency resolution because thats done for you by the installers.

Written in Rust – memory-safe, zero-cost, ultra-fast.

The task you are doing is entirely IO bound, rusts performance is irrelevant.