fix(aztec-up): add truncation protection to install scripts

[nchamo]

Problem

The install and aztec-install scripts are both fetched and executed via curl | bash (e.g. bash -i <(curl -s https://install.aztec.network) for aztec-install, and curl -fsSL "$install_url" | bash in aztec-up line 163 for install).

When bash reads from a pipe, it processes input incrementally. If the download is truncated mid-stream (network drop, CDN timeout, partial response), bash can execute the portion it has already read, leaving the system in a broken or partially-configured state. For example, a truncated install script could create the version directory and download the versions manifest but never install the actual toolchain binaries, leaving users with a seemingly-installed but non-functional version.

aztec-up itself already has this protection (lines 4-6 and 496-498), but the two scripts it downloads and pipes to bash did not.

Fix

Wrapped both scripts in { ... exit; }, the same pattern already used by aztec-up:

#!/usr/bin/env bash
# Guard against truncated curl downloads: bash must parse the entire {} block before executing any of it.
{
set -euo pipefail

# ... script body ...

main "$@"

# Explicit exit prevents bash from reading past the closing brace.
exit
}

The {} grouping forces bash to read and parse the entire block before executing any of it. If the download is truncated, bash hits a parse error (unclosed {) and refuses to run anything. The explicit exit before } ensures the shell terminates cleanly and doesn't attempt to parse any trailing data.

Files changed:

• aztec-install: the root bootstrap script users invoke directly via curl
• install: the per-version installer that aztec-up downloads and pipes to bash

Fixes F-481

[mverzilli]

🚀

[AztecBot]

✅ Successfully backported to backport-to-v4-next-staging #21899.