But he’s not using a package, he’s downloading from gir repo and build which exactly same getting a bash script from the same repo and executing it.

It’s not. Try pulling updates after a rebase. Very much not the same as piping arbitrary disembodied text into your shell.