Is common_schema safe?
It's me :P

Good point on not having checksum for the sql file, I'll get some.

Your hesitation is commendable. And it's quite difficult to review the code line by line; there are stored procedures involved which are actually being executed -- I wouldn't want to review any single line of code of, say grep, or apache or... anything.

Noteworthy is that the project has moved to GitHub. The authenticy of the code in this link is as good as any SHA1 checksum I would publish on that same page.

So what next? This is known (to me) to have been downloaded tens of thousands of times; I've installed it in production on hundreds of servers; also I'm a nice guy.

It's actually a wonderful question; how can I make one trust my code? Providing a checksum is more for you to know no one else tampered with my code. I suppose you rely on the wisdom of the masses, on Google, on author's reputation (see my blog, my GitHub profile, BTW I work for GitHub). I got aware of this question having been notified by a friend in the MySQL community who is also a great stackeschange member... Thanks @RickJames

Oh: you can always import common_schema onto a replica, without endangering your master; then you are able to checksum your entire data to prove that common_schema hasn't done anything evil. The fact you can do it is likely to give you confidence. Or just do it.

I never had more fun answering a question on stackexchange.