Shell, editor and terminal configuration, and the tools that go with them https://git.soarez.net/sz/dot.git/atom?h=master 2026-10-03T03:18:53+00:00 2026-10-03T03:18:53+00:00 Igor Soarez igor@soarez.org 2026-10-03T03:18:53+00:00 urn:sha1:013b5922d1b8401fe8eb47a8834f01fba1e1ad5a Homebrew disabled the alacritty cask on 2026-09-01: upstream builds are ad-hoc signed and not notarized. Existing installs kept it, but a new Mac got no Alacritty, and this repo's config, Dock, Hammerspoon and terminal-set-opacity all assume one. Clearing a quarantine flag is now allowed under one rule instead of never: the file is pinned by a hash reviewed here, its signature verifies as unmodified, and the app is named explicitly. Alacritty passes -- the v0.17.0 DMG matches GitHub's published digest, and codesign --verify --deep --strict passes. toggleMute failed on the signature, which is why it stays dropped. The hash is hard-coded rather than looked up, since a checksum fetched beside the file catches corruption, not substitution. The filed version wrapped the steps in `( set -euo pipefail ... ) || warn`, and bash ignores set -e on the left of ||: a wrong hash still installed the app. Each step now exits by hand. Tested against a scratch target with the right hash, a wrong hash, and a failing signature check. From change request 56fc45. 2026-10-01T18:12:39+00:00 Igor Soarez igor@soarez.org 2026-10-01T18:12:39+00:00 urn:sha1:cf4c4424a695235f7288a64ab47e6f71d9e23dc0 Ad-hoc signed, no TeamIdentifier, and spctl rejects the bundle as modified since signing, so it only runs with its quarantine flag cleared. A setup script that every machine runs is the wrong place to put an unverifiable binary past Gatekeeper, so the xattr step goes with it and install.sh now says it clears no quarantine flags at all. QuickMD stays: Developer ID, notarized. 2026-10-01T18:10:47+00:00 Igor Soarez igor@soarez.org 2026-10-01T18:10:47+00:00 urn:sha1:251ebd6e5bfe747a1d9f83a49abf6d393ee4aee1 Checked rather than assumed. QuickMD is signed with a Developer ID and notarized, so its quarantine flag costs a dialog. toggleMute is ad-hoc signed with no TeamIdentifier, and spctl rejects it as modified since signing -- so the quarantine step is not 'it is not notarized' but 'there is no verifiable publisher'. The trust gate also turned out looser than the first note claimed: it refused an untrusted formula, but both casks installed without it. 2026-10-01T18:07:46+00:00 Igor Soarez igor@soarez.org 2026-10-01T18:07:46+00:00 urn:sha1:5b882ce27970e17bb3ddfe08e2c59a53a00b00a2 Neither is in homebrew-cask. That costs three things this file cannot express on its own, so install.sh carries them: brew will not load a cask from an unofficial tap until it is trusted, which is per machine and recorded outside the repo; the trust is granted per cask rather than per tap, so it covers these two files and not whatever the taps add later; and toggleMute is not notarized, so Gatekeeper refuses it until com.apple.quarantine is cleared -- that one attribute on that one path, not the `xattr -cr` its README asks for. Nothing here vouches for either binary, and a third-party tap can change what it installs between two runs. Both are deliberate exceptions, named as such. 2026-09-21T11:57:57+00:00 Igor Soarez igor@soarez.org 2026-09-21T11:57:57+00:00 urn:sha1:f671fb679b303e9f4de270414c008ad7129e6c25 Supermaven was running everywhere. Its `condition` option reads the other way round from what the code assumed -- `true` stops it -- so `return false` meant "never stop", and the plugin loaded on InsertEnter, started its agent and offered inline suggestions on every machine. Only blink's source for it was off, which is what made it look disabled. It sends buffer context to a third party, so it is now opt-in: DOT_SUPERMAVEN=1, in ~/.localenv where it is wanted. Off, lazy keeps both plugins off disk entirely. install.sh no longer stops at brew bundle either. A managed machine can refuse a cask outright -- "disabled because it does not pass the macOS Gatekeeper check" -- and brew bundle fails the whole run for one such entry, which left the checkouts, nvim plugins and colour files undone. It warns and carries on; brew has already named the entry. 2026-09-21T11:37:35+00:00 Igor Soarez igor@soarez.org 2026-09-21T11:37:35+00:00 urn:sha1:352bd588135b62f0da548d22188c829143bdbe32 Three things a machine set up from this repo alone hit on its first run: Homebrew was a dead end -- install.sh printed the command and exited, leaving the one prerequisite everything else needs to be run by hand. It installs it now, NONINTERACTIVE so it does not wait on a RETURN; the sudo password is still asked for, which is why this script is run by hand. bash was missing from the Brewfile, so bin/open and secrets/ ran under the 3.2 macOS ships and failed on `${v,,}`; config/bashrc also looks for the bash-completion 2.x that wants 4.2. Ghostty refused to start -- "error opening config-file ... error.FileNotFound" -- because config-file pointed at the colour file bin/theme writes, which does not exist until theme has run. The include is optional now (`?`), and this script seeds the colour files when a machine has none, leaving a machine that already has a theme alone. 2026-09-17T18:45:23+00:00 Igor Soarez igor@soarez.org 2026-09-17T18:45:23+00:00 urn:sha1:13cc065ec014b86369dfe4ad60d1a43fa06fd251 Shell, editor and terminal configuration, the tools that go with them, and szecret, an age-based secret manager whose store lives elsewhere. History restarts here. What came before was not written to be read by anyone else, and carried machine names, addresses and an encrypted secret store; it is kept privately instead. What is left is meant to be safe on any machine, including one whose owner is not me: see CLAUDE.md for the rule it is written to.