install.sh: Alacritty from its release DMG, under a stated rule

Homebrew disabled the alacritty cask on 2026-09-01: upstream builds are ad-hoc
signed and not notarized. Existing installs kept it, but a new Mac got no
Alacritty, and this repo's config, Dock, Hammerspoon and terminal-set-opacity
all assume one.

Clearing a quarantine flag is now allowed under one rule instead of never: the
file is pinned by a hash reviewed here, its signature verifies as unmodified,
and the app is named explicitly. Alacritty passes -- the v0.17.0 DMG matches
GitHub's published digest, and codesign --verify --deep --strict passes.
toggleMute failed on the signature, which is why it stays dropped. The hash is
hard-coded rather than looked up, since a checksum fetched beside the file
catches corruption, not substitution.

The filed version wrapped the steps in `( set -euo pipefail ... ) || warn`,
and bash ignores set -e on the left of ||: a wrong hash still installed the
app. Each step now exits by hand. Tested against a scratch target with the
right hash, a wrong hash, and a failing signature check.

From change request 56fc45.

1 files changed, 39 insertions, 4 deletions

diff --git a/install.sh b/install.sh
index 71e29d1..da037a7 100755
--- a/install.sh
+++ b/install.sh
@@ -81,10 +81,45 @@ if [[ "$(uname)" == "Darwin" ]]; then
     >&2 echo
   fi
 
-  # Nothing here clears a quarantine flag. An app that will not open without
-  # that is an app macOS cannot attribute to anyone, and a setup script that
-  # runs on every machine is the wrong place to decide that is fine -- see the
-  # note in the Brewfile about toggleMute, which was dropped for this reason.
+  # Clearing a quarantine flag puts an app past Gatekeeper, so here it happens
+  # only under one rule: the file is pinned by a hash reviewed in this repo,
+  # its code signature is intact -- nothing changed since it was signed -- and
+  # the app is named explicitly, never matched by a loop. Both checks run
+  # below; failing either leaves the app uninstalled. A Developer ID is not
+  # required, which is the point: an ad-hoc signed app can still be exactly
+  # the bytes that were reviewed. What the rule refuses is an app that cannot
+  # be pinned or whose bundle is altered -- toggleMute, dropped from the
+  # Brewfile, failed it on the signature.
+  #
+  # Alacritty: Homebrew disabled its cask on 2026-09-01 because upstream builds
+  # are ad-hoc signed and not notarized. The hash is hard-coded rather than
+  # looked up from the release: a checksum fetched from the same place as the
+  # file catches a corrupt download, not a swapped one. Bump both together, by
+  # hand, after checking the new hash against GitHub's published asset digest.
+  # Fresh installs only; an existing Alacritty is left alone.
+  if [[ ! -d /Applications/Alacritty.app ]]
+  then
+    # Every step exits on failure by hand. `set -e` would look like it does
+    # the same, but bash ignores it inside anything on the left of `||` --
+    # this subshell included -- and with it every check below became advisory:
+    # a wrong hash still installed the app, which is how this was found.
+    (
+      version="0.17.0"
+      sha256="ad8d7de35fb38e43184776cac6dfee05ca325caa0b6639a06a55e54e4b026620"
+      dmg="$(mktemp -d)/Alacritty-v${version}.dmg" || exit 1
+      curl -fsSL -o "$dmg" \
+        "https://github.com/alacritty/alacritty/releases/download/v${version}/Alacritty-v${version}.dmg" \
+        || exit 1
+      echo "${sha256}  ${dmg}" | shasum -a 256 -c - >/dev/null || exit 1
+      mnt="$(hdiutil attach -nobrowse -readonly "$dmg" | awk -F'\t' '/\/Volumes\//{print $NF}')"
+      [[ -n "$mnt" ]] || exit 1
+      trap 'hdiutil detach -quiet "$mnt" 2>/dev/null || true' EXIT
+      codesign --verify --deep --strict "$mnt/Alacritty.app" || exit 1
+      cp -R "$mnt/Alacritty.app" /Applications/ || exit 1
+      xattr -dr com.apple.quarantine /Applications/Alacritty.app || exit 1
+      echo "INFO: installed $(/Applications/Alacritty.app/Contents/MacOS/alacritty --version)"
+    ) || >&2 echo "WARNING: Alacritty not installed: download, hash or signature check failed"
+  fi
 fi
 
 # 2. Checkouts the config reads: the pure prompt (config/zshrc falls back to a