Brewfile: toggleMute and QuickMD, from their authors' taps

Neither is in homebrew-cask. That costs three things this file cannot express
on its own, so install.sh carries them: brew will not load a cask from an
unofficial tap until it is trusted, which is per machine and recorded outside
the repo; the trust is granted per cask rather than per tap, so it covers these
two files and not whatever the taps add later; and toggleMute is not notarized,
so Gatekeeper refuses it until com.apple.quarantine is cleared -- that one
attribute on that one path, not the `xattr -cr` its README asks for.

Nothing here vouches for either binary, and a third-party tap can change what
it installs between two runs. Both are deliberate exceptions, named as such.

1 files changed, 28 insertions, 0 deletions

diff --git a/install.sh b/install.sh
index a9b1f7a..3ee3f67 100755
--- a/install.sh
+++ b/install.sh
@@ -51,6 +51,19 @@ if [[ "$(uname)" == "Darwin" ]]; then
     >&2 echo '  /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"'
     exit 1
   fi
+  # Two casks in the Brewfile come from their authors' own taps, and brew
+  # refuses to load a cask from an unofficial tap until it is trusted. Trust is
+  # per machine, recorded in $XDG_CONFIG_HOME/homebrew/trust.json, so it cannot
+  # live in the Brewfile; naming the casks rather than the taps keeps the trust
+  # to these two files instead of everything the taps ever add. Older Homebrews
+  # have no `trust` subcommand and need nothing, hence the guard.
+  if brew help trust >/dev/null 2>&1; then
+    for untrusted_cask in satrik/togglemute/togglemute b451c/quickmd/quickmd; do
+      brew trust --cask "${untrusted_cask}" >/dev/null || \
+        >&2 echo "WARNING: could not trust ${untrusted_cask}; brew bundle will skip it"
+    done
+  fi
+
   # --no-upgrade: install what is missing and leave what is there alone. Plain
   # `brew bundle` also upgrades every listed package that is out of date.
   #
@@ -66,6 +79,21 @@ if [[ "$(uname)" == "Darwin" ]]; then
     >&2 echo "above). Continuing with the rest of the setup."
     >&2 echo
   fi
+
+  # toggleMute is not notarized, so Gatekeeper refuses to open it while the
+  # download carries com.apple.quarantine, and the author's install
+  # instructions say to clear it. Only that one attribute, not the `xattr -cr`
+  # the README asks for, which strips every extended attribute the app has.
+  # Nothing here can vouch for the binary: this is a deliberate exception for
+  # one app, which is why it names the path rather than looping over
+  # /Applications.
+  togglemute_app="/Applications/toggleMute.app"
+  if [[ -d "${togglemute_app}" ]] &&
+     xattr "${togglemute_app}" 2>/dev/null | grep -q com.apple.quarantine
+  then
+    echo "INFO: clearing the quarantine flag on ${togglemute_app}"
+    xattr -dr com.apple.quarantine "${togglemute_app}"
+  fi
 fi
 
 # 2. Checkouts the config reads: the pure prompt (config/zshrc falls back to a