diff options
| -rw-r--r-- | Brewfile | 3 | ||||
| -rwxr-xr-x | install.sh | 43 |
2 files changed, 41 insertions, 5 deletions
@@ -34,7 +34,8 @@ brew "tree-sitter-cli" # nvim-treesitter generates and compiles parsers with # Wanted on any machine this account uses, though nothing here reads them. brew "glow" # markdown rendered in the terminal -cask "alacritty" +# Not alacritty: Homebrew disabled that cask on 2026-09-01 (it fails the +# Gatekeeper check), so install.sh installs it from the release DMG, pinned. cask "hammerspoon" cask "neovide-app" # Wanted on any Mac this account uses, though nothing here depends on it. @@ -81,10 +81,45 @@ if [[ "$(uname)" == "Darwin" ]]; then >&2 echo fi - # Nothing here clears a quarantine flag. An app that will not open without - # that is an app macOS cannot attribute to anyone, and a setup script that - # runs on every machine is the wrong place to decide that is fine -- see the - # note in the Brewfile about toggleMute, which was dropped for this reason. + # Clearing a quarantine flag puts an app past Gatekeeper, so here it happens + # only under one rule: the file is pinned by a hash reviewed in this repo, + # its code signature is intact -- nothing changed since it was signed -- and + # the app is named explicitly, never matched by a loop. Both checks run + # below; failing either leaves the app uninstalled. A Developer ID is not + # required, which is the point: an ad-hoc signed app can still be exactly + # the bytes that were reviewed. What the rule refuses is an app that cannot + # be pinned or whose bundle is altered -- toggleMute, dropped from the + # Brewfile, failed it on the signature. + # + # Alacritty: Homebrew disabled its cask on 2026-09-01 because upstream builds + # are ad-hoc signed and not notarized. The hash is hard-coded rather than + # looked up from the release: a checksum fetched from the same place as the + # file catches a corrupt download, not a swapped one. Bump both together, by + # hand, after checking the new hash against GitHub's published asset digest. + # Fresh installs only; an existing Alacritty is left alone. + if [[ ! -d /Applications/Alacritty.app ]] + then + # Every step exits on failure by hand. `set -e` would look like it does + # the same, but bash ignores it inside anything on the left of `||` -- + # this subshell included -- and with it every check below became advisory: + # a wrong hash still installed the app, which is how this was found. + ( + version="0.17.0" + sha256="ad8d7de35fb38e43184776cac6dfee05ca325caa0b6639a06a55e54e4b026620" + dmg="$(mktemp -d)/Alacritty-v${version}.dmg" || exit 1 + curl -fsSL -o "$dmg" \ + "https://github.com/alacritty/alacritty/releases/download/v${version}/Alacritty-v${version}.dmg" \ + || exit 1 + echo "${sha256} ${dmg}" | shasum -a 256 -c - >/dev/null || exit 1 + mnt="$(hdiutil attach -nobrowse -readonly "$dmg" | awk -F'\t' '/\/Volumes\//{print $NF}')" + [[ -n "$mnt" ]] || exit 1 + trap 'hdiutil detach -quiet "$mnt" 2>/dev/null || true' EXIT + codesign --verify --deep --strict "$mnt/Alacritty.app" || exit 1 + cp -R "$mnt/Alacritty.app" /Applications/ || exit 1 + xattr -dr com.apple.quarantine /Applications/Alacritty.app || exit 1 + echo "INFO: installed $(/Applications/Alacritty.app/Contents/MacOS/alacritty --version)" + ) || >&2 echo "WARNING: Alacritty not installed: download, hash or signature check failed" + fi fi # 2. Checkouts the config reads: the pure prompt (config/zshrc falls back to a |