diff options
Diffstat (limited to 'install.sh')
| -rwxr-xr-x | install.sh | 44 |
1 files changed, 12 insertions, 32 deletions
@@ -51,21 +51,18 @@ if [[ "$(uname)" == "Darwin" ]]; then >&2 echo ' /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"' exit 1 fi - # Two casks in the Brewfile come from their authors' own taps. Homebrew gates + # One cask in the Brewfile comes from its author's own tap. Homebrew gates # unofficial taps behind `brew trust`, recorded per machine in # $XDG_CONFIG_HOME/homebrew/trust.json, so it cannot live in the Brewfile. # Measured on 2026-10-01 rather than assumed: the gate refused an untrusted - # *formula* outright, while these two casks installed through brew bundle - # without it and only quickmd ended up recorded. So this is a precaution that - # keeps working if the gate tightens, not a step the install depends on - # today. Naming the casks rather than the taps keeps the trust to these two - # files and not whatever the taps add later. Older Homebrews have no `trust` - # subcommand and need nothing, hence the guard. + # *formula* outright, while this cask installed through brew bundle without + # it. So this is a precaution that keeps working if the gate tightens, not a + # step the install depends on today. Naming the cask rather than the tap + # keeps the trust to this one file and not whatever the tap adds later. Older + # Homebrews have no `trust` subcommand and need nothing, hence the guard. if brew help trust >/dev/null 2>&1; then - for untrusted_cask in satrik/togglemute/togglemute b451c/quickmd/quickmd; do - brew trust --cask "${untrusted_cask}" >/dev/null || \ - >&2 echo "WARNING: could not trust ${untrusted_cask}; brew bundle will skip it" - done + brew trust --cask b451c/quickmd/quickmd >/dev/null || \ + >&2 echo "WARNING: could not trust b451c/quickmd/quickmd; brew bundle will skip it" fi # --no-upgrade: install what is missing and leave what is there alone. Plain @@ -84,27 +81,10 @@ if [[ "$(uname)" == "Darwin" ]]; then >&2 echo fi - # toggleMute will not open while the download carries com.apple.quarantine, - # and the author's install instructions say to clear it. What that costs is - # worth stating exactly, because it is worse than "not notarized" (checked - # 2026-10-01): the app is ad-hoc signed, TeamIdentifier is not set, and - # `spctl -a` rejects it with "invalid Info.plist (plist or signature have - # been modified)". There is no verifiable publisher, and macOS considers the - # bundle altered since it was signed. Clearing quarantine is the only way to - # run it, so this is a deliberate exception for one app -- hence the explicit - # path rather than a loop over /Applications, and only that one attribute - # rather than the `xattr -cr` the README asks for, which would strip every - # extended attribute the bundle has. - # - # QuickMD needs none of this: it is signed with a Developer ID and notarized, - # so its quarantine flag costs one dialog and nothing more. - togglemute_app="/Applications/toggleMute.app" - if [[ -d "${togglemute_app}" ]] && - xattr "${togglemute_app}" 2>/dev/null | grep -q com.apple.quarantine - then - echo "INFO: clearing the quarantine flag on ${togglemute_app}" - xattr -dr com.apple.quarantine "${togglemute_app}" - fi + # Nothing here clears a quarantine flag. An app that will not open without + # that is an app macOS cannot attribute to anyone, and a setup script that + # runs on every machine is the wrong place to decide that is fine -- see the + # note in the Brewfile about toggleMute, which was dropped for this reason. fi # 2. Checkouts the config reads: the pure prompt (config/zshrc falls back to a |