From cf4c4424a695235f7288a64ab47e6f71d9e23dc0 Mon Sep 17 00:00:00 2001 From: Igor Soarez Date: Thu, 1 Oct 2026 21:12:39 +0300 Subject: Brewfile: drop toggleMute Ad-hoc signed, no TeamIdentifier, and spctl rejects the bundle as modified since signing, so it only runs with its quarantine flag cleared. A setup script that every machine runs is the wrong place to put an unverifiable binary past Gatekeeper, so the xattr step goes with it and install.sh now says it clears no quarantine flags at all. QuickMD stays: Developer ID, notarized. --- Brewfile | 28 ++++++++++++---------------- install.sh | 44 ++++++++++++-------------------------------- 2 files changed, 24 insertions(+), 48 deletions(-) diff --git a/Brewfile b/Brewfile index 800741f..eac03d9 100644 --- a/Brewfile +++ b/Brewfile @@ -41,23 +41,19 @@ cask "neovide-app" cask "keepingyouawake" # menu-bar toggle that stops the Mac sleeping cask "jordanbaird-ice" # Ice: hides and arranges the menu bar itself -# Neither of these is in homebrew-cask, so they come from their authors' own -# taps, with what that means: nobody reviewed the cask, and the tap can change -# what it installs between two runs of install.sh, which applies this file -# again every time. brew will not load a cask from an unofficial tap until it -# is trusted, once per machine, which cannot be expressed here -- install.sh -# does it, so the decision sits in a tracked file rather than in a README -# someone pastes from. -tap "satrik/togglemute" +# Not in homebrew-cask, so it comes from the author's own tap, with what that +# means: nobody reviewed the cask, and the tap can change what it installs +# between two runs of install.sh, which applies this file again every time. +# What earns it that: the app is signed with a Developer ID and notarized +# (checked 2026-10-01), so macOS can still say who shipped it. +# +# toggleMute was here too and was dropped: ad-hoc signed, no TeamIdentifier, +# and `spctl -a` rejecting the bundle as modified since signing. It only runs +# with its quarantine flag cleared, and nothing in a shared setup script should +# quietly put an unverifiable binary past Gatekeeper on every machine. tap "b451c/quickmd" -cask "satrik/togglemute/togglemute" # menu-bar mic mute, and it follows the - # hardware mute button on a headset. - # Ad-hoc signed, no Developer ID, and - # spctl calls the bundle modified, so it - # only opens once install.sh clears its - # quarantine flag -- see the note there -cask "b451c/quickmd/quickmd" # qmd.app: native markdown viewer, live - # preview, AppKit rather than Electron +cask "b451c/quickmd/quickmd" # qmd.app: native markdown viewer, live preview, + # AppKit rather than Electron # Only where no Ghostty is installed yet: a machine running the ghostty@tip # build would collide with a second cask over /Applications/Ghostty.app. diff --git a/install.sh b/install.sh index 4351357..71e29d1 100755 --- a/install.sh +++ b/install.sh @@ -51,21 +51,18 @@ if [[ "$(uname)" == "Darwin" ]]; then >&2 echo ' /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"' exit 1 fi - # Two casks in the Brewfile come from their authors' own taps. Homebrew gates + # One cask in the Brewfile comes from its author's own tap. Homebrew gates # unofficial taps behind `brew trust`, recorded per machine in # $XDG_CONFIG_HOME/homebrew/trust.json, so it cannot live in the Brewfile. # Measured on 2026-10-01 rather than assumed: the gate refused an untrusted - # *formula* outright, while these two casks installed through brew bundle - # without it and only quickmd ended up recorded. So this is a precaution that - # keeps working if the gate tightens, not a step the install depends on - # today. Naming the casks rather than the taps keeps the trust to these two - # files and not whatever the taps add later. Older Homebrews have no `trust` - # subcommand and need nothing, hence the guard. + # *formula* outright, while this cask installed through brew bundle without + # it. So this is a precaution that keeps working if the gate tightens, not a + # step the install depends on today. Naming the cask rather than the tap + # keeps the trust to this one file and not whatever the tap adds later. Older + # Homebrews have no `trust` subcommand and need nothing, hence the guard. if brew help trust >/dev/null 2>&1; then - for untrusted_cask in satrik/togglemute/togglemute b451c/quickmd/quickmd; do - brew trust --cask "${untrusted_cask}" >/dev/null || \ - >&2 echo "WARNING: could not trust ${untrusted_cask}; brew bundle will skip it" - done + brew trust --cask b451c/quickmd/quickmd >/dev/null || \ + >&2 echo "WARNING: could not trust b451c/quickmd/quickmd; brew bundle will skip it" fi # --no-upgrade: install what is missing and leave what is there alone. Plain @@ -84,27 +81,10 @@ if [[ "$(uname)" == "Darwin" ]]; then >&2 echo fi - # toggleMute will not open while the download carries com.apple.quarantine, - # and the author's install instructions say to clear it. What that costs is - # worth stating exactly, because it is worse than "not notarized" (checked - # 2026-10-01): the app is ad-hoc signed, TeamIdentifier is not set, and - # `spctl -a` rejects it with "invalid Info.plist (plist or signature have - # been modified)". There is no verifiable publisher, and macOS considers the - # bundle altered since it was signed. Clearing quarantine is the only way to - # run it, so this is a deliberate exception for one app -- hence the explicit - # path rather than a loop over /Applications, and only that one attribute - # rather than the `xattr -cr` the README asks for, which would strip every - # extended attribute the bundle has. - # - # QuickMD needs none of this: it is signed with a Developer ID and notarized, - # so its quarantine flag costs one dialog and nothing more. - togglemute_app="/Applications/toggleMute.app" - if [[ -d "${togglemute_app}" ]] && - xattr "${togglemute_app}" 2>/dev/null | grep -q com.apple.quarantine - then - echo "INFO: clearing the quarantine flag on ${togglemute_app}" - xattr -dr com.apple.quarantine "${togglemute_app}" - fi + # Nothing here clears a quarantine flag. An app that will not open without + # that is an app macOS cannot attribute to anyone, and a setup script that + # runs on every machine is the wrong place to decide that is fine -- see the + # note in the Brewfile about toggleMute, which was dropped for this reason. fi # 2. Checkouts the config reads: the pure prompt (config/zshrc falls back to a -- cgit v1.2.3