install.sh: Alacritty from its release DMG, under a stated rule Homebrew disabled the alacritty cask on 2026-09-01: upstream builds are ad-hoc signed and not notarized. Existing installs kept it, but a new Mac got no Alacritty, and this repo's config, Dock, Hammerspoon and terminal-set-opacity all assume one. Clearing a quarantine flag is now allowed under one rule instead of never: the file is pinned by a hash reviewed here, its signature verifies as unmodified, and the app is named explicitly. Alacritty passes -- the v0.17.0 DMG matches GitHub's published digest, and codesign --verify --deep --strict passes. toggleMute failed on the signature, which is why it stays dropped. The hash is hard-coded rather than looked up, since a checksum fetched beside the file catches corruption, not substitution. The filed version wrapped the steps in `( set -euo pipefail ... ) || warn`, and bash ignores set -e on the left of ||: a wrong hash still installed the app. Each step now exits by hand. Tested against a scratch target with the right hash, a wrong hash, and a failing signature check. From change request 56fc45.
Igor Soarez igor@soarez.org
Sat, 03 Oct 2026 06:18:53 +0300
2 files changed,
41 insertions(+),
5 deletions(-)
M
Brewfile
→
Brewfile
@@ -34,7 +34,8 @@
# Wanted on any machine this account uses, though nothing here reads them. brew "glow" # markdown rendered in the terminal -cask "alacritty" +# Not alacritty: Homebrew disabled that cask on 2026-09-01 (it fails the +# Gatekeeper check), so install.sh installs it from the release DMG, pinned. cask "hammerspoon" cask "neovide-app" # Wanted on any Mac this account uses, though nothing here depends on it.
M
install.sh
→
install.sh
@@ -81,10 +81,45 @@ >&2 echo "above). Continuing with the rest of the setup."
>&2 echo fi - # Nothing here clears a quarantine flag. An app that will not open without - # that is an app macOS cannot attribute to anyone, and a setup script that - # runs on every machine is the wrong place to decide that is fine -- see the - # note in the Brewfile about toggleMute, which was dropped for this reason. + # Clearing a quarantine flag puts an app past Gatekeeper, so here it happens + # only under one rule: the file is pinned by a hash reviewed in this repo, + # its code signature is intact -- nothing changed since it was signed -- and + # the app is named explicitly, never matched by a loop. Both checks run + # below; failing either leaves the app uninstalled. A Developer ID is not + # required, which is the point: an ad-hoc signed app can still be exactly + # the bytes that were reviewed. What the rule refuses is an app that cannot + # be pinned or whose bundle is altered -- toggleMute, dropped from the + # Brewfile, failed it on the signature. + # + # Alacritty: Homebrew disabled its cask on 2026-09-01 because upstream builds + # are ad-hoc signed and not notarized. The hash is hard-coded rather than + # looked up from the release: a checksum fetched from the same place as the + # file catches a corrupt download, not a swapped one. Bump both together, by + # hand, after checking the new hash against GitHub's published asset digest. + # Fresh installs only; an existing Alacritty is left alone. + if [[ ! -d /Applications/Alacritty.app ]] + then + # Every step exits on failure by hand. `set -e` would look like it does + # the same, but bash ignores it inside anything on the left of `||` -- + # this subshell included -- and with it every check below became advisory: + # a wrong hash still installed the app, which is how this was found. + ( + version="0.17.0" + sha256="ad8d7de35fb38e43184776cac6dfee05ca325caa0b6639a06a55e54e4b026620" + dmg="$(mktemp -d)/Alacritty-v${version}.dmg" || exit 1 + curl -fsSL -o "$dmg" \ + "https://github.com/alacritty/alacritty/releases/download/v${version}/Alacritty-v${version}.dmg" \ + || exit 1 + echo "${sha256} ${dmg}" | shasum -a 256 -c - >/dev/null || exit 1 + mnt="$(hdiutil attach -nobrowse -readonly "$dmg" | awk -F'\t' '/\/Volumes\//{print $NF}')" + [[ -n "$mnt" ]] || exit 1 + trap 'hdiutil detach -quiet "$mnt" 2>/dev/null || true' EXIT + codesign --verify --deep --strict "$mnt/Alacritty.app" || exit 1 + cp -R "$mnt/Alacritty.app" /Applications/ || exit 1 + xattr -dr com.apple.quarantine /Applications/Alacritty.app || exit 1 + echo "INFO: installed $(/Applications/Alacritty.app/Contents/MacOS/alacritty --version)" + ) || >&2 echo "WARNING: Alacritty not installed: download, hash or signature check failed" + fi fi # 2. Checkouts the config reads: the pure prompt (config/zshrc falls back to a