| @@ -1,7 +1,55 @@ |
| 1 | # Install `mm` on macOS | 1 | # Install `mm` on macOS |
| 2 | | 2 | |
| | 3 | +Short version: |
| | 4 | +```bash |
| | 5 | +VERSION=1.0.5 |
| | 6 | +curl -fsSLO "https://rickub.com/bots-garden/mini-me/releases/download/v${VERSION}/mm-${VERSION}-darwin-arm64" |
| | 7 | +chmod +x ./mm-${VERSION}-darwin-arm64 |
| | 8 | +sudo rm -f /usr/local/bin/mm |
| | 9 | +sudo cp ./mm-${VERSION}-darwin-arm64 /usr/local/bin/mm |
| | 10 | +mm --version |
| | 11 | +``` |
| | 12 | + |
| | 13 | +From v1.0.5, the macOS binary is signed with a Developer ID and notarized by Apple. You can check who signed it before you install it, and there is no quarantine attribute to remove. |
| | 14 | + |
| 3 | ```bash | 15 | ```bash |
| 4 | # download the binary release in https://rickub.com/bots-garden/mini-me/releases | 16 | # download the binary release in https://rickub.com/bots-garden/mini-me/releases |
| | 17 | +VERSION=1.0.5 |
| | 18 | +curl -fsSLO "https://rickub.com/bots-garden/mini-me/releases/download/v${VERSION}/mm-${VERSION}-darwin-arm64" |
| | 19 | + |
| | 20 | +# optional: check the download against the release's checksums |
| | 21 | +curl -fsSLO "https://rickub.com/bots-garden/mini-me/releases/download/v${VERSION}/SHA256SUMS" |
| | 22 | +shasum -a 256 -c --ignore-missing SHA256SUMS |
| | 23 | + |
| | 24 | +# check the signature: valid, and made by the mini-me Developer ID |
| | 25 | +codesign --verify --strict --verbose=2 ./mm-${VERSION}-darwin-arm64 |
| | 26 | +codesign -dv --verbose=4 ./mm-${VERSION}-darwin-arm64 2>&1 | grep -E "^Identifier|^Authority=Developer ID Application|^TeamIdentifier" |
| | 27 | + |
| | 28 | +chmod +x ./mm-${VERSION}-darwin-arm64 |
| | 29 | +sudo rm -f /usr/local/bin/mm |
| | 30 | +sudo cp ./mm-${VERSION}-darwin-arm64 /usr/local/bin/mm |
| | 31 | +mm --version |
| | 32 | +``` |
| | 33 | + |
| | 34 | +The signature check should print: |
| | 35 | + |
| | 36 | +``` |
| | 37 | +./mm-1.0.5-darwin-arm64: valid on disk |
| | 38 | +./mm-1.0.5-darwin-arm64: satisfies its Designated Requirement |
| | 39 | +Identifier=com.bots-garden.mm |
| | 40 | +Authority=Developer ID Application: Philippe Charriere (SNLLBZP9V9) |
| | 41 | +TeamIdentifier=SNLLBZP9V9 |
| | 42 | +``` |
| | 43 | + |
| | 44 | +Downloaded **with a browser** instead of `curl`, the file carries the quarantine attribute: macOS checks the notarization online the first time you run it (so that first run needs the network), then runs it without asking. There is no need for `xattr`. |
| | 45 | + |
| | 46 | +## Versions up to v1.0.4 (not signed) |
| | 47 | + |
| | 48 | +Up to v1.0.4, the macOS binary was not signed with a Developer ID: it only had the ad hoc signature the Go linker gives every darwin/arm64 binary. A copy that macOS had put in quarantine (a browser download, for example) was blocked at its first run, with "Apple could not verify…". The `xattr -cr` line removed the quarantine attribute so that the binary could run. There is nothing to check with `codesign` for these versions. |
| | 49 | + |
| | 50 | +Use this block only to install one of these older versions: |
| | 51 | + |
| | 52 | +```bash |
| 5 | VERSION=1.0.4 | 53 | VERSION=1.0.4 |
| 6 | curl -fsSLO "https://rickub.com/bots-garden/mini-me/releases/download/v${VERSION}/mm-${VERSION}-darwin-arm64" | 54 | curl -fsSLO "https://rickub.com/bots-garden/mini-me/releases/download/v${VERSION}/mm-${VERSION}-darwin-arm64" |
| 7 | chmod +x ./mm-${VERSION}-darwin-arm64 | 55 | chmod +x ./mm-${VERSION}-darwin-arm64 |
| @@ -9,4 +57,3 @@ xattr -cr ./mm-${VERSION}-darwin-arm64 |
| 9 | sudo rm -f /usr/local/bin/mm | 57 | sudo rm -f /usr/local/bin/mm |
| 10 | sudo cp ./mm-${VERSION}-darwin-arm64 /usr/local/bin/mm | 58 | sudo cp ./mm-${VERSION}-darwin-arm64 /usr/local/bin/mm |
| 11 | ``` | 59 | ``` |
| 12 | - | | |