buddymac 0.1.1 → 0.1.3

package/README.md

@@ -6,7 +6,7 @@ npx buddymac
 
 Downloads BuddyMac to `~/Applications` and opens it. Requires an Apple Silicon Mac running macOS 26 or later and Node.js 20 or later. No Bun installation is needed.
 
-The installer checks a pinned SHA-256 checksum and Francesco Oddo's Apple Developer signature. It does not overwrite existing apps or change your app data. To update, quit BuddyMac and move the previous app out of the destination first.
+The installer shows download progress and checks a pinned SHA-256 checksum, Francesco Oddo's Apple Developer signature, and macOS Gatekeeper approval. It does not overwrite existing apps or change your app data. To update, quit BuddyMac and move the previous app out of the destination first.
 
 ```sh
 npx buddymac --no-open
@@ -14,6 +14,6 @@ npx buddymac --destination /Applications
 npx buddymac --help
 ```
 
-This early release is signed but not notarized. If macOS blocks the first launch, open System Settings → Privacy & Security → Open Anyway. The installer preserves macOS download protection.
+The app is signed and notarized by Apple, with the notarization ticket included. The installer preserves macOS download protection.
 
 Source and downloads: https://github.com/OxFrancesco/BuddyMac

package/cli.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createHash } from 'node:crypto';
-import { createReadStream, createWriteStream } from 'node:fs';
+import { createWriteStream } from 'node:fs';
 import { access, mkdir, mkdtemp, readFile, rename, rm } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
-import { Readable } from 'node:stream';
+import { Readable, Transform } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 
 const release = JSON.parse(await readFile(new URL('./release.json', import.meta.url), 'utf8'));
@@ -15,8 +15,7 @@ const help = `Usage: npx buddymac [--destination <folder>] [--no-open]
 Installs BuddyMac ${release.version} to ~/Applications and opens it.
 Requires Apple Silicon, macOS 26+, and Node.js 20+.
 Existing apps are never overwritten. Quit and move an old copy before updating.
-This early build is signed but not notarized. macOS may require Open Anyway
-in System Settings > Privacy & Security after the first launch attempt.
+The download is signed and notarized by Apple. macOS download protection stays enabled.
 
   --destination <folder>  Install in a different folder
   --no-open               Install without opening the app
@@ -32,6 +31,7 @@ function run(command, parameters) {
 }
 
 async function install() {
+  const started = performance.now();
   let destination = join(homedir(), 'Applications');
   let open = true;
   for (let i = 0; i < args.length; i++) {
@@ -67,20 +67,46 @@ async function install() {
     stage = await mkdtemp(join(destination, '.buddymac-'));
     const archive = join(stage, 'BuddyMac.zip');
     process.stdout.write(`Downloading BuddyMac ${release.version}…\n`);
+    const downloadStarted = performance.now();
     const response = await fetch(release.url, { signal: AbortSignal.timeout(300_000) });
     if (!response.ok || !response.body) throw new Error(`Download failed: HTTP ${response.status}. ${release.url}`);
-    await pipeline(Readable.fromWeb(response.body), createWriteStream(archive, { flags: 'wx' }));
+    const total = Number(response.headers.get('content-length'));
+    let received = 0;
     const hash = createHash('sha256');
-    for await (const chunk of createReadStream(archive)) hash.update(chunk);
+    const meter = new Transform({ transform(chunk, encoding, done) {
+      received += chunk.length;
+      hash.update(chunk);
+      done(null, chunk);
+    } });
+    const progress = () => {
+      const seconds = (performance.now() - downloadStarted) / 1000;
+      const mb = (received / 1_000_000).toFixed(1);
+      const size = total > 0 ? ` / ${(total / 1_000_000).toFixed(1)} MB (${Math.min(100, Math.floor(received / total * 100))}%)` : ' MB';
+      const message = `${mb}${size} · ${(received / 1_000_000 / Math.max(seconds, 0.001)).toFixed(1)} MB/s · ${seconds.toFixed(0)}s`;
+      process.stdout.write(process.stdout.isTTY ? `\r\x1b[2K${message}` : `${message}\n`);
+    };
+    const timer = setInterval(progress, process.stdout.isTTY ? 250 : 5000);
+    try {
+      await pipeline(Readable.fromWeb(response.body), meter, createWriteStream(archive, { flags: 'wx' }));
+    } finally {
+      clearInterval(timer);
+      if (process.stdout.isTTY) process.stdout.write('\r\x1b[2K');
+    }
     if (hash.digest('hex') !== release.sha256) throw new Error('Download checksum mismatch. No app was installed.');
+    process.stdout.write(`Download verified in ${((performance.now() - downloadStarted) / 1000).toFixed(1)}s. Unpacking…\n`);
+    const unpackStarted = performance.now();
     run('/usr/bin/ditto', ['-x', '-k', archive, stage]);
     const app = join(stage, 'BuddyMac.app');
+    process.stdout.write(`Unpacked in ${((performance.now() - unpackStarted) / 1000).toFixed(1)}s. Checking Apple signature and notarization…\n`);
+    const verificationStarted = performance.now();
     run('/usr/bin/codesign', ['--verify', '--deep', '--strict', '-R', '=anchor apple generic and certificate leaf[subject.OU] = "G2442WAF29"', app]);
     const identifier = run('/usr/libexec/PlistBuddy', ['-c', 'Print :CFBundleIdentifier', join(app, 'Contents/Info.plist')]);
     if (identifier !== 'org.buddytools.BuddyMac') throw new Error('Unexpected application identifier.');
     run('/usr/bin/xattr', ['-w', 'com.apple.quarantine', `0081;${Math.floor(Date.now() / 1000).toString(16)};BuddyMac Installer;`, app]);
+    run('/usr/sbin/spctl', ['--assess', '--type', 'execute', app]);
+    process.stdout.write(`Apple verification passed in ${((performance.now() - verificationStarted) / 1000).toFixed(1)}s.\n`);
     await rename(app, target);
-    process.stdout.write(`Installed ${target}\nThis build is not notarized. If macOS blocks it, use System Settings > Privacy & Security > Open Anyway.\n`);
+    process.stdout.write(`Installed ${target} in ${((performance.now() - started) / 1000).toFixed(1)}s.\n`);
     if (open) run('/usr/bin/open', [target]);
   } finally {
     if (stage) await rm(stage, { recursive: true, force: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "buddymac",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Download and install BuddyMac for Apple Silicon Macs",
   "type": "module",
   "bin": {

package/release.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.1",
-  "url": "https://github.com/OxFrancesco/BuddyMac/releases/download/v0.1.1/BuddyMac-darwin-arm64.zip",
-  "sha256": "1ae2deb858c9647a22e21c18abda39a621c97f16595f8dcc999056c04b474c77"
+  "version": "0.1.3",
+  "url": "https://github.com/OxFrancesco/BuddyMac/releases/download/v0.1.3/BuddyMac-darwin-arm64.zip",
+  "sha256": "4a4fcd984d46ca6644eed072aae50eecf1bdbe7bdb2710e9cd10e4c54a791165"
 }