buddymac 0.1.2 → 0.1.4

package/README.md

@@ -6,7 +6,7 @@ npx buddymac
 
 Downloads BuddyMac to `~/Applications` and opens it. Requires an Apple Silicon Mac running macOS 26 or later and Node.js 20 or later. No Bun installation is needed.
 
-The installer checks a pinned SHA-256 checksum and Francesco Oddo's Apple Developer signature. It does not overwrite existing apps or change your app data. To update, quit BuddyMac and move the previous app out of the destination first.
+The installer shows download progress and checks a pinned SHA-256 checksum, Francesco Oddo's Apple Developer signature, and macOS Gatekeeper approval. It does not overwrite existing apps or change your app data. To update, quit BuddyMac and move the previous app out of the destination first.
 
 ```sh
 npx buddymac --no-open
@@ -14,6 +14,8 @@ npx buddymac --destination /Applications
 npx buddymac --help
 ```
 
-This early release is signed but not notarized. If macOS blocks the first launch, open System Settings → Privacy & Security → Open Anyway. The installer preserves macOS download protection.
+The app is signed and notarized by Apple, with the notarization ticket included. The installer preserves macOS download protection.
 
 Source and downloads: https://github.com/OxFrancesco/BuddyMac
+
+Installer 0.1.4 downloads the same notarized BuddyMac 0.1.3 app using macOS curl with HTTP/2 and a smaller tar.xz archive. The installed app remains in Applications after Terminal closes.

package/cli.mjs

@@ -1,26 +1,26 @@
 #!/usr/bin/env node
 import { createHash } from 'node:crypto';
-import { createReadStream, createWriteStream } from 'node:fs';
+import { createWriteStream } from 'node:fs';
 import { access, mkdir, mkdtemp, readFile, rename, rm } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { Readable } from 'node:stream';
+import { spawn, spawnSync } from 'node:child_process';
+import { Transform } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 
 const release = JSON.parse(await readFile(new URL('./release.json', import.meta.url), 'utf8'));
+const { version: installerVersion } = JSON.parse(await readFile(new URL('./package.json', import.meta.url), 'utf8'));
 const args = process.argv.slice(2);
 const help = `Usage: npx buddymac [--destination <folder>] [--no-open]
 
 Installs BuddyMac ${release.version} to ~/Applications and opens it.
 Requires Apple Silicon, macOS 26+, and Node.js 20+.
 Existing apps are never overwritten. Quit and move an old copy before updating.
-This early build is signed but not notarized. macOS may require Open Anyway
-in System Settings > Privacy & Security after the first launch attempt.
+The download is signed and notarized by Apple. macOS download protection stays enabled.
 
   --destination <folder>  Install in a different folder
   --no-open               Install without opening the app
-  --version               Print the bundled release version
+  --version               Print the installer version
   --help                  Show this help
 `;
 
@@ -32,12 +32,13 @@ function run(command, parameters) {
 }
 
 async function install() {
+  const started = performance.now();
   let destination = join(homedir(), 'Applications');
   let open = true;
   for (let i = 0; i < args.length; i++) {
     switch (args[i]) {
       case '--help': case '-h': process.stdout.write(help); return;
-      case '--version': process.stdout.write(`${release.version}\n`); return;
+      case '--version': process.stdout.write(`${installerVersion}\n`); return;
       case '--no-open': open = false; break;
       case '--destination':
         if (!args[i + 1] || args[i + 1].startsWith('--')) throw new Error('--destination requires a folder.');
@@ -65,22 +66,58 @@ async function install() {
       if (error.code !== 'ENOENT') throw error;
     }
     stage = await mkdtemp(join(destination, '.buddymac-'));
-    const archive = join(stage, 'BuddyMac.zip');
+    const archive = join(stage, 'BuddyMac.tar.xz');
     process.stdout.write(`Downloading BuddyMac ${release.version}…\n`);
-    const response = await fetch(release.url, { signal: AbortSignal.timeout(300_000) });
-    if (!response.ok || !response.body) throw new Error(`Download failed: HTTP ${response.status}. ${release.url}`);
-    await pipeline(Readable.fromWeb(response.body), createWriteStream(archive, { flags: 'wx' }));
+    const downloadStarted = performance.now();
+    const download = spawn('/usr/bin/curl', [
+      '--disable', '--fail', '--location', '--http2', '--proto', '=https', '--proto-redir', '=https',
+      '--silent', '--show-error', '--connect-timeout', '20', '--max-time', '300', release.url,
+    ], { env: { ...process.env }, stdio: ['ignore', 'pipe', 'pipe'] });
+    let downloadError = '';
+    download.stderr.on('data', chunk => { downloadError = (downloadError + chunk.toString()).slice(-4096); });
+    const finished = new Promise((resolve, reject) => {
+      download.once('error', reject);
+      download.once('close', code => code === 0 ? resolve() : reject(new Error(downloadError.trim() || `Download failed: curl exited with ${code}.`)));
+    });
+    const total = release.bytes;
+    let received = 0;
     const hash = createHash('sha256');
-    for await (const chunk of createReadStream(archive)) hash.update(chunk);
+    const meter = new Transform({ transform(chunk, encoding, done) {
+      received += chunk.length;
+      hash.update(chunk);
+      done(null, chunk);
+    } });
+    const progress = () => {
+      const seconds = (performance.now() - downloadStarted) / 1000;
+      const mb = (received / 1_000_000).toFixed(1);
+      const size = total > 0 ? ` / ${(total / 1_000_000).toFixed(1)} MB (${Math.min(100, Math.floor(received / total * 100))}%)` : ' MB';
+      const message = `${mb}${size} · ${(received / 1_000_000 / Math.max(seconds, 0.001)).toFixed(1)} MB/s · ${seconds.toFixed(0)}s`;
+      process.stdout.write(process.stdout.isTTY ? `\r\x1b[2K${message}` : `${message}\n`);
+    };
+    const timer = setInterval(progress, process.stdout.isTTY ? 250 : 5000);
+    try {
+      await Promise.all([finished, pipeline(download.stdout, meter, createWriteStream(archive, { flags: 'wx' }))]);
+    } finally {
+      if (download.exitCode === null) download.kill();
+      await finished.catch(() => {});
+      clearInterval(timer);
+      if (process.stdout.isTTY) process.stdout.write('\r\x1b[2K');
+    }
     if (hash.digest('hex') !== release.sha256) throw new Error('Download checksum mismatch. No app was installed.');
-    run('/usr/bin/ditto', ['-x', '-k', archive, stage]);
+    process.stdout.write(`Download verified in ${((performance.now() - downloadStarted) / 1000).toFixed(1)}s. Unpacking…\n`);
+    const unpackStarted = performance.now();
+    run('/usr/bin/tar', ['-xJf', archive, '-C', stage]);
     const app = join(stage, 'BuddyMac.app');
+    process.stdout.write(`Unpacked in ${((performance.now() - unpackStarted) / 1000).toFixed(1)}s. Checking Apple signature and notarization…\n`);
+    const verificationStarted = performance.now();
     run('/usr/bin/codesign', ['--verify', '--deep', '--strict', '-R', '=anchor apple generic and certificate leaf[subject.OU] = "G2442WAF29"', app]);
     const identifier = run('/usr/libexec/PlistBuddy', ['-c', 'Print :CFBundleIdentifier', join(app, 'Contents/Info.plist')]);
     if (identifier !== 'org.buddytools.BuddyMac') throw new Error('Unexpected application identifier.');
     run('/usr/bin/xattr', ['-w', 'com.apple.quarantine', `0081;${Math.floor(Date.now() / 1000).toString(16)};BuddyMac Installer;`, app]);
+    run('/usr/sbin/spctl', ['--assess', '--type', 'execute', app]);
+    process.stdout.write(`Apple verification passed in ${((performance.now() - verificationStarted) / 1000).toFixed(1)}s.\n`);
     await rename(app, target);
-    process.stdout.write(`Installed ${target}\nThis build is not notarized. If macOS blocks it, use System Settings > Privacy & Security > Open Anyway.\n`);
+    process.stdout.write(`Installed ${target} in ${((performance.now() - started) / 1000).toFixed(1)}s.\n`);
     if (open) run('/usr/bin/open', [target]);
   } finally {
     if (stage) await rm(stage, { recursive: true, force: true });

package/package.json

@@ -1,17 +1,25 @@
 {
   "name": "buddymac",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Download and install BuddyMac for Apple Silicon Macs",
   "type": "module",
   "bin": {
     "buddymac": "cli.mjs"
   },
-  "files": ["cli.mjs", "release.json", "README.md"],
+  "files": [
+    "cli.mjs",
+    "release.json",
+    "README.md"
+  ],
   "engines": {
     "node": ">=20"
   },
-  "os": ["darwin"],
-  "cpu": ["arm64"],
+  "os": [
+    "darwin"
+  ],
+  "cpu": [
+    "arm64"
+  ],
   "repository": {
     "type": "git",
     "url": "git+https://github.com/OxFrancesco/BuddyMac.git",

package/release.json

@@ -1,5 +1,6 @@
 {
-  "version": "0.1.2",
-  "url": "https://github.com/OxFrancesco/BuddyMac/releases/download/v0.1.2/BuddyMac-darwin-arm64.zip",
-  "sha256": "ddf75a0c1bd7d34fad4db252228edf66eaeecfb4162ce0f560f2a4ed43ce44a5"
+  "version": "0.1.3",
+  "url": "https://github.com/OxFrancesco/BuddyMac/releases/download/v0.1.3/BuddyMac-darwin-arm64.tar.xz",
+  "sha256": "5baa5ab5d4c45154c3b63f78e14bd7cbab0dc6886173f5e839feaa995943a206",
+  "bytes": 28078884
 }