brew: check installed apps against their pins after self-update
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 58/100
Research direction
This depends on #65, which provides the pins and verify-casks --installed; read that issue and inspect the existing dotfiles doctor command entry point. Start by running the installed-cask check and trace how its results can be reported. Done when one command reports each installed cask's signer state, stays silent on success unless asked, and fails when a pin is changed.
Written by the indexing model from the issue text.
Description
Brew installs an app once. After that, the app updates itself. Ten of
the thirteen desktop casks set auto_updates. Their updaters deliver
all later code. Brew does not see it.
The pins from #65 still apply. An update signed by a different team is
the event to catch.
Do
Run verify-casks --installed on a schedule. Two choices:
- A launchd agent, daily. It writes failures to a log and posts a
notification. - A
dotfiles doctorsubcommand, run by hand.
Start with the subcommand. Add the agent if the subcommand is forgotten.
Output
One line per app. Say nothing on success unless asked.
FAIL signer: /Applications/Slack.app is not signed by BQR82RBBHL
FAIL gatekeeper: /Applications/eul.app is not notarized
UNPINNED tolaria
Not in scope
The check does not stop a bad update. It finds one after the fact. To
stop updates, disable the updater. That trades a rare risk for a
constant one: browsers and password managers then wait for a manual
bump. Do not do that.
Done when
- One command reports the signer state of every installed cask.
- Changing a pin by one character makes that command fail.
Depends on #65.
- Dominant language
- Shell
- Stars
- 1
- Forks
- 0
- Avg merge
- 9h 5m
- Merged PRs (30d)
- 5
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from indexzero/dotfiles
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
Difficulty 5/5 Over a week Newbie friendliness 45/100
-
Difficulty 4/5 3-5 days Newbie friendliness 56/100
All issues in indexzero/dotfiles
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
infamousjoeg/conceal#60 ·
-
area/ci area/security microtask size/S status/ready
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
HarnageaGabriel/disdetta#76 ·
Maintainers usually reply within 1 day
-
diagnosing-superpowers: transcript-as-evidence guard never reaches the dispatcher or the analystsOpen
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
obra/superpowers#2662 ·
Maintainers usually reply within 3 days
-
package-update
Difficulty 1/5 Under an hour Newbie friendliness 69/100
oSoWoSo/oco#844 · 2 comments ·
Maintainers usually reply within 1 day
-
bug linux priority-low
Difficulty 2/5 1-3 hours Newbie friendliness 73/100
Maintainers usually reply within 1 day