Leadaxe：singbox-launcher 的 Homebrew Cask 在 Intel Mac 上通过安装和升级隔离属性检查

在尚未合并的 Homebrew tap PR #1 中，Leadaxe 报告使用 Intel Mac、macOS 26 和 Homebrew 6.0.20，按建议的 Cask 写法重跑检查：style 通过，安装后应用不带 com.apple.quarantine，2.3.9 升级到 2.3.10 后也会再次清除该属性。移除 xattr 步骤的对照 Cask 会保留隔离属性，spctl 检查因 ad-hoc 签名被拒绝；更新脚本能够使用已发布的 SHA-256 升级，并在第二次运行时报告已是最新版。该评论未测试卸载清理与线上定时 workflow；作者在后续评论补充，这些检查使用临时 appdir，未实际启动应用，完整安装、启动和连接验证仍待完成。

作者原文@Leadaxe
Follow-up: I re-ran the checks with the Cask exactly as suggested in my review (depends_on :macos, postflight_steps with {{appdir}}, zap), on Homebrew 6.0.20, Intel, macOS 26:
| Check | Result |
|---|---|
| brew style --cask | no offenses |
| brew install --cask (--appdir to a scratch folder) | installs; com.apple.quarantine absent on the .app |
| Control: same Cask without the xattr step | .app keeps com.apple.quarantine; spctl --assess → rejected (ad-hoc signature) |
| Install 2.3.9 via the Cask → brew upgrade --cask | upgrades to 2.3.10; quarantine cleared again after upgrade |
| scripts/update-homebrew-cask.sh on a copy pinned to 2.3.9 | bumps to 2.3.10 with the published SHA-256; result is byte-identical to the expected Cask; second run reports "already up to date" |
So the quarantine step is actually needed (without it, Gatekeeper blocks the first launch), and the postflight_steps form does clear the flag on both install and upgrade.
Not tested: brew uninstall --zap (I didn't want to wipe my real data dir) and the scheduled workflow itself; that one can only be checked after merge, with a manual workflow_dispatch run.

返回动态列表查看原文