From 44dfa536959bfdec5f56c86c317e1a2fb37b3eb1 Mon Sep 17 00:00:00 2001
From: Ishan Malu <ishan.malu@gmail.com>
Date: Wed, 2 Sep 2026 17:54:26 +0300
Subject: [PATCH] Add a one-command install, so the quarantine step is not the
 visitor's job

Perch is signed but not notarized, and will stay that way for now, so
macOS quarantines every download and blocks the first launch. The
instructions therefore ended with asking a stranger to paste an xattr
command, which is where most people stop.

The script does what those instructions described: reads the latest
release, downloads the image, checks it against the published checksum
and refuses to continue without one, installs it, clears the quarantine
flag, and starts it. No sudo, and it falls back to ~/Applications if
/Applications is not writable. Everything happens in a temp directory the
trap cleans up, including the mount.

Piping into a shell is a real thing to be wary of, so the page and the
README both show how to read it first rather than pretending otherwise.

Run against the live 1.8.5 release before committing: installs, signature
still valid, quarantine cleared, app running, no mount left behind.
---
 README.md       | 22 +++++++++++-
 docs/index.html | 23 +++++++++++--
 docs/install.sh | 90 +++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 132 insertions(+), 3 deletions(-)
 create mode 100755 docs/install.sh

diff --git a/README.md b/README.md
index f7bd9bc..57aea8c 100644
--- a/README.md
+++ b/README.md
@@ -32,7 +32,27 @@ Night mode · Disk cleaning · Screen, keyboard and trackpad cleaning
 ## Install
 
 Perch is free, open source, and needs macOS 14 or later. The binary is
-universal — Apple silicon and Intel — and about 4 MB.
+universal — Apple silicon and Intel — and about 6 MB.
+
+### One command
+
+```bash
+curl -fsSL https://ishanmalu.github.io/Perch/install.sh | bash
+```
+
+Fetches the latest release, checks it against the published checksum, installs
+it, clears the flag macOS puts on downloads, and starts it. It asks for no
+privileges and touches nothing outside the app.
+
+Piping a script into a shell means trusting it, which is a fair thing to be
+wary of. Read it first if you would rather:
+
+```bash
+curl -fsSL https://ishanmalu.github.io/Perch/install.sh -o install.sh
+less install.sh && bash install.sh
+```
+
+Updates after this install themselves — press Check in the panel footer.
 
 ### Download the DMG
 
diff --git a/docs/index.html b/docs/index.html
index 53535f6..0052d74 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -899,12 +899,31 @@ <h2>Install</h2>
     <p class="section-sub">Free, and takes about a minute.</p>
 
     <div class="tabs" role="tablist" style="justify-content:center">
-      <button class="tab" role="tab" aria-selected="true" data-panel="p-dmg">Download</button>
+      <button class="tab" role="tab" aria-selected="true" data-panel="p-cmd">One command</button>
+      <button class="tab" role="tab" aria-selected="false" data-panel="p-dmg">Download</button>
       <button class="tab" role="tab" aria-selected="false" data-panel="p-brew">Homebrew</button>
       <button class="tab" role="tab" aria-selected="false" data-panel="p-src">Build it</button>
     </div>
 
-    <div class="panel" id="p-dmg" style="max-width:640px;margin:0 auto">
+    <div class="panel" id="p-cmd" style="max-width:640px;margin:0 auto">
+      <p class="section-sub" style="margin-bottom:14px">
+        Fetches the latest release, checks it against the published checksum, installs it,
+        clears the flag macOS puts on downloads, and starts it. Asks for no privileges.
+      </p>
+<pre>curl -fsSL https://ishanmalu.github.io/Perch/install.sh | bash</pre>
+      <p style="margin-top:16px;color:var(--muted);font-size:14.4px">
+        Piping a script into a shell means trusting it, which is a fair thing to be wary of.
+        Read it first if you would rather:
+      </p>
+<pre>curl -fsSL https://ishanmalu.github.io/Perch/install.sh -o install.sh
+less install.sh &amp;&amp; bash install.sh</pre>
+      <p style="margin-top:16px;color:var(--muted);font-size:14.4px">
+        Then grant Accessibility access under System Settings → Privacy &amp; Security →
+        Accessibility, and press <kbd>⌃⌥Space</kbd>. Updates after this install themselves.
+      </p>
+    </div>
+
+    <div class="panel" id="p-dmg" hidden style="max-width:640px;margin:0 auto">
       <ol class="steps">
         <li>
           <h4>Download the DMG</h4>
diff --git a/docs/install.sh b/docs/install.sh
new file mode 100755
index 0000000..3120f6b
--- /dev/null
+++ b/docs/install.sh
@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+#
+# Installs the latest Perch release.
+#
+#   curl -fsSL https://ishanmalu.github.io/Perch/install.sh | bash
+#
+# Perch is signed but not notarized, because notarizing needs a paid Apple
+# Developer account. macOS therefore quarantines the download and blocks the
+# first launch. This does what you would otherwise do by hand: fetch the
+# release, check it against the published checksum, install it, clear the
+# quarantine flag, and start it.
+#
+# It asks for no privileges and touches nothing outside the app itself. If you
+# would rather read it before running it, that is the better habit:
+#
+#   curl -fsSL https://ishanmalu.github.io/Perch/install.sh -o install.sh
+#   less install.sh && bash install.sh
+#
+set -euo pipefail
+
+REPO="ishanmalu/Perch"
+API="https://api.github.com/repos/$REPO/releases/latest"
+
+say() { printf '\033[1m==>\033[0m %s\n' "$1"; }
+die() { printf '\033[1;31m!!\033[0m %s\n' "$1" >&2; exit 1; }
+
+[ "$(uname -s)" = "Darwin" ] || die "Perch is a macOS app."
+major="$(sw_vers -productVersion | cut -d. -f1)"
+[ "$major" -ge 14 ] || die "Perch needs macOS 14 or newer; this is $(sw_vers -productVersion)."
+
+say "Finding the latest release"
+json="$(curl -fsSL "$API")" || die "Could not reach GitHub."
+version="$(printf '%s' "$json" | sed -n 's/.*"tag_name": *"v\{0,1\}\([^"]*\)".*/\1/p' | head -1)"
+[ -n "$version" ] || die "Could not read the latest version."
+
+dmg_url="$(printf '%s' "$json" | grep -o 'https://[^"]*\.dmg' | head -1)"
+sums_url="$(printf '%s' "$json" | grep -o 'https://[^"]*SHA256SUMS\.txt' | head -1)"
+[ -n "$dmg_url" ] || die "That release has no disk image."
+[ -n "$sums_url" ] || die "That release publishes no checksum, so it will not be installed."
+
+tmp="$(mktemp -d)"
+trap 'hdiutil detach "$tmp/mnt" -quiet -force 2>/dev/null || true; rm -rf "$tmp"' EXIT
+
+say "Downloading Perch $version"
+curl -fsSL "$dmg_url" -o "$tmp/Perch.dmg" || die "Download failed."
+curl -fsSL "$sums_url" -o "$tmp/SHA256SUMS.txt" || die "Could not fetch the checksum."
+
+say "Checking it against the published checksum"
+expected="$(awk '{print $1}' "$tmp/SHA256SUMS.txt" | head -1)"
+actual="$(shasum -a 256 "$tmp/Perch.dmg" | awk '{print $1}')"
+[ "$expected" = "$actual" ] || die "Checksum mismatch. The download was discarded."
+
+# /Applications is writable by admins; fall back to the user's own folder so
+# this never needs sudo.
+dest="/Applications"
+[ -w "$dest" ] || dest="$HOME/Applications"
+mkdir -p "$dest"
+
+say "Installing to $dest"
+mkdir -p "$tmp/mnt"
+hdiutil attach "$tmp/Perch.dmg" -nobrowse -noautoopen -quiet -mountpoint "$tmp/mnt" \
+  || die "Could not open the disk image."
+[ -d "$tmp/mnt/Perch.app" ] || die "The disk image did not contain Perch."
+
+if pgrep -f "Perch.app/Contents/MacOS/Perch" >/dev/null 2>&1; then
+  say "Quitting the running copy"
+  osascript -e 'quit app "Perch"' 2>/dev/null || true
+  sleep 1
+fi
+
+rm -rf "$dest/Perch.app"
+# ditto rather than cp: it preserves the signature's extended attributes.
+ditto "$tmp/mnt/Perch.app" "$dest/Perch.app" || die "Could not copy Perch into $dest."
+
+say "Clearing the quarantine flag"
+xattr -dr com.apple.quarantine "$dest/Perch.app" 2>/dev/null || true
+
+say "Starting Perch"
+open "$dest/Perch.app"
+
+cat <<NOTE
+
+Perch $version is installed in $dest.
+
+Grant Accessibility access when asked — window tiling, the switcher and the
+cleaning modes need it: System Settings -> Privacy & Security -> Accessibility.
+
+Press Control-Option-Space to open the panel.
+Updates from here install themselves: press Check in the panel footer.
+NOTE