v0.1.2

Before you install

• The macOS agent binaries are signed and notarized, but NOT stapled. A bare Mach-O executable
  has nowhere to hold a notarisation ticket, so Gatekeeper resolves it over the network at first
  launch. On a host with restricted egress that first launch can fail, and under launchd it fails
  quietly. The mechanism, the channel rule and the fix are in
  packaging/macos/GATEKEEPER.md.
• Pessimal-0.1.2-macos.zip (the menu bar app) is Apple silicon only. It is signed,
  notarized and stapled, but scripts/build-macos-app.sh compiles with
  -target "$(uname -m)-apple-macos…" and there is no lipo step, so no x86_64 slice exists. It
  will not launch on an Intel Mac. The agent itself ships for both macOS architectures.
• There is no Windows build in this release. Not an oversight: a cross-build of the agent for
  Windows ran for over twenty minutes without finishing, and the machines that build and check this
  release include none that could run a Windows binary, so it would have been the one asset nobody
  had ever executed. It is deferred, not abandoned.
• The Linux tarballs need glibc 2.28 or newer (Debian 10+, Ubuntu 18.10+, RHEL 8+). They are
  cross-built with cargo-zigbuild against a glibc 2.28 target, and the release fails if either
  binary asks for a newer glibc symbol than that. There is no musl build: a static musl binary
  resolves names through its own stub resolver with no nsswitch, which is a behaviour change rather
  than a build problem, so it is deferred deliberately.
• The x86_64 Linux binary was never executed by the release pipeline. Its glibc floor and its
  checksum are verified, but the build machines are Apple silicon and run arm64 Linux, so only the
  aarch64 Linux and macOS binaries are launched before a release is promoted. The build log says
  whether the x86_64 macOS binary was also run under Rosetta.

Install

The agent, on any supported platform:

mise use -g github:Lightless-Labs/pessimal

github: is the current spelling. mise's ubi: backend is deprecated, and its exe= option does
not exist on the github: backend.

Or take a tarball from the assets below and check it first:

shasum -a 256 -c --ignore-missing SHA256SUMS

SHA256SUMS must come from this same release: it is computed over the bytes GitHub serves here, so a
copy from anywhere else proves nothing. Each agent tarball also carries LICENSE,
pessimal.example.toml, a README.md with the install and service steps, and on Linux the
pessimal-agent.service systemd unit.

Full Changelog: v0.1.1...v0.1.2