cli-v0.4.3

Install

brew install reachpad/tap/reachpad     # macOS, Linux
npm install -g @reachpad/cli           # anywhere Node 18+ runs
curl -fsSL https://reachpad.dev/install | sh

All three deliver the binaries below, and none of them hits the
macOS warning described next.

Downloading a tarball here, on macOS

These binaries are ad-hoc signed, not yet Developer ID signed and
notarized. A browser download tags the file with
com.apple.quarantine, and macOS then refuses it with "Apple
could not verify reachpad is free of malware". The file is fine —
it is unsigned, not unsafe — and any of the three commands above
avoids the tag entirely. If you want this exact tarball anyway:

shasum -a 256 -c SHA256SUMS --ignore-missing
xattr -d com.apple.quarantine reachpad

Verify the checksum first, as above; that is the check the
signature would otherwise be doing for you.

Verifying where these came from

Every tarball carries a signed build-provenance attestation: proof
that these exact bytes came out of this repository's release
workflow, at the commit this tag names. It needs no key of ours —
the record lives in a public transparency log.

gh attestation verify reachpad-<target>.tar.gz --repo Reachpad/reachpad-cli