v1.2.0

kjak v1.2.0

kjak sends one notification to Slack, Discord, e-mail, any HTTP API or a
plugin of your own, from the command line, a script or CI. v1.2.0 lets a
plugin installed with Homebrew run on macOS, under a statement of its
content that you make. It is a minor release: everything v1.0.0 guarantees
(docs/stability.md)
is kept.

Highlights

• Plugins installed by Homebrew (macOS). Homebrew makes
  <prefix>/bin, Cellar and opt writable by the admin group, so kjak
  refused every plugin installed with brew. Such a plugin now runs when
  its SHA-256 is the one you stated: a feather of your configuration whose
  sha256 equals the file's, or a project whose kjak config trust
  recorded that path and SHA-256. kjak feather plugins shows the value to
  pin:

  [feathers.mac]
  type = "external"
  plugin = "notify-macos"
  sha256 = "..."     # from kjak feather plugins; update it after brew upgrade

  kjak does not treat the admin group as root (writing there needs no
  authentication). The exception covers only the group-write rule, only
  bin, Cellar and opt of /opt/homebrew and /usr/local (owned by
  you, group admin, not writable by others, ACLs checked as before), and
  only a file in a keg named for the plugin that is a Mach-O executable
  whose load commands name system libraries alone (not a script, not a
  program linked to a library of Homebrew; what the plugin opens or starts
  at run time is not checked). The content and the place are checked again before
  every run, and once more just before the process starts. What it opens to
  other admin users, and the short window that remains before the exec, are
  in docs/security.md.

Compatibility

• Nothing that ran before is refused now, and nothing is removed or changed
  in meaning. A plugin anywhere but Homebrew's directories is checked
  exactly as in v1.1.0.
• New: in kjak feather plugins -o json, plugins[].homebrew (true for a
  plugin in Homebrew's directories, with its sha256); in the text output,
  its state Homebrew: runs only for a feather with sha256 = "..." (or a project trust). kjak config trust notes such a plugin.
• Linux (Linuxbrew included) and Windows behave as in v1.1.0.
• The plugin protocol is still version 1.

Install

brew install magicdrive/tap/kjak            # macOS, Linux; brew upgrade kjak later

or, without Homebrew, on macOS and Linux:

curl -fsSLO https://raw.githubusercontent.com/magicdrive/kjak/v1.2.0/install.sh
sh install.sh --version v1.2.0              # into ~/.local/bin; sh install.sh --upgrade later

or the archive of your platform below, checked with kjak_checksums.txt
and, optionally, its build provenance:

gh attestation verify kjak_1.2.0_linux_amd64.tar.gz --repo magicdrive/kjak \
  --signer-workflow magicdrive/kjak/.github/workflows/release.yml --source-ref refs/tags/v1.2.0

Developers can build from source with Go 1.27 (make build, or
go install github.com/magicdrive/kjak@v1.2.0).

Platforms

platform	archive
macOS arm64, amd64	tar.gz; Homebrew, install script
Linux amd64, arm64	tar.gz; Homebrew, install script
Windows amd64	zip

The notes of v1.0.0 on keychains, secrets-file permissions and plugins per
platform still apply.

Known limitations

• A plugin installed by Homebrew needs its sha256 updated after each
  brew upgrade. Between kjak's last check and the exec, another admin user
  of the Mac could still replace it (docs/security.md).
• OS-native notifications are not supported.
• Windows has no keychain support. On macOS and Linux the keychain tools
  are tested as test doubles, not against a real keychain.
• Changes other than adding a feather, group or template rewrite the
  configuration file without its comments.
• Plugins are not sandboxed: they run with your rights.
• The macOS binaries are not notarized.

Full Changelog: v1.1.0...v1.2.0