Skip to content

Replay 0.9.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Jul 19:58
· 71 commits to main since this release
v0.9.3
b283e6a

Download

Replay-0.9.3.zip — unzip it and drag Replay.app to Applications.

macOS will refuse to open it the first time. Here is why, and what to do.

Replay has no Apple Developer ID yet, so macOS marks it as unverified and shows
"Apple could not verify Replay is free of malware" — offering only Move to
Trash or Cancel. That message is about a missing certificate, not about
anything found in the app. Every unsigned app gets it.

To open it:

  1. Try to open Replay once and dismiss the warning.
  2. Go to System Settings ▸ Privacy & Security, scroll down, click Open Anyway.
  3. Confirm. It opens normally from then on.

Or one line in a terminal, which does the same thing:

xattr -dr com.apple.quarantine /Applications/Replay.app

Right-click ▸ Open does not work. That bypass existed for years and Apple
removed it in macOS 15. It is still the advice in most projects' READMEs.

Or skip all of that

Homebrew compiles it on your machine, so it is never downloaded, never quarantined,
and opens with no warning at all:

brew tap nurkamol/tap
brew install nurkamol/tap/replay-app    # the application
brew install nurkamol/tap/replay        # the command-line reader

A signed, notarised disk image — no warnings, nothing to click through — appears
here the day there is a certificate. The workflow that builds it is already written.

Added

  • Updates install themselves. The banner's button was a link to a release page, which
    left somebody to download a zip and drag a bundle over the one they were running. It now
    downloads the zip, fetches the SHA-256 the release publishes beside it, hashes the download
    and compares, extracts with ditto, checks the bundle is signed and is this application
    and is the version that was advertised, then replaces itself and restarts.
  • What the trust rests on, said out loud: HTTPS to a repository named in the source, plus
    a checksum published in the same release — the Homebrew-formula model. It proves the bytes
    are the ones that release carries, not that the release is trustworthy. Anyone who can
    publish to the repository can publish an update. A Developer ID would add authorship and is
    still the thing worth buying.
  • It refuses more often than it installs, which is the design rather than a limitation. A
    Homebrew copy is left to brew upgrade, since replacing the bundle would leave brew
    believing it has a version it no longer has. A copy running from macOS's read-only
    translocation mount — what an app still sitting in Downloads gets — has nothing to replace.
    A read-only location refuses rather than half-installing.

Fixed

  • Rate limiting says something useful. Testing exhausted GitHub's sixty-per-hour
    unauthenticated cap, and "GitHub replied 403" tells nobody anything they can act on.
Assets 4
Loading