Add unquarantine step to Darwin config

homes/common.nix

@@ -94,6 +94,9 @@ in {
       installRunic = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
         run ${pkgs.julia-bin}/bin/julia --project=@runic --startup-file=no -e 'using Pkg; Pkg.add(name="Runic", version="${runic_version}")'
       '';
+      installJuliaFormatter = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+        run ${pkgs.julia-bin}/bin/julia --project=@JuliaFormatter --startup-file=no -e 'using Pkg; Pkg.add(name="JuliaFormatter", version="2.1.6")'
+      '';
     };
   };
   programs = {

homes/desktop.nix

@@ -25,7 +25,6 @@
       quarto
       roboto-slab
       shellcheck
-      sqlitebrowser
       tex-fmt
       woodpecker-cli
       (texlive.combine { inherit (texlive) scheme-basic latex-bin latexmk; })

homes/linux-desktop.nix

@@ -6,7 +6,7 @@ in {
   imports = [ ./../programs/plasma.nix ];
 
   home = {
-    packages = with pkgs; [ kwalletcli custom-pkgs.sc4pac ];
+    packages = with pkgs; [ kwalletcli sqlitebrowser custom-pkgs.sc4pac ];
     sessionVariables = { ZED_WINDOW_DECORATIONS = "server"; };
   };
   services = {

programs/firefox.nix

@@ -75,7 +75,7 @@
           })
         ];
         search = {
-          default = "Milliron X Search";
+          default = "Kagi";
           privateDefault = "Milliron X Search";
           force = true;
           engines = {
@@ -108,6 +108,41 @@
               updateInterval = 7 * 24 * 60 * 60 * 1000;
               definedAliases = [ "@pxt" ];
             };
+            "Kagi" = {
+              urls = [
+                {
+                  rels = [ "results" ];
+                  type = "text/html";
+                  method = "GET";
+                  template = "https://kagi.com/search?q={searchTerms}";
+                }
+                {
+                  rels = [ "suggestions" ];
+                  type = "application/x-suggestions+json";
+                  method = "GET";
+                  template =
+                    "https://kagisuggest.com/api/autosuggest?q={searchTerms}";
+                }
+              ];
+              icon = "https://kagi.com/favicon.ico";
+              updateInterval = 24 * 60 * 60 * 1000; # every day
+              definedAliases = [ "@kg" ];
+            };
+            # Based on which bangs I use, I should also add (in no particular order):
+            # - Dockerhub
+            # - WineHQ
+            # - nixpkgs
+            # - YouTube
+            # - IMDB
+            # - Flathub
+            # - USPS/UPS/DHL/FedEx
+            # - PubMed
+            # - Cabi Abstracts?
+            # - Conda
+            # - Marginalia
+            # - AlternativeTo
+            # - Wikipedia
+            # - Google Scholar
           };
         };
         settings = {

programs/zed.nix

@@ -4,7 +4,6 @@
     extensions = [
       "basher"
       "clojure"
-      "cspell"
       "dockerfile"
       "earthfile"
       "git-firefly"
@@ -19,27 +18,12 @@
     ];
     userSettings = {
       agent = {
+        use_modifier_to_send = true;
         default_model = {
           provider = "copilot_chat";
           model = "gpt-4.1";
         };
       };
-      auto_install_extensions = {
-        basher = true;
-        clojure = true;
-        cspell = true;
-        dockerfile = true;
-        earthfile = true;
-        git-firefly = true;
-        html = true;
-        julia = true;
-        latex = true;
-        macos-classic = true;
-        nix = true;
-        r = true;
-        toml = true;
-        xml = true;
-      };
       buffer_font_family = "FiraCode Nerd Font";
       buffer_font_size = 11;
       features = { edit_prediction_provider = "zed"; };
@@ -49,6 +33,8 @@
             external = {
               command = "julia";
               arguments = [
+                "--project=@JuliaFormatter"
+                "--startup-file=no"
                 "-e"
                 "using JuliaFormatter; print(format_text(String(read(stdin))));"
               ];

secrets.nix

@@ -19,4 +19,5 @@ in {
     ++ [ bosephus-host ];
   "secrets/pihole.age".publicKeys = system-administrators ++ [ bosephus-host ];
   "secrets/ansible-vault-password.age".publicKeys = system-administrators;
+  "secrets/darwin-policies-json.age".publicKeys = system-administrators;
 }

secrets/darwin-policies-json.age

@@ -0,0 +1,14 @@
+age-encryption.org/v1
+-> ssh-ed25519 bN6E9A pP/KN1DuadjXdcmn88HMfbPx3fJtfVPsk6thr0nkdCM
+81yMhheSMDQAl0c40l99kE8LgpGFFaO0oM/i04sfYe8
+-> ssh-ed25519 1g/xww /Kp3JUItkd3sWvOD6Te6OqynKnHCE3N4EKC6IVBZzRc
+CNWaNgLMNXpLzx9jNZR5sToouRCJxNDife+dTMhw/mc
+-> ssh-ed25519 +kBihw qRIX7qPG2+/gsfvEJBp1tAS71fAXeQ42RBk7EjaWdUM
+gjlHOUzMZuWZKLLdn/vTDjhDzKul7J0tzvCFwE/eRWE
+-> ssh-ed25519 dbKeHw BIkHWULlDEbu+/6pKVhbQccfgGQZy05V5ZrsmOxuilI
+G/B1TLuaIi4dnlyp1bo0wCjyBJcfOvv2ecuWLo7Cgl0
+--- t4O2Yxqi3K+siT5JhDW55lHPw2uQ05Y6rcDOPzXbAIY
+bdò	
0ÀS®Üa^O<>ö>Í&Ã42/xÅZÿ/£–ÏÒó(ã¿”3K
+lº|p-WÁ,[Ö0¿½ê"Œ¥'<¨÷úi
+¥ò\¶Ž «)Vo€¼©_ox†¿£/‚ÿ–ß&‰WlžÀ.4òx<§ÜŠ<C39C>ñcåb5´X,{ú»?Îñ=¾—™&ÔÈ›&"q±éî°ÅÑ?{ZÆUo>ºB~A›žì.ÅõòE»ˆË<CB86>òÂÆÏÏÔG©žøt
+]¸qÁ':—Æ(Ñ<>õ=Wê W8°$E(í!

systems/darwin/corianne.nix

@@ -33,6 +33,46 @@
   system.keyboard.enableKeyMapping = true;
   system.primaryUser = "millironx";
 
+  # nix-darwin doesn't provide a nice injection point for running activation
+  # scripts like home-manager does. In other words, we can't add an arbitrary
+  # number of activation scripts with well-defined entry points into the system
+  # activation process. Instead, we can rely on these three obscure and
+  # discouraged activation points to bootstrap stuff:
+  # https://github.com/nix-darwin/nix-darwin/blob/e04a388232d9a6ba56967ce5b53a8a6f713cdfcf/modules/system/activation-scripts.nix#L152-L156
+  # In this case, we are using the postActivation section (since it runs after
+  # homebrew) to unquarantine any casks that might have updated and are now
+  # in quarantine again.
+  system.activationScripts.postActivation.text = ''
+    echo unquarantining Homebrew casks...
+    PATH="/opt/homebrew/bin:${
+      pkgs.lib.makeBinPath [ pkgs.jq pkgs.gnugrep ]
+    }:/usr/bin:$PATH" \
+        sudo \
+                --preserve-env=PATH \
+                --user=${config.system.primaryUser} \
+                --set-home \
+            brew info \
+                --casks \
+                --installed \
+                --json=v2 \
+        | jq \
+                --raw-output0 \
+                '.casks[]
+                    | select(.artifacts[] | type == "object" and has("app"))
+                    | "\(.artifacts[]?.app | first // empty)"' \
+        | xargs \
+                --null \
+                -I{} \
+                sh -c 'xattr "$0" | \
+                            grep \
+                                    --quiet \
+                                    com.apple.quarantine \
+                            && echo "$0" \
+                            && xattr -vrd com.apple.quarantine "$0" \
+                            || true' \
+                        /Applications/{}
+  '';
+
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   nixpkgs.hostPlatform = "aarch64-darwin";
 
@@ -79,12 +119,14 @@
       "docker-buildx"
       "docker-credential-helper"
       "firefoxpwa"
+      "mpv"
       "r"
     ];
     casks = [
       "alt-tab"
       "anki"
       "anythingllm"
+      "db-browser-for-sqlite"
       "firefox"
       "freetube"
       "inkscape"