BidMeme for Mac

One download, from one place. The app is sandboxed with two entitlements, holds no key, signs nothing, has no updater, and is built by a machine from a public tag so a stranger can rebuild it.

Get it

The first release is not published yet. This page is where it will be linked from, and from nowhere else.

requires: macOS 14 or later. Apple silicon and Intel.
format: A disk image. Never a package installer, because a package runs scripts as root.
updates: None in the app. The menu says when a newer version exists and opens this page; you drag the new app over the old one.
origin: This page. A BidMeme from a mirror, a chat attachment or a zip in a message is not BidMeme.

Signing in

The app shows an eight character code. You approve it on your account page, signed in with X, and the app collects a device token on its own. The app never sees your X session and never asks for a password, a seed phrase or a key. The token can post minutes and read your bar, and the account page can revoke it.

What it reads

Idle time, lock and display state, whether its own item is on screen, and the hardware model. The full list, with the API behind each read and the list of what it never reads, is on the privacy page and in the source, and the test suite fails if the two differ. The app's own menu has Show Last Payload, which prints the exact bytes of the last request it made.

Verifying a build

Three parties vouch for a download and none of them can vouch alone. Apple notarized it under the identity below. The release signer, a person holding a key that is listed in the source at the tag, signed the digests. And the build workflow, a machine that holds no signing key, attested the digest of the unsigned executable it built from the same tag. The unsigned digest is reproducible: the same source on the toolchain named beside it builds the same bytes, which is what lets you be the fourth party. One script checks all of it and says what each step proved.

signed by: Not published yet.

the whole sequence

# from a clone of the source, with the tag and the file you downloaded
scripts/verify-release.sh v1.2.3 ~/Downloads/BidMeme-1.2.3.dmg

Or by hand, step by step.

by hand

# Apple's check: Developer ID, notarized, hardened runtime
spctl --assess --type open --context context:primary-signature -vv BidMeme-1.2.3.dmg

# the identity that signed, to compare with the one on this page
codesign -dvvv /Volumes/BidMeme/BidMeme.app 2>&1 | grep ^Authority | head -1

# exactly two entitlements on the app inside the dmg
codesign -d --entitlements - --xml /Volumes/BidMeme/BidMeme.app

# the release signature over the digests, by a key listed in the source at the tag
ssh-keygen -Y verify -f scripts/release-signers -I bidmeme-release -n bidmeme-release -s SHA256SUMS.sig < SHA256SUMS

# the workflow's attestation over the unsigned digest, from a machine holding no key
gh attestation verify UNSIGNED-SHA256 --repo <owner>/<repo>

# the executable rebuilt from the tag has that same digest
cd mac && bash scripts/build-unsigned.sh

signed: Developer ID, under the hardened runtime with none of its exceptions, notarized and stapled.
sandbox: Two entitlements: the App Sandbox and outbound network. The entitlement file is in the release notes verbatim.
no key in CI: The signing identity never enters the build pipeline. A compromised repository can produce an unsigned binary that macOS refuses to open, and nothing else.
provenance: A Sigstore statement binds the unsigned digest to the repository, the workflow, the commit and the run that built it.
no updater: The app cannot replace itself. A new version is a download you make from this page and an app you drag over the old one.
one host: Every request the app makes goes to this site. The test suite fails if a second host appears in the source.