macOS without a checkout (self-extracting installer)
One file that verifies its own payload before extracting, for a Mac with no route to the internet.
An air-gapped Enterprise deployment on a Mac gets a self-extracting installer — the same role a deb plays on Linux. Everywhere else a Mac is installed with the one-line install (an install, end to end).
The file is one installer-darwin-arm64.sh. Like every other delivery route, this installer
carries the four binaries of the machine payload — saphan, saphan-agent, saphan-gateway and
saphan-server — and no authorization server. Run it on the target Mac:
It verifies its own payload checksum before extracting and refuses by name if that
fails. The target prefix is /usr/local/bin, which is root-owned on Apple Silicon, so the
installer prints the exact sudo install commands before it runs them — sudo asks for your
password — and ends by printing the line that removes what it installed. Re-running a newer
installer is the upgrade. It writes no configuration and starts nothing; set the machine up
afterwards (First run).
Only darwin/arm64 exists: the declared release targets carry no darwin/amd64, and a
request for one is refused by name rather than quietly producing something else.
Gatekeeper: transferring the installer over scp does not set com.apple.quarantine.
Distributing it by browser or curl download would, and clearing that would need an xattr step
or notarization — neither is part of this path today. ⚠ The installer is not signed or notarized.
Air-gapped installation (Enterprise)
A package, installed system-wide on a host with no network path to anything — what it puts on the machine, and what still needs your hand afterwards.
Central servers: saphan-server, saphan-gateway and saphan-oauth
What the central server programs are, what each one serves, which of them a delivery route carries, and what each needs from you.