macOS without a checkout (self-extracting installer)
One file that verifies its own payload before extracting, for a Mac that does not have the repository.
An air-gapped Enterprise deployment on a Mac gets a self-extracting installer — the same role a deb plays on Linux. Everywhere else a Mac is installed with the one-line install (an install, end to end).
The file is one installer-darwin-arm64.sh, carrying the same three binaries every other route
delivers and no authorization server. Run it on the target Mac:
It verifies its own payload checksum before extracting and refuses by name if that
fails. The target prefix is /usr/local/bin, which is root-owned on Apple Silicon, so the
installer prints the exact sudo commands it is about to run rather than performing them
silently — and, when you want it gone, prints the self-extracting installer's three files to
remove. Re-running a newer installer is the upgrade.
Only darwin/arm64 exists: the declared release targets carry no darwin/amd64, and a
request for one is refused by name rather than quietly producing something else.
Gatekeeper: transferring the installer over scp does not set
com.apple.quarantine (measured on the fleet's own channel). Distributing it by browser or
curl download would, and clearing that would need an xattr step or notarization —
neither is part of this path today. The installer is not signed or notarized.
Air-gapped installation (Enterprise)
A signed package, installed system-wide on a host with no network path to anything — what it puts on the machine, and what still needs your hand afterwards.
Central servers: saphan-gateway and saphan-oauth
What the two central server programs are, what each one serves, and what a central deployment needs from you.