homebrew-chicks

Install some of my software with Homebrew.

Installation

Install the tap:

brew tap chicks-net/chicks

Note: Homebrew is introducing tap trust as a security measure. Starting in Homebrew 6.0.0 (or 5.2.0, whichever comes first), non-official taps will require explicit trust. To trust this tap now, run:

brew trust --tap chicks-net/chicks

Or set HOMEBREW_REQUIRE_TAP_TRUST=1 to opt into the new behavior early. See Homebrew/brew#22635 for the Brewfile trust documentation and Homebrew/brew#22652 for ongoing trust handling improvements.

Available Formulas

Here are a couple of sets of tools that you might find interesting. More formula are planned. Feedback is welcomed.

chicks-git-tools

Git and GitHub automation utilities:

• repos-summary - Comprehensive repository health checker
• github_fix_https - Convert HTTPS repo clones to SSH
• apply-ruleset - Apply GitHub rulesets via API

Installation:

brew install chicks-net/chicks/chicks-git-tools

Usage with bundled rulesets:

# Find installed rulesets
RULESETS="$(brew --prefix)/share/chicks-git-tools/rulesets"

# Apply default linear history ruleset
apply-ruleset "$RULESETS/default-linear.json" my-repo

# Apply pull request requirement ruleset
apply-ruleset "$RULESETS/require-pr.json" my-repo

Note: apply-ruleset works on public repos (requires GitHub Pro for private repos).

chicks-monitoring-tools

System and network monitoring utilities:

• watch_constate - Monitor network connection states (like vmstat but for connections)
• watch_zk_conns - ZooKeeper connection monitoring
• host_scanner - Network host scanning and discovery
• haproxy_stats - HAProxy statistics monitoring
• ip2smokeping - IP to Smokeping integration

Installation:

brew install chicks-net/chicks/chicks-monitoring-tools

chicks-text-tools

Text manipulation utilities:

• comify - Convert newline-separated values to comma-separated
• ruler - Display character ruler for counting columns
• roll - D&D dice roller (supports notation like 2d6, d20)
• closefh - Close file descriptors (requires lsof)

Installation:

brew install chicks-net/chicks/chicks-text-tools

ctm

Control Time Machines Corp. network clocks over UDP:

• ctm - query clock status and drive uptimer/downtimer/display modes

Installation:

brew install chicks-net/chicks/ctm

Installs a prebuilt binary from the ctm GitHub release on macOS/Linux (amd64/arm64); falls back to building from source with go on other platforms.

Usage:

ctm status 192.168.1.100

chicks-desktop

Meta-package for full desktop environment setup. Installs 50+ CLI tools and provides a setup script for GUI applications and home directory configuration.

CLI tools included: agg, aliae, ansiweather, asciinema, bat, coreutils, cue, datasette, dnscontrol, editorconfig-checker, exiftool, ffmpeg, figlet, flac, fzf, gh, git, git-lfs, glow, go, gping, graphviz, gum, handbrake, hugo, imagemagick, jq, just, lsof, lua, markdownlint-cli2, mtr, nushell, opencode, opentofu, pandoc, podman, r, rclone, ripgrep, rustup, shellcheck, sqlite, starship, terraform-docs, tmux, uv, wget, wtfutil, yt-dlp, chicks-git-tools

Installation:

brew install chicks-net/chicks/chicks-desktop

After installing the formula, run the setup script to complete configuration:

$(brew --prefix)/share/chicks-desktop/bin/chicks-desktop-setup

The setup script will:

• Install GUI applications (Blender, GIMP, Godot, Inkscape, iTerm2, LibreOffice, Processing)
• Install the Claude Code app and Fira Code Nerd Font
• Clone chicks-home into ~/Documents/git/chicks-home
• Create symlinks for dotfiles (.bashrc, .vimrc, etc.)

You can also install GUI applications manually using the bundled Brewfile:

brew bundle --file=$(brew --prefix)/share/chicks-desktop/Brewfile

Contributing

• Code of Conduct
• Contributing Guide includes a step-by-step guide to our development process.

Verifying releases

Each tagged release (e.g. v0.5) ships a metadata-only asset bundle (homebrew-chicks-<tag>.tar.gz containing the formula files, Brewfile, and this README), a checksums.txt file, a cosign keyless signature (.bundle), an SBOM (.sbom.json), and an SLSA provenance attestation (multiple.intoto.jsonl).

Verify the asset signature with cosign

# Replace v0.5 with the tag you want to verify.
TAG="v0.5"
curl -L -O "https://github.com/chicks-net/homebrew-chicks/releases/download/${TAG}/homebrew-chicks-${TAG}.tar.gz"
curl -L -O "https://github.com/chicks-net/homebrew-chicks/releases/download/${TAG}/homebrew-chicks-${TAG}.tar.gz.bundle"

cosign verify-blob \
  --bundle homebrew-chicks-${TAG}.tar.gz.bundle \
  --certificate-identity-regexp "https://github.com/chicks-net/homebrew-chicks/.github/workflows/release.yml@refs/tags/${TAG}" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  homebrew-chicks-${TAG}.tar.gz

Verify SLSA build provenance

TAG="v0.5"
curl -L -O "https://github.com/chicks-net/homebrew-chicks/releases/download/${TAG}/homebrew-chicks-${TAG}.tar.gz"
curl -L -O "https://github.com/chicks-net/homebrew-chicks/releases/download/${TAG}/multiple.intoto.jsonl"

slsa-verifier verify-artifact \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/chicks-net/homebrew-chicks \
  --source-tag "${TAG}" \
  homebrew-chicks-${TAG}.tar.gz

The signature is produced via keyless signing using GitHub Actions OIDC identities, so there are no long-lived signing keys to trust or rotate - you only trust the Sigstore Fulcio certificate chain and the workflow identity printed above.

Verify a release with just verify-release

For convenience, the repo's justfile ships a verify-release recipe that performs all three checks (cosign signature, SLSA provenance, and checksums.txt) in one shot. It defaults to the latest published tag and cleans up its temp directory afterwards:

# Verify the latest release
just verify-release

# Verify a specific tag
just verify-release v0.6

The recipe requires cosign, slsa-verifier, curl, and gh; it will tell you to install any that are missing (brew install cosign slsa-verifier gh). gh is used to look up the latest tag when none is given and to inspect a release's assets in the troubleshooting hint. If a tag has no signed assets attached, it will point you at gh release view <TAG> --json assets -q '.assets[].name' to inspect the release.

Support & Security

• Getting Support
• Security Policy