Skip to content
Quartermaster Quartermaster

macOS installer

QuartermasterCollectorSetup-macos-arm64.run (Apple Silicon; -x64 for Intel) is a self-contained installer for the collector — the macOS sibling of the Windows and Linux installers. It bundles a portable Node binary, so the machine needs no Node install and no git clone, and everything happens per-user — no sudo required.

Because it’s a plain shell script you run from the terminal, Gatekeeper doesn’t apply — no code signing, no notarization, no right-click-open dance. (The bundled Node binary is Apple-notarized upstream by the OpenJS Foundation.)

Install

Section titled “Install”
Terminal window
sh ./QuartermasterCollectorSetup-macos-arm64.run

The guided flow mirrors the Windows wizard:

  1. Explains what will happen, then installs to ~/Library/Application Support/Quartermaster (override with --prefix).
  2. Prompts for your Worker URL and admin token (input hidden). The admin token is used once to pair and is never stored; only the revocable device-scoped token lands on disk (~/.quartermaster/, mode 0600). Re-running over an existing pairing keeps it.
  3. Registers hourly background scans via a launchd user agent (~/Library/LaunchAgents/io.quartermaster.collector.plist). Runs missed while the Mac slept coalesce and fire on wake. Logs go to <prefix>/collector.log.
  4. Offers to run the first scan immediately.

From then on the machine scans itself every hour, with secrets redacted on-device before upload — exactly the same pipeline as every other collector.

Unattended installs

Section titled “Unattended installs”

Every prompt has a flag, so fleets and dotfile scripts can install headlessly:

Terminal window
sh ./QuartermasterCollectorSetup-macos-arm64.run --yes \
  --url https://quartermaster.<you>.workers.dev \
  --admin-token "$QM_ADMIN_TOKEN"          # or just export QM_ADMIN_TOKEN
  • --roots a,b — scan roots (default: the ~/.{tool} dirs that exist)
  • --skip-connect — install now, pair later with <prefix>/collector connect
  • --no-schedule — skip the launchd agent registration
  • --uninstall — run the uninstaller of an existing install

After install

Section titled “After install”
Terminal window
QM="$HOME/Library/Application Support/Quartermaster"
"$QM/collector" status   # config + tracked count + server health
"$QM/collector" scan     # incremental scan now
"$QM/uninstall.sh"       # remove (keeps pairing)

Uninstalling unloads the launchd agent and removes the plist and program files but deliberately leaves ~/.quartermaster, so re-installing never needs re-pairing — revoke the device server-side to fully disconnect it.

Get the installer

Section titled “Get the installer”
  • Releases: every collector-v* tag builds both architectures in CI and attaches them to the GitHub release, each with a .sha256 sidecar — verify with shasum -a 256 -c QuartermasterCollectorSetup-macos-arm64.run.sha256.
  • Build it yourself: node installer/unix/build.mjs --platform macos (needs only tar; builds on any OS).

Requirements

Section titled “Requirements”

macOS on Apple Silicon (arm64) or Intel (x86_64) able to run Node 22 — macOS 11 Big Sur or later. Pick the build matching uname -m; the installer refuses a mismatch rather than relying on Rosetta.