Misc changes - added xcodeinstall routine

docs/TODO.md

@@ -1,6 +1,8 @@
 xattr -d com.apple.quarantine rclone
 Create issue about setting up completions - https://github.com/rsteube/lazycomplete
 
+Use minimum permissions / IAM for https://iosexample.com/a-command-line-tool-to-download-and-install-apples-xcode/
+https://github.com/tiiiecherle/osx_install_config/blob/master/03_homebrew_casks_and_mas/3b_homebrew_casks_and_mas_install/6_mas_appstore.sh
 # TODOs
 
 This page outlines various projects and tasks that we are currently working on. Creating a GitHub issue for each of these items would be overkill.

docs/customization/secrets.md

@@ -168,6 +168,9 @@ Unless otherwise specified in the description column, all of the variables in th
 | `ATUIN_EMAIL`                    | E-mail address used for registering with [Atuin](https://atuin.sh/)                                                                                                                                                                                                                                                                                                                             |
 | `ATUIN_PASSWORD`                 | Password used for registering with [Atuin](https://atuin.sh/)                                                                                                                                                                                                                                                                                                                                   |
 | `ATUIN_USERNAME`                 | Username used for registering with [Atuin](https://atuin.sh/)                                                                                                                                                                                                                                                                                                                                   |
+| `AWS_ACCESS_KEY_ID` | AWS access key ID (used for storing / retrieving from AWS Secret Manager which is used for headless Xcode installations / developer account authentications) |
+| `AWS_DEFAULT_REGION` | Default AWS region to use when region is not passed in via commands (e.g. `us-east-1`) |
+| `AWS_SECRET_ACCESS_KEY` | AWS access key secret (used in conjunction with the `AWS_ACCESS_KEY_ID`) |
 | `CLOUDFLARE_API_KEY`             | CloudFlare administration API key. Used by CloudFlare CLI.                                                                                                                                                                                                                                                                                                                                      |
 | `CLOUDFLARE_ACCOUNT_ID`          | The CloudFlare account ID                                                                                                                                                                                                                                                                                                                                                                       |
 | `CLOUDFLARE_ORIGIN_CA_KEY`       | The CloudFlare origin CA key (currently unused)                                                                                                                                                                                                                                                                                                                                                 |

docs/scripts/profile/exports.sh.tmpl.md

@@ -171,7 +171,7 @@ export PATH="$DOCKER_CONFIG/cli-plugins:$PATH"
 ### Dotnet
 export DOTNET_CLI_HOME="$XDG_CONFIG_HOME/dotnet"
 if [ -d /Applications ] && [ -d /Library ]; then
-  export DOTNET_ROOT="/usr/local/opt/dotnet/libexec"
+  export DOTNET_ROOT="${HOMEBREW_PREFIX:-/opt/homebrew}/opt/dotnet/libexec"
 elif [ -d /home/linuxbrew/.linuxbrew/opt/dotnet ]; then
   export DOTNET_ROOT="/home/linuxbrew/.linuxbrew/opt/dotnet/libexec"
 fi

home/.chezmoiscripts/universal/run_onchange_after_12-install-packages.sh.tmpl

@@ -43,9 +43,16 @@ if command -v install-program > /dev/null; then
     env | grep JAVA
     env | grep SDKMAN
     env | grep ASDF
+    if ! command -v unbuffer > /dev/null; then
+      if command -v brew > /dev/null; then
+        logg info 'Ensuring expect is installed for the unbuffer command' && brew install expect
+      fi
+    fi
     if command -v unbuffer > /dev/null; then
+      logg info 'Running unbuffer install-program'
       unbuffer install-program {{ $softwareList }}
     else
+      logg info 'Running install-program without unbuffer'
       install-program {{ $softwareList }}
     fi
     # TODO - Figure out how to configure no logs to print to ~/.ansible.log -- should be printing to the value specified in the ansible.cfg

home/.chezmoitemplates/secrets/AWS_ACCESS_KEY_ID

@@ -0,0 +1,7 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1M2FJL2VBSTB3Zko4OUFY
+SFQ2M2NEYmVCU01KQ2hvdkpucTFSMUV5Z2tRCnBJUzNhNS9pTE9lK3FTVlk1ZS9B
+V25QeE44NFJ4QWYvNE55bXhlN2F4WlUKLS0tIFBreThtaDNnN2lKMEk3TUpDTHhL
+WGlCU1paeitIeVFCRVpQRWdMS0Z1ZlUKpRet4slh5+Dim1wn2SvTiqQoj2BPl/Nh
+rM6TRU5POyktGI3IhIfiZP5/fJ+WpkHsHxhHlA==
+-----END AGE ENCRYPTED FILE-----

home/.chezmoitemplates/secrets/AWS_DEFAULT_REGION

@@ -0,0 +1,7 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByQmF0dEtOdlZrUzBZb0hp
+Zm9oNTlpdDJ3VFR2Rm51LzBiUTJpVFVHblJRCnZFcXRVWlMyVEpER0FUbGJSTFEv
+OUc4bzlLZUZpS1o3ZlhkMFZRZC9zY2MKLS0tIENucWs5VzNWQlM4WXVlQThnYjNo
+SzUrY1JQMnJaejJ4MlhvM3EyTXI2TEEKJO+A8U9A/OQaCKydiJZ+WtGDAaoUp7Ti
+LQE4KuHNLenVlegbuJ/MPt0=
+-----END AGE ENCRYPTED FILE-----

home/.chezmoitemplates/secrets/AWS_SECRET_ACCESS_KEY

@@ -0,0 +1,7 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJSmtad2k1Uy95Umx5bHZy
+WjlESFJTR3IwL1RhRmVOSWg3Z2lzQXphcUd3CmFJc2FyNVlFQ3ZvQ3o3d05SZHE3
+WDcyZ2poTTllaWptVnJ4c2xZdi9VWEUKLS0tIEUwU3N4ckw5Ym9waEwwMkNITkg4
+cWNiRmM0bHBodmZrL293SS9zQ1JQbDgKA8sbyRWGPNtXb3TubeXU/j1orAN2SN6e
+37mv1r0l4nivPOfyI/CpQKJtnshn7PBVRdX7of5EP+1pWnY3a/MBlOwZnuoQbkFJ
+-----END AGE ENCRYPTED FILE-----

home/dot_config/powershell/profile.ps1

@@ -30,6 +30,7 @@ Set-PSReadlineKeyHandler -Key Tab -Function MenuComplete
 carapace _carapace | Out-String | Invoke-Expression
 
 ### Homebrew
+# TODO - Add for case where value is /opt/homebrew/bin/brew shellenv
 Add-Content -Path $PROFILE.CurrentUserAllHosts -Value '$(/usr/local/bin/brew shellenv) | Invoke-Expression'
 
 ### posh-git settings

home/dot_config/shell/exports.sh.tmpl

@@ -184,10 +184,11 @@ export PATH="$DOCKER_CONFIG/cli-plugins:$PATH"
 ### Dotnet
 export DOTNET_CLI_HOME="${XDG_CONFIG_HOME:-$HOME/.config}/dotnet"
 if [ -d /Applications ] && [ -d /Library ]; then
-  export DOTNET_ROOT="/usr/local/opt/dotnet/libexec"
+  export DOTNET_ROOT="${HOMEBREW_PREFIX:-/opt/homebrew}/opt/dotnet/libexec"
 elif [ -d /home/linuxbrew/.linuxbrew/opt/dotnet ]; then
   export DOTNET_ROOT="/home/linuxbrew/.linuxbrew/opt/dotnet/libexec"
 fi
+export MONO_GAC_PREFIX="${HOMEBREW_PREFIX:-/opt/homebrew}"
 export PATH="$PATH:${XDG_CONFIG_HOME:-$HOME/.config}/dotnet/.dotnet/tools"
 
 ### Elastic Agent

home/dot_config/shell/private_private.sh.tmpl

@@ -16,6 +16,11 @@ export ATUIN_EMAIL="{{ if (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates"
 export ATUIN_PASSWORD="{{ if (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ATUIN_PASSWORD")) }}{{ includeTemplate "secrets/ATUIN_PASSWORD" | decrypt | trim }}{{ else }}{{ env "ATUIN_PASSWORD" }}{{ end }}"
 export ATUIN_USERNAME="{{ if (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "ATUIN_USERNAME")) }}{{ includeTemplate "secrets/ATUIN_USERNAME" | decrypt | trim }}{{ else }}{{ env "ATUIN_USERNAME" }}{{ end }}"
 
+### AWS
+export AWS_ACCESS_KEY_ID="{{ if (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "AWS_ACCESS_KEY_ID")) }}{{ includeTemplate "secrets/AWS_ACCESS_KEY_ID" | decrypt | trim }}{{ else }}{{ env "AWS_ACCESS_KEY_ID" }}{{ end }}"
+export AWS_SECRET_ACCESS_KEY="{{ if (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "AWS_SECRET_ACCESS_KEY")) }}{{ includeTemplate "secrets/AWS_SECRET_ACCESS_KEY" | decrypt | trim }}{{ else }}{{ env "AWS_SECRET_ACCESS_KEY" }}{{ end }}"
+export AWS_DEFAULT_REGION="{{ if (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "AWS_DEFAULT_REGION")) }}{{ includeTemplate "secrets/AWS_DEFAULT_REGION" | decrypt | trim }}{{ else }}{{ env "AWS_DEFAULT_REGION" }}{{ end }}"
+
 ### Google Cloud SDK
 export CLOUDSDK_CORE_PROJECT="{{ .user.gcloud.coreProject }}"
 export GCE_SERVICE_ACCOUNT_EMAIL="{{ .user.gcloud.email }}"

home/dot_local/etc/clamav/clamd.conf

@@ -0,0 +1,800 @@
+##
+## Example config file for the Clam AV daemon
+## Please read the clamd.conf(5) manual before editing this file.
+##
+
+
+# Comment or remove the line below.
+
+# Uncomment this option to enable logging.
+# LogFile must be writable for the user running daemon.
+# A full path is required.
+# Default: disabled
+#LogFile /tmp/clamd.log
+
+# By default the log file is locked for writing - the lock protects against
+# running clamd multiple times (if want to run another clamd, please
+# copy the configuration file, change the LogFile variable, and run
+# the daemon with --config-file option).
+# This option disables log file locking.
+# Default: no
+#LogFileUnlock yes
+
+# Maximum size of the log file.
+# Value of 0 disables the limit.
+# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
+# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
+# in bytes just don't use modifiers. If LogFileMaxSize is enabled, log
+# rotation (the LogRotate option) will always be enabled.
+# Default: 1M
+#LogFileMaxSize 2M
+
+# Log time with each message.
+# Default: no
+#LogTime yes
+
+# Also log clean files. Useful in debugging but drastically increases the
+# log size.
+# Default: no
+#LogClean yes
+
+# Use system logger (can work together with LogFile).
+# Default: no
+#LogSyslog yes
+
+# Specify the type of syslog messages - please refer to 'man syslog'
+# for facility names.
+# Default: LOG_LOCAL6
+#LogFacility LOG_MAIL
+
+# Enable verbose logging.
+# Default: no
+#LogVerbose yes
+
+# Enable log rotation. Always enabled when LogFileMaxSize is enabled.
+# Default: no
+#LogRotate yes
+
+# Enable Prelude output.
+# Default: no
+#PreludeEnable yes
+#
+# Set the name of the analyzer used by prelude-admin.
+# Default: ClamAV
+#PreludeAnalyzerName ClamAV
+
+# Log additional information about the infected file, such as its
+# size and hash, together with the virus name.
+#ExtendedDetectionInfo yes
+
+# This option allows you to save a process identifier of the listening
+# daemon (main thread).
+# This file will be owned by root, as long as clamd was started by root.
+# It is recommended that the directory where this file is stored is
+# also owned by root to keep other users from tampering with it.
+# Default: disabled
+#PidFile /var/run/clamd.pid
+
+# Optional path to the global temporary directory.
+# Default: system specific (usually /tmp or /var/tmp).
+#TemporaryDirectory /var/tmp
+
+# Path to the database directory.
+# Default: hardcoded (depends on installation options)
+#DatabaseDirectory /var/lib/clamav
+
+# Only load the official signatures published by the ClamAV project.
+# Default: no
+#OfficialDatabaseOnly no
+
+# The daemon can work in local mode, network mode or both.
+# Due to security reasons we recommend the local mode.
+
+# Path to a local socket file the daemon will listen on.
+# Default: disabled (must be specified by a user)
+LocalSocket /var/run/clamd.socket
+
+# Sets the group ownership on the unix socket.
+# Default: disabled (the primary group of the user running clamd)
+#LocalSocketGroup virusgroup
+
+# Sets the permissions on the unix socket to the specified mode.
+# Default: disabled (socket is world accessible)
+#LocalSocketMode 660
+
+# Remove stale socket after unclean shutdown.
+# Default: yes
+#FixStaleSocket yes
+
+# TCP port address.
+# Default: no
+#TCPSocket 3310
+
+# TCP address.
+# By default we bind to INADDR_ANY, probably not wise.
+# Enable the following to provide some degree of protection
+# from the outside world. This option can be specified multiple
+# times if you want to listen on multiple IPs. IPv6 is now supported.
+# Default: no
+#TCPAddr localhost
+
+# Maximum length the queue of pending connections may grow to.
+# Default: 200
+#MaxConnectionQueueLength 30
+
+# Clamd uses FTP-like protocol to receive data from remote clients.
+# If you are using clamav-milter to balance load between remote clamd daemons
+# on firewall servers you may need to tune the options below.
+
+# Close the connection when the data size limit is exceeded.
+# The value should match your MTA's limit for a maximum attachment size.
+# Default: 100M
+#StreamMaxLength 25M
+
+# Limit port range.
+# Default: 1024
+#StreamMinPort 30000
+# Default: 2048
+#StreamMaxPort 32000
+
+# Maximum number of threads running at the same time.
+# Default: 10
+#MaxThreads 20
+
+# Waiting for data from a client socket will timeout after this time (seconds).
+# Default: 120
+#ReadTimeout 300
+
+# This option specifies the time (in seconds) after which clamd should
+# timeout if a client doesn't provide any initial command after connecting.
+# Default: 30
+#CommandReadTimeout 30
+
+# This option specifies how long to wait (in milliseconds) if the send buffer
+# is full.
+# Keep this value low to prevent clamd hanging.
+#
+# Default: 500
+#SendBufTimeout 200
+
+# Maximum number of queued items (including those being processed by
+# MaxThreads threads).
+# It is recommended to have this value at least twice MaxThreads if possible.
+# WARNING: you shouldn't increase this too much to avoid running out  of file
+# descriptors, the following condition should hold:
+# MaxThreads*MaxRecursion + (MaxQueue - MaxThreads) + 6< RLIMIT_NOFILE (usual
+# max is 1024).
+#
+# Default: 100
+#MaxQueue 200
+
+# Waiting for a new job will timeout after this time (seconds).
+# Default: 30
+#IdleTimeout 60
+
+# Don't scan files and directories matching regex
+# This directive can be used multiple times
+# Default: scan all
+#ExcludePath ^/proc/
+#ExcludePath ^/sys/
+
+# Maximum depth directories are scanned at.
+# Default: 15
+#MaxDirectoryRecursion 20
+
+# Follow directory symlinks.
+# Default: no
+#FollowDirectorySymlinks yes
+
+# Follow regular file symlinks.
+# Default: no
+#FollowFileSymlinks yes
+
+# Scan files and directories on other filesystems.
+# Default: yes
+#CrossFilesystems yes
+
+# Perform a database check.
+# Default: 600 (10 min)
+#SelfCheck 600
+
+# Enable non-blocking (multi-threaded/concurrent) database reloads.
+# This feature will temporarily load a second scanning engine while scanning
+# continues using the first engine. Once loaded, the new engine takes over.
+# The old engine is removed as soon as all scans using the old engine have
+# completed.
+# This feature requires more RAM, so this option is provided in case users are
+# willing to block scans during reload in exchange for lower RAM requirements.
+# Default: yes
+#ConcurrentDatabaseReload no
+
+# Execute a command when virus is found. In the command string %v will
+# be replaced with the virus name and %f will be replaced with the file name.
+# Additionally, two environment variables will be defined: $CLAM_VIRUSEVENT_FILENAME
+# and $CLAM_VIRUSEVENT_VIRUSNAME.
+# Default: no
+#VirusEvent /usr/local/bin/send_sms 123456789 "VIRUS ALERT: %v in %f"
+
+# Run as another user (clamd must be started by root for this option to work)
+# Default: don't drop privileges
+#User clamav
+
+# Stop daemon when libclamav reports out of memory condition.
+#ExitOnOOM yes
+
+# Don't fork into background.
+# Default: no
+#Foreground yes
+
+# Enable debug messages in libclamav.
+# Default: no
+#Debug yes
+
+# Do not remove temporary files (for debug purposes).
+# Default: no
+#LeaveTemporaryFiles yes
+
+# Record metadata about the file being scanned.
+# Scan metadata is useful for file analysis purposes and for debugging scan behavior.
+# The JSON metadata will be printed after the scan is complete if Debug is enabled.
+# A metadata.json file will be written to the scan temp directory if LeaveTemporaryFiles is enabled.
+# Default: no
+#GenerateMetadataJson yes
+
+# Permit use of the ALLMATCHSCAN command. If set to no, clamd will reject
+# any ALLMATCHSCAN command as invalid.
+# Default: yes
+#AllowAllMatchScan no
+
+# Detect Possibly Unwanted Applications.
+# Default: no
+#DetectPUA yes
+
+# Exclude a specific PUA category. This directive can be used multiple times.
+# See https://github.com/vrtadmin/clamav-faq/blob/master/faq/faq-pua.md for
+# the complete list of PUA categories.
+# Default: Load all categories (if DetectPUA is activated)
+#ExcludePUA NetTool
+#ExcludePUA PWTool
+
+# Only include a specific PUA category. This directive can be used multiple
+# times.
+# Default: Load all categories (if DetectPUA is activated)
+#IncludePUA Spy
+#IncludePUA Scanner
+#IncludePUA RAT
+
+# This option causes memory or nested map scans to dump the content to disk.
+# If you turn on this option, more data is written to disk and is available
+# when the LeaveTemporaryFiles option is enabled.
+#ForceToDisk yes
+
+# This option allows you to disable the caching feature of the engine. By
+# default, the engine will store an MD5 in a cache of any files that are
+# not flagged as virus or that hit limits checks. Disabling the cache will
+# have a negative performance impact on large scans.
+# Default: no
+#DisableCache yes
+
+# In some cases (eg. complex malware, exploits in graphic files, and others),
+# ClamAV uses special algorithms to detect abnormal patterns and behaviors that
+# may be malicious.  This option enables alerting on such heuristically
+# detected potential threats.
+# Default: yes
+#HeuristicAlerts yes
+
+# Allow heuristic alerts to take precedence.
+# When enabled, if a heuristic scan (such as phishingScan) detects
+# a possible virus/phish it will stop scan immediately. Recommended, saves CPU
+# scan-time.
+# When disabled, virus/phish detected by heuristic scans will be reported only
+# at the end of a scan. If an archive contains both a heuristically detected
+# virus/phish, and a real malware, the real malware will be reported
+#
+# Keep this disabled if you intend to handle "Heuristics.*" viruses
+# differently from "real" malware.
+# If a non-heuristically-detected virus (signature-based) is found first,
+# the scan is interrupted immediately, regardless of this config option.
+#
+# Default: no
+#HeuristicScanPrecedence yes
+
+
+##
+## Heuristic Alerts
+##
+
+# With this option clamav will try to detect broken executables (both PE and
+# ELF) and alert on them with the Broken.Executable heuristic signature.
+# Default: no
+#AlertBrokenExecutables yes
+
+# With this option clamav will try to detect broken media file (JPEG,
+# TIFF, PNG, GIF) and alert on them with a Broken.Media heuristic signature.
+# Default: no
+#AlertBrokenMedia yes
+
+# Alert on encrypted archives _and_ documents with heuristic signature
+# (encrypted .zip, .7zip, .rar, .pdf).
+# Default: no
+#AlertEncrypted yes
+
+# Alert on encrypted archives with heuristic signature (encrypted .zip, .7zip,
+# .rar).
+# Default: no
+#AlertEncryptedArchive yes
+
+# Alert on encrypted archives with heuristic signature (encrypted .pdf).
+# Default: no
+#AlertEncryptedDoc yes
+
+# With this option enabled OLE2 files containing VBA macros, which were not
+# detected by signatures will be marked as "Heuristics.OLE2.ContainsMacros".
+# Default: no
+#AlertOLE2Macros yes
+
+# Alert on SSL mismatches in URLs, even if the URL isn't in the database.
+# This can lead to false positives.
+# Default: no
+#AlertPhishingSSLMismatch yes
+
+# Alert on cloaked URLs, even if URL isn't in database.
+# This can lead to false positives.
+# Default: no
+#AlertPhishingCloak yes
+
+# Alert on raw DMG image files containing partition intersections
+# Default: no
+#AlertPartitionIntersection yes
+
+
+##
+## Executable files
+##
+
+# PE stands for Portable Executable - it's an executable file format used
+# in all 32 and 64-bit versions of Windows operating systems. This option
+# allows ClamAV to perform a deeper analysis of executable files and it's also
+# required for decompression of popular executable packers such as UPX, FSG,
+# and Petite. If you turn off this option, the original files will still be
+# scanned, but without additional processing.
+# Default: yes
+#ScanPE yes
+
+# Certain PE files contain an authenticode signature. By default, we check
+# the signature chain in the PE file against a database of trusted and
+# revoked certificates if the file being scanned is marked as a virus.
+# If any certificate in the chain validates against any trusted root, but
+# does not match any revoked certificate, the file is marked as trusted.
+# If the file does match a revoked certificate, the file is marked as virus.
+# The following setting completely turns off authenticode verification.
+# Default: no
+#DisableCertCheck yes
+
+# Executable and Linking Format is a standard format for UN*X executables.
+# This option allows you to control the scanning of ELF files.
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+# Default: yes
+#ScanELF yes
+
+
+##
+## Documents
+##
+
+# This option enables scanning of OLE2 files, such as Microsoft Office
+# documents and .msi files.
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+# Default: yes
+#ScanOLE2 yes
+
+# This option enables scanning within PDF files.
+# If you turn off this option, the original files will still be scanned, but
+# without decoding and additional processing.
+# Default: yes
+#ScanPDF yes
+
+# This option enables scanning within SWF files.
+# If you turn off this option, the original files will still be scanned, but
+# without decoding and additional processing.
+# Default: yes
+#ScanSWF yes
+
+# This option enables scanning xml-based document files supported by libclamav.
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+# Default: yes
+#ScanXMLDOCS yes
+
+# This option enables scanning of HWP3 files.
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+# Default: yes
+#ScanHWP3 yes
+
+
+##
+## Mail files
+##
+
+# Enable internal e-mail scanner.
+# If you turn off this option, the original files will still be scanned, but
+# without parsing individual messages/attachments.
+# Default: yes
+#ScanMail yes
+
+# Scan RFC1341 messages split over many emails.
+# You will need to periodically clean up $TemporaryDirectory/clamav-partial
+# directory.
+# WARNING: This option may open your system to a DoS attack.
+#	   Never use it on loaded servers.
+# Default: no
+#ScanPartialMessages yes
+
+# With this option enabled ClamAV will try to detect phishing attempts by using
+# HTML.Phishing and Email.Phishing NDB signatures.
+# Default: yes
+#PhishingSignatures no
+
+# With this option enabled ClamAV will try to detect phishing attempts by
+# analyzing URLs found in emails using WDB and PDB signature databases.
+# Default: yes
+#PhishingScanURLs no
+
+
+##
+## Data Loss Prevention (DLP)
+##
+
+# Enable the DLP module
+# Default: No
+#StructuredDataDetection yes
+
+# This option sets the lowest number of Credit Card numbers found in a file
+# to generate a detect.
+# Default: 3
+#StructuredMinCreditCardCount 5
+
+# With this option enabled the DLP module will search for valid Credit Card
+# numbers only. Debit and Private Label cards will not be searched.
+# Default: no
+#StructuredCCOnly yes
+
+# This option sets the lowest number of Social Security Numbers found
+# in a file to generate a detect.
+# Default: 3
+#StructuredMinSSNCount 5
+
+# With this option enabled the DLP module will search for valid
+# SSNs formatted as xxx-yy-zzzz
+# Default: yes
+#StructuredSSNFormatNormal yes
+
+# With this option enabled the DLP module will search for valid
+# SSNs formatted as xxxyyzzzz
+# Default: no
+#StructuredSSNFormatStripped yes
+
+
+##
+## HTML
+##
+
+# Perform HTML normalisation and decryption of MS Script Encoder code.
+# Default: yes
+# If you turn off this option, the original files will still be scanned, but
+# without additional processing.
+#ScanHTML yes
+
+
+##
+## Archives
+##
+
+# ClamAV can scan within archives and compressed files.
+# If you turn off this option, the original files will still be scanned, but
+# without unpacking and additional processing.
+# Default: yes
+#ScanArchive yes
+
+
+##
+## Limits
+##
+
+# The options below protect your system against Denial of Service attacks
+# using archive bombs.
+
+# This option sets the maximum amount of time to a scan may take.
+# In this version, this field only affects the scan time of ZIP archives.
+# Value of 0 disables the limit.
+# Note: disabling this limit or setting it too high may result allow scanning
+# of certain files to lock up the scanning process/threads resulting in a
+# Denial of Service.
+# Time is in milliseconds.
+# Default: 120000
+#MaxScanTime 300000
+
+# This option sets the maximum amount of data to be scanned for each input
+# file. Archives and other containers are recursively extracted and scanned
+# up to this value.
+# Value of 0 disables the limit
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 400M
+#MaxScanSize 1000M
+
+# Files larger than this limit won't be scanned. Affects the input file itself
+# as well as files contained inside it (when the input file is an archive, a
+# document or some other kind of container).
+# Value of 0 disables the limit.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Technical design limitations prevent ClamAV from scanning files greater than
+# 2 GB at this time.
+# Default: 100M
+#MaxFileSize 400M
+
+# Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR
+# file, all files within it will also be scanned. This options specifies how
+# deeply the process should be continued.
+# Note: setting this limit too high may result in severe damage to the system.
+# Default: 17
+#MaxRecursion 10
+
+# Number of files to be scanned within an archive, a document, or any other
+# container file.
+# Value of 0 disables the limit.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 10000
+#MaxFiles 15000
+
+# Maximum size of a file to check for embedded PE. Files larger than this value
+# will skip the additional analysis step.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 40M
+#MaxEmbeddedPE 100M
+
+# Maximum size of a HTML file to normalize. HTML files larger than this value
+# will not be normalized or scanned.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 40M
+#MaxHTMLNormalize 100M
+
+# Maximum size of a normalized HTML file to scan. HTML files larger than this
+# value after normalization will not be scanned.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 8M
+#MaxHTMLNoTags 16M
+
+# Maximum size of a script file to normalize. Script content larger than this
+# value will not be normalized or scanned.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 20M
+#MaxScriptNormalize 50M
+
+# Maximum size of a ZIP file to reanalyze type recognition. ZIP files larger
+# than this value will skip the step to potentially reanalyze as PE.
+# Note: disabling this limit or setting it too high may result in severe damage
+# to the system.
+# Default: 1M
+#MaxZipTypeRcg 1M
+
+# This option sets the maximum number of partitions of a raw disk image to be
+# scanned.
+# Raw disk images with more partitions than this value will have up to
+# the value number partitions scanned. Negative values are not allowed.
+# Note: setting this limit too high may result in severe damage or impact
+# performance.
+# Default: 50
+#MaxPartitions 128
+
+# This option sets the maximum number of icons within a PE to be scanned.
+# PE files with more icons than this value will have up to the value number
+# icons scanned.
+# Negative values are not allowed.
+# WARNING: setting this limit too high may result in severe damage or impact
+# performance.
+# Default: 100
+#MaxIconsPE 200
+
+# This option sets the maximum recursive calls for HWP3 parsing during
+# scanning. HWP3 files using more than this limit will be terminated and
+# alert the user.
+# Scans will be unable to scan any HWP3 attachments if the recursive limit
+# is reached.
+# Negative values are not allowed.
+# WARNING: setting this limit too high may result in severe damage or impact
+# performance.
+# Default: 16
+#MaxRecHWP3 16
+
+# This option sets the maximum calls to the PCRE match function during
+# an instance of regex matching.
+# Instances using more than this limit will be terminated and alert the user
+# but the scan will continue.
+# For more information on match_limit, see the PCRE documentation.
+# Negative values are not allowed.
+# WARNING: setting this limit too high may severely impact performance.
+# Default: 100000
+#PCREMatchLimit 20000
+
+# This option sets the maximum recursive calls to the PCRE match function
+# during an instance of regex matching.
+# Instances using more than this limit will be terminated and alert the user
+# but the scan will continue.
+# For more information on match_limit_recursion, see the PCRE documentation.
+# Negative values are not allowed and values > PCREMatchLimit are superfluous.
+# WARNING: setting this limit too high may severely impact performance.
+# Default: 2000
+#PCRERecMatchLimit 10000
+
+# This option sets the maximum filesize for which PCRE subsigs will be
+# executed. Files exceeding this limit will not have PCRE subsigs executed
+# unless a subsig is encompassed to a smaller buffer.
+# Negative values are not allowed.
+# Setting this value to zero disables the limit.
+# WARNING: setting this limit too high or disabling it may severely impact
+# performance.
+# Default: 100M
+#PCREMaxFileSize 400M
+
+# When AlertExceedsMax is set, files exceeding the MaxFileSize, MaxScanSize, or
+# MaxRecursion limit will be flagged with the virus name starting with
+# "Heuristics.Limits.Exceeded".
+# Default: no
+#AlertExceedsMax yes
+
+##
+## On-access Scan Settings
+##
+
+# Don't scan files larger than OnAccessMaxFileSize
+# Value of 0 disables the limit.
+# Default: 5M
+#OnAccessMaxFileSize 10M
+
+# Max number of scanning threads to allocate to the OnAccess thread pool at
+# startup. These threads are the ones responsible for creating a connection
+# with the daemon and kicking off scanning after an event has been processed.
+# To prevent clamonacc from consuming all clamd's resources keep this lower
+# than clamd's max threads.
+# Default: 5
+#OnAccessMaxThreads 10
+
+# Max amount of time (in milliseconds) that the OnAccess client should spend
+# for every connect, send, and recieve attempt when communicating with clamd
+# via curl.
+# Default: 5000 (5 seconds)
+# OnAccessCurlTimeout 10000
+
+# Toggles dynamic directory determination. Allows for recursively watching
+# include paths.
+# Default: no
+#OnAccessDisableDDD yes
+
+# Set the include paths (all files inside them will be scanned). You can have
+# multiple OnAccessIncludePath directives but each directory must be added
+# in a separate line.
+# Default: disabled
+#OnAccessIncludePath /home
+#OnAccessIncludePath /students
+
+# Set the exclude paths. All subdirectories are also excluded.
+# Default: disabled
+#OnAccessExcludePath /home/user
+
+# Modifies fanotify blocking behaviour when handling permission events.
+# If off, fanotify will only notify if the file scanned is a virus,
+# and not perform any blocking.
+# Default: no
+#OnAccessPrevention yes
+
+# When using prevention, if this option is turned on, any errors that occur
+# during scanning will result in the event attempt being denied. This could
+# potentially lead to unwanted system behaviour with certain configurations,
+# so the client defaults this to off and prefers allowing access events in
+# case of scan or connection error.
+# Default: no
+#OnAccessDenyOnError yes
+
+# Toggles extra scanning and notifications when a file or directory is
+# created or moved.
+# Requires the  DDD system to kick-off extra scans.
+# Default: no
+#OnAccessExtraScanning yes
+
+# Set the  mount point to be scanned. The mount point specified, or the mount
+# point containing the specified directory will be watched. If any directories
+# are specified, this option will preempt (disable and ignore all options
+# related to) the DDD system. This option will result in verdicts only.
+# Note that prevention is explicitly disallowed to prevent common, fatal
+# misconfigurations. (e.g. watching "/" with prevention on and no exclusions
+# made on vital system directories)
+# It can be used multiple times.
+# Default: disabled
+#OnAccessMountPath /
+#OnAccessMountPath /home/user
+
+# With this option you can exclude the root UID (0). Processes run under
+# root with be able to access all files without triggering scans or
+# permission denied events.
+# Note that if clamd cannot check the uid of the process that generated an
+# on-access scan event (e.g., because OnAccessPrevention was not enabled, and
+# the process already exited), clamd will perform a scan.  Thus, setting
+# OnAccessExcludeRootUID is not *guaranteed* to prevent every access by the
+# root user from triggering a scan (unless OnAccessPrevention is enabled).
+# Default: no
+#OnAccessExcludeRootUID no
+
+# With this option you can exclude specific UIDs. Processes with these UIDs
+# will be able to access all files without triggering scans or permission
+# denied events.
+# This option can be used multiple times (one per line).
+# Using a value of 0 on any line will disable this option entirely.
+# To exclude the root UID (0) please enable the OnAccessExcludeRootUID
+# option.
+# Also note that if clamd cannot check the uid of the process that generated an
+# on-access scan event (e.g., because OnAccessPrevention was not enabled, and
+# the process already exited), clamd will perform a scan.  Thus, setting
+# OnAccessExcludeUID is not *guaranteed* to prevent every access by the
+# specified uid from triggering a scan (unless OnAccessPrevention is enabled).
+# Default: disabled
+#OnAccessExcludeUID -1
+
+# This option allows exclusions via user names when using the on-access
+# scanning client. It can be used multiple times.
+# It has the same potential race condition limitations of the
+# OnAccessExcludeUID option.
+# Default: disabled
+#OnAccessExcludeUname clamav
+
+# Number of times the OnAccess client will retry a failed scan due to
+# connection problems (or other issues).
+# Default: 0
+#OnAccessRetryAttempts 3
+
+##
+## Bytecode
+##
+
+# With this option enabled ClamAV will load bytecode from the database.
+# It is highly recommended you keep this option on, otherwise you'll miss
+# detections for many new viruses.
+# Default: yes
+#Bytecode yes
+
+# Set bytecode security level.
+# Possible values:
+#   None -      No security at all, meant for debugging.
+#               DO NOT USE THIS ON PRODUCTION SYSTEMS.
+#               This value is only available if clamav was built
+#               with --enable-debug!
+#   TrustSigned - Trust bytecode loaded from signed .c[lv]d files, insert
+#               runtime safety checks for bytecode loaded from other sources.
+#   Paranoid -  Don't trust any bytecode, insert runtime checks for all.
+# Recommended: TrustSigned, because bytecode in .cvd files already has these
+# checks.
+# Note that by default only signed bytecode is loaded, currently you can only
+# load unsigned bytecode in --enable-debug mode.
+#
+# Default: TrustSigned
+#BytecodeSecurity TrustSigned
+
+# Allow loading bytecode from outside digitally signed .c[lv]d files.
+# **Caution**: You should NEVER run bytecode signatures from untrusted sources.
+# Doing so may result in arbitrary code execution.
+# Default: no
+#BytecodeUnsigned yes
+
+# Set bytecode timeout in milliseconds.
+#
+# Default: 5000
+# BytecodeTimeout 1000

software.yml

@@ -718,6 +718,9 @@ softwarePackages:
     _github: https://github.com/0xERR0R/blocky
     _name: Blocky
     _service: blocky
+    _service:brew:
+      - name: blocky
+        sudo: true
     _serviceEnabled: true
     brew: blocky
     go: github.com/0xERR0R/blocky@mastergithub.com/0xERR0R/blocky@master
@@ -730,11 +733,8 @@ softwarePackages:
   tart:
     _bin: tart
     _github: https://github.com/cirruslabs/tart
-    _when:brew:darwin: '[ $(uname -m) = "arm64" ]'
     _todo: Verify that this installs properly (error on arm64 macOS)
-    brew:darwin:
-      - tart
-      - cirruslabs/cli/gitlab-tart-executor
+    brew:darwin: gitlab-tart-executor
   web-ext:
     _bin: web-ext
     _github: https://github.com/mozilla/web-ext
@@ -1898,11 +1898,30 @@ softwarePackages:
     _github: https://github.com/Cisco-Talos/clamav
     _home: https://www.clamav.net/
     _name: ClamAV
-    _post: if [ -f "${XDG_CONFIG_HOME:-$HOME/.config}/clamav/freshclam.conf" ]; then sudo cp -f "${XDG_CONFIG_HOME:-$HOME/.config}/clamav/freshclam.conf" /usr/local/etc/clamav/freshclam.conf; fi && freshclam
+    _post: |
+      # Add freshclam.conf
+      if [ -f "$HOME/.local/etc/clamav/freshclam.conf" ]; then
+        sudo mkdir -p /usr/local/etc/clamav
+        sudo cp -f "$HOME/.local/etc/clamav/freshclam.conf" /usr/local/etc/clamav/freshclam.conf
+        if [ -d "${HOMEBREW_PREFIX:-/opt/homebrew}/etc/clamav" ] && [ ! -f "${HOMEBREW_PREFIX:-/opt/homebrew}/etc/clamav/freshclam.conf" ]; then
+          ln -s /usr/local/etc/clamav/freshclam.conf "${HOMEBREW_PREFIX:-/opt/homebrew}/etc/clamav/freshclam.conf"
+        fi
+      fi
+      # Add clamd.conf
+      if [ -f "$HOME/.local/etc/clamav/clamd.conf" ]; then
+        sudo mkdir -p /usr/local/etc/clamav
+        sudo cp -f "$HOME/.local/etc/clamav/clamd.conf" /usr/local/etc/clamav/clamd.conf
+        if [ -d "${HOMEBREW_PREFIX:-/opt/homebrew}/etc/clamav" ] && [ ! -f "${HOMEBREW_PREFIX:-/opt/homebrew}/etc/clamav/clamd.conf" ]; then
+          ln -s /usr/local/etc/clamav/clamd.conf "${HOMEBREW_PREFIX:-/opt/homebrew}/etc/clamav/clamd.conf"
+        fi
+      fi
+      # Update database
+      freshclam
     _service:apt: clamav-freshclam
     _service:dnf: clamd-freshclam
     _service:pacman: clamav-freshclam
     _service:brew: clamav
+    _serviceEnabled: true
     apt:
       - clamav
       - clamdscan
@@ -2032,7 +2051,6 @@ softwarePackages:
     _github: https://github.com/CocoaPods/CocoaPods
     _home: https://cocoapods.org/
     _name: cocoapods
-    _when:brew: test -d /usr/local/Cellar/cocoapods
     ansible:darwin: professormanhattan.cocoapods
     brew:darwin: cocoapods
     gem:darwin: cocoapods
@@ -2934,8 +2952,8 @@ softwarePackages:
     _github: https://github.com/mongodb/mongo
     _name: MongoDB
     _service: mongodb
-    _service:brew: mongodb/brew/mongodb-community
-    brew: mongodb/brew/mongodb-community
+    _service:brew: mongodb-community
+    brew: mongodb-community
     choco: mongodb
   mongodb-compass:
     _bin: mongodb-compass
@@ -3882,7 +3900,9 @@ softwarePackages:
     _github: null
     _home: null
     _name: Git LFS
-    _post: git lfs install
+    _post: |
+      sudo git lfs install --system
+      git lfs install
     ansible: professormanhattan.gitlfs
     brew: git-lfs
     scoop: git-lfs
@@ -5799,7 +5819,18 @@ softwarePackages:
     ansible: professormanhattan.microsofttodo
     cask: ao
     snap: microsoft-todo-unofficial
+  hyperkit:
+    _deps:darwin:
+      - xcode
+    _bin: hyperkit
+    _github: https://github.com/moby/hyperkit
+    _name: HyperKit
+    brew:darwin: hyperkit
   minikube:
+    _deps:darwin:
+      - hyperkit
+    _deps:
+      - docker
     _bin: minikube
     _desc: minikube quickly sets up a local Kubernetes cluster on macOS, Linux, and Windows
     _docs: https://minikube.sigs.k8s.io/docs/
@@ -5807,13 +5838,9 @@ softwarePackages:
     _home: null
     _name: minikube
     # TODO - Prefer HyperV on Windows https://minikube.sigs.k8s.io/docs/drivers/hyperv/
-    # TODO - Prefer HyperKit on macOS https://minikube.sigs.k8s.io/docs/drivers/hyperkit/
-    _post: if command -v docker > /dev/null; then minikube config set driver docker; elif command -v VBoxManage > /dev/null; then minikube config set driver virtualbox; fi
+    _post: if command -v hyperkit > /dev/null; then minikube config set driver hyperkit; elif command -v docker > /dev/null; then minikube config set driver docker; elif command -v VBoxManage > /dev/null; then minikube config set driver virtualbox; fi
     _todo: A full installation of Xcode.app 9.0 is required. Also, hyperkit x86_64 architecture is required for this software. So automate install of Xcode.app 9.0 and add check for x86_64 prior to installing this
     brew: minikube
-    brew:darwin:
-      - hyperkit
-      - minikube
     choco: minikube
   mitmproxy:
     _bin: mitmproxy
@@ -6271,6 +6298,9 @@ softwarePackages:
     _home: https://github.com/slackhq/nebula
     _name: nebula
     _service: nebula
+    _service:brew:
+      - name: nebula
+        sudo: true
     _serviceEnabled: true
     brew: nebula
     dnf: nebula
@@ -7131,6 +7161,8 @@ softwarePackages:
     port: php
     scoop: php
   php-extensions:
+    _deps:
+      - postgresql
     _name: PHP Extensions
     _note: Needs testing
     apt:
@@ -7154,8 +7186,6 @@ softwarePackages:
       - php-snmp
       - php-sqlite3
       - php-xml
-    brew:
-      - postgresql
     dnf:
       - pcre-devel
       - postgresql-devel
@@ -7215,6 +7245,17 @@ softwarePackages:
       - php-snmp
       - php-sqlite3
       - php-xml
+  postgresql:
+    _bin: postgresql
+    _name: PostgreSQL
+    _github: https://github.com/postgres/postgres
+    _service:brew: postgresql@14
+    brew: postgresql
+    zypper: postgresql
+    pacman: postgresql
+    apt: postgresql
+    dnf: postgresql
+    choco: postgresql
   pip:
     _bin: pip
     _desc: '[pip](https://pypi.org/project/pip/) is a package-management system written in Python used to install and manage software packages. It connects to an online repository of public and paid-for private packages, called the Python Package Index.'
@@ -7564,6 +7605,7 @@ softwarePackages:
       - protonvpn
     yay: protonvpn
   protonvpn-cli:
+    # TODO - Add seperate entry for openvpn (sudo brew services start openvpn)
     _bin: protonvpn
     _desc: The ProtonVPN CLI official release for Linux along with an unofficial ProtonVPN CLI for macOS
     _docs: null
@@ -8419,6 +8461,9 @@ softwarePackages:
     _name: sftpgo
     _post: sudo mkdir -p /usr/local/etc/sftpgo && sudo cp -f "$HOME/.local/etc/sftpgo/sftpgo.json" /usr/local/etc/sftpgo/sftpgo.json && sudo sftpgo initprovider
     _service: sftpgo
+    _service:brew:
+      - name: sftpgo
+        sudo: true
     _serviceEnabled: true
     brew: sftpgo
     choco: sftpgo
@@ -10420,6 +10465,9 @@ softwarePackages:
   fail2ban:
     _bin: fail2ban-client
     _service: fail2ban
+    _service:brew:
+      - name: fail2ban
+        sudo: true
     _serviceEnabled: true
     # fail2ban cannot be installed on Qubes Fedora 36 without messing with the qubes-firewall since firewalld is required
     _when:linux: echo '! command -v qubes-firewall > /dev/null && test -f /proc/version && ! grep Microsoft /proc/version > /dev/null' | bash
@@ -10598,6 +10646,8 @@ softwarePackages:
     _name: xcpretty
     gem:darwin: xcpretty
   xcode:
+    _deps:script:darwin:
+      - xcodeinstall
     _bin: xcodebuild
     _desc: "[Xcode](https://developer.apple.com/xcode/) is Apple's integrated development environment for macOS, used to develop software for macOS, iOS, iPadOS, watchOS, and tvOS."
     _docs: https://developer.apple.com/documentation/xcode
@@ -10605,7 +10655,57 @@ softwarePackages:
     _home: https://developer.apple.com/xcode/
     _name: XCode
     _post: sudo xcodebuild -license accept && sudo xcodebuild -runFirstLaunch
+    _when:darwin: '! test -d /Applications/Xcode.app'
     mas: 497799835
+    script:darwin: |
+      ### Load AWS secrets
+      source "${XDG_CONFIG_HOME:-$HOME/.config}/shell/private.sh"
+      ### Setup passwordless sudo
+      if ! sudo cat /etc/sudoers | grep '# TEMPORARY FOR XCODEINSTALL' > /dev/null; then
+        if [ -n "$SUDO_PASSWORD" ]; then
+          printf '%s\n' "$SUDO_PASSWORD" | sudo -p "" -S echo "$(whoami) ALL=(ALL:ALL) NOPASSWD: ALL # TEMPORARY FOR XCODEINSTALL" | sudo tee -a /etc/sudoers
+        else
+          echo "$(whoami) ALL=(ALL:ALL) NOPASSWD: ALL # TEMPORARY FOR XCODEINSTALL" | sudo tee -a /etc/sudoers
+        fi
+      fi
+      ### Remove old files
+      rm -rf ~/.xcodeinstall
+      ### Authenticate
+      xcodeinstall authenticate -s "$AWS_DEFAULT_REGION"
+      ### Download files
+      while read XCODE_DOWNLOAD_ITEM; do
+        if [[ "$XCODE_DOWNLOAD_ITEM" != *"Command Line Tools"* ]]; then
+          DOWNLOAD_ID="$(echo "$XCODE_DOWNLOAD_ITEM" | sed 's/^\[\(.*\)\] .*/\1/')"
+          echo "$DOWNLOAD_ID" | xcodeinstall download -s "$AWS_DEFAULT_REGION" &
+        fi
+      done < <(xcodeinstall list -s "$AWS_DEFAULT_REGION" | grep --invert-match 'Release Candidate' | grep --invert-match ' beta ' | grep ' Xcode \d\d ')
+      wait
+      ### Install Xcode
+      xcodeinstall install --name "$(basename "$(find ~/.xcodeinstall/download -maxdepth 1 -name "*.xip")")"
+      ### Install Command Line Tools
+      # Commentted out because it is already installed by xcode-select in the provision.sh script
+      # xcodeinstall install --name "$(basename "$(find ~/.xcodeinstall/download -maxdepth 1 -name "*Command Line Tools*")")"
+      ### Install Additional Tools
+      while read ADDITIONAL_TOOLS; do
+        hdiutil attach "$ADDITIONAL_TOOLS"
+        rm -rf "/Applications/Additional Tools"
+        cp -rf "/Volumes/Additional Tools" "/Applications/Additional Tools"
+        hdiutil detach "$(find /Volumes -name "Additional Tools")"
+      done < <(find ~/.xcodeinstall/download -name "Additional Tools*")
+      ### Install Font Tools
+      while read FONT_TOOLS; do
+        hdiutil attach "$FONT_TOOLS"
+        cd "$(find /Volumes -maxdepth 1 -name "*Font Tools*")"
+        sudo installer -pkg "$(find . -maxdepth 1 -name "*Font Tools*.pkg")" -target /
+        cd / && hdiutil detach "$(find /Volumes -maxdepth 1 -name "*Font Tools*")"
+      done < <(find ~/.xcodeinstall/download -name "Font Tools*")
+      ### Remove cache / downloaded files
+      rm -rf ~/.xcodeinstall
+      ### Remove passwordless sudo
+      if ! command -v gsed > /dev/null; then
+        brew install gnu-sed
+      fi
+      sudo gsed -i '/# TEMPORARY FOR XCODEINSTALL/d' /etc/sudoers
   xurls:
     _bin: xurls
     _desc: Extract urls from text
@@ -10625,6 +10725,11 @@ softwarePackages:
     brew: yamllint
     pipx: yamllint
     _service: null
+  xcodeinstall:
+    _bin: xcodeinstall
+    _name: Xcode Install
+    _github: https://github.com/sebsto/xcodeinstall
+    brew: sebsto/macos/xcodeinstall
   sshfs:
     _bin: sshfs
     _desc: null