Your desk is ready.
A complete vintage Macintosh-inspired Omarchy plugin and theme package, delivered as an immutable, digest-verified release.
Verified install
bash <<'ONE_BIT_BUREAU_INSTALL'
set -Eeuo pipefail
release_tag="v1.2.4"
release_asset="one-bit-bureau-${release_tag}.tar.gz"
release_dir=$(mktemp -d)
trap 'rm -rf -- "$release_dir"' EXIT
curl --proto '=https' --proto-redir '=https' --tlsv1.2 --fail --location --silent --show-error --retry 3 --max-time 30 --max-filesize 1048576 \
-H 'Accept: application/vnd.github+json' \
-H 'X-GitHub-Api-Version: 2026-03-10' \
"https://api.github.com/repos/RegionallyFamous/one-bit-bureau/releases/tags/$release_tag" \
--output "$release_dir/release.json"
jq -e --arg tag "$release_tag" '.immutable == true and .tag_name == $tag' "$release_dir/release.json" >/dev/null
release_url=$(jq -er --arg name "$release_asset" '.assets[] | select(.name == $name) | .browser_download_url' "$release_dir/release.json")
release_sha256=$(jq -er --arg name "$release_asset" '.assets[] | select(.name == $name) | .digest | select(startswith("sha256:")) | ltrimstr("sha256:")' "$release_dir/release.json")
[[ $release_sha256 =~ ^[a-f0-9]{64}$ ]]
curl --proto '=https' --proto-redir '=https' --tlsv1.2 --fail --location --silent --show-error --retry 3 --max-time 300 --max-filesize 268435456 \
"$release_url" --output "$release_dir/$release_asset"
actual_sha256=$(sha256sum "$release_dir/$release_asset" | awk '{print $1}')
[[ $actual_sha256 == "$release_sha256" ]]
mkdir "$release_dir/payload"
tar --no-same-owner --no-same-permissions -xzf "$release_dir/$release_asset" -C "$release_dir/payload"
bash "$release_dir/payload/one-bit-bureau-$release_tag/install"
ONE_BIT_BUREAU_INSTALL
This downloads the GitHub release record and archive first, requires an immutable release, checks GitHub’s published SHA-256 digest, and only then runs the local installer. Nothing downloaded is piped directly into a shell.