Skip to content

docs(first-steps): checksum verification and macOS first-run fixes - #3138

Open
granman3 wants to merge 1 commit into
prometheus:mainfrom
granman3:docs/macos-first-steps
Open

granman3 wants to merge 1 commit into
prometheus:mainfrom
granman3:docs/macos-first-steps

Conversation

@granman3

@granman3 granman3 commented Oct 14, 2026 •

Copy link
Copy Markdown

Part of #3137 (the "macOS binary path works for first-timers" section). Closes #1946.

@RichiH (per MAINTAINERS.md) and @lasomethingsomething (epic author)

What changed (docs/introduction/first_steps.md, "Downloading Prometheus")

  • Checksum validation (docs: Getting started guide could add mention of validating checksums #1946): compare the archive's SHA256 against the download page before extracting, using sha256sum (Linux), shasum -a 256 (macOS) or Get-FileHash (Windows PowerShell).
  • Wildcard fix: cd prometheus-* → cd prometheus-*/. With the tarball still next to the extracted directory (the normal case), the old command matches both and fails (cd: too many arguments in bash, cd: string not in pwd in zsh). The trailing slash matches only directories in both shells.
  • Where the download lands: browsers save to ~/Downloads, and no matches found means you're in the wrong directory.
  • Gatekeeper NOTE: a browser-downloaded darwin binary is quarantined (bsdtar carries the attribute to the extracted files) and isn't notarized, so macOS kills it on first run. The note gives both fixes: Allow Anyway in System Settings > Privacy & Security, or xattr -dr com.apple.quarantine ..

How I tested

macOS 27.0.1 (Apple Silicon), Prometheus v3.15.0 darwin-arm64:

  • shasum -a 256 and sha256sum hashes match sha256sums.txt.
  • cd prometheus-* fails in bash and zsh with the tarball present; cd prometheus-*/ works in both.
  • Browser-quarantined tarball: the extracted binary keeps com.apple.quarantine, spctl --assess rejects it (ad-hoc signature only), and running it gets SIGKILL. System Settings then shows "“prometheus” was blocked to protect your Mac" with an Allow Anyway button. After xattr -dr com.apple.quarantine . it runs normally. A curl download isn't quarantined and runs as-is.

I've only seen the System Settings wording on macOS 27, so older releases may label the button differently. Happy to adjust the wording or split this up.

🤖 Generated with Claude Code

- Explain how to verify the download's SHA256 checksum on Linux, macOS
  and Windows before extracting it (closes prometheus#1946).
- Use `cd prometheus-*/` so the wildcard only matches the extracted
  directory; `cd prometheus-*` fails in bash and zsh when the tarball is
  in the same directory.
- Note where browser downloads land and what `no matches found` means.
- Add a NOTE on the macOS Gatekeeper block for browser-downloaded
  binaries and the two ways to allow them.

Part of prometheus#3137.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: granman <45244251+granman3@users.noreply.github.com>
@granman3
granman3 force-pushed the docs/macos-first-steps branch from 72044b1 to 5670dd8 Compare October 14, 2026 01:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

docs: Getting started guide could add mention of validating checksums

1 participant