feat(darwin): harden brew installations

flake.nix

@@ -82,7 +82,7 @@
         };
       };
       darwinConfigurations = {
-        "sashimi-slicer" = darwin.lib.darwinSystem rec {
+        "sashimi" = darwin.lib.darwinSystem rec {
           system = "aarch64-darwin";
 
           modules = [

machines/sashimi/darwin.nix

@@ -23,23 +23,23 @@
 
   homebrew = {
     enable = true;
-    caskArgs.no_quarantine = true;
+    caskArgs = {
-    onActivation = {
+      require_sha = true;
-      autoUpdate = true;
-      cleanup = "zap";
     };
-    casks = [
+    onActivation.autoUpdate = true;
+    casks = let
+      skipSha = name: {
+        inherit name;
+        args = {require_sha = false;};
+      };
+    in [
       "1password"
-      "affinity-designer"
-      "affinity-photo"
-      "affinity-publisher"
       "alfred"
       "bitwarden"
       "blender"
       "discord"
       "docker"
       "easy-move-plus-resize"
-      "eloston-chromium"
       "firefox"
       "imageoptim"
       "insomnia"
@@ -54,11 +54,22 @@
       "postman"
       "qt-creator"
       "rustdesk"
-      "sizzy"
       "uninstallpkg"
       "utm"
       "yubico-yubikey-manager"
 
+      # casks without shasums
+      (skipSha "affinity-designer")
+      (skipSha "affinity-photo")
+      (skipSha "affinity-publisher")
+      (skipSha "sizzy")
+
+      # community builds needing to skip quarantine
+      {
+        name = "eloston-chromium";
+        args = {no_quarantine = true;};
+      }
+
       # drivers
       "elgato-wave-link"
       "uhk-agent"