fix atomic binary install to prevent macOS code signature cache rejection

Author: Tanq16

internal/installer/archive.go

@@ -40,3 +40,30 @@ func FindBinary(dir, pattern string) (string, error) {
 	}
 	return "", fmt.Errorf("binary not found matching pattern %s in %s", pattern, dir)
 }
+
+func AtomicInstallBinary(srcPath, destPath string) error {
+	data, err := os.ReadFile(srcPath)
+	if err != nil {
+		return err
+	}
+	dir := filepath.Dir(destPath)
+	tmp, err := os.CreateTemp(dir, ".cps-tmp-*")
+	if err != nil {
+		return err
+	}
+	tmpPath := tmp.Name()
+	if _, err := tmp.Write(data); err != nil {
+		tmp.Close()
+		os.Remove(tmpPath)
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		os.Remove(tmpPath)
+		return err
+	}
+	if err := os.Chmod(tmpPath, 0755); err != nil {
+		os.Remove(tmpPath)
+		return err
+	}
+	return os.Rename(tmpPath, destPath)
+}

internal/installer/direct_download.go

@@ -71,17 +71,27 @@ func (d *DirectDownloadInstaller) Install(tool *registry.Tool, p platform.Platfo
 	}
 
 	destPath := filepath.Join(destDir, tool.BinaryName)
-	f, err := os.Create(destPath)
+	tmp, err := os.CreateTemp(destDir, ".cps-tmp-*")
 	if err != nil {
 		return Result{Tool: tool.Name, Err: err}
 	}
-	defer f.Close()
+	tmpPath := tmp.Name()
 
-	if _, err := io.Copy(f, resp.Body); err != nil {
+	if _, err := io.Copy(tmp, resp.Body); err != nil {
+		tmp.Close()
+		os.Remove(tmpPath)
 		return Result{Tool: tool.Name, Err: err}
 	}
-
-	if err := os.Chmod(destPath, 0755); err != nil {
+	if err := tmp.Close(); err != nil {
+		os.Remove(tmpPath)
+		return Result{Tool: tool.Name, Err: err}
+	}
+	if err := os.Chmod(tmpPath, 0755); err != nil {
+		os.Remove(tmpPath)
+		return Result{Tool: tool.Name, Err: err}
+	}
+	if err := os.Rename(tmpPath, destPath); err != nil {
+		os.Remove(tmpPath)
 		return Result{Tool: tool.Name, Err: err}
 	}
 
@@ -157,11 +167,7 @@ func (d *DirectDownloadInstaller) installArchive(tool *registry.Tool, url, versi
 	}
 
 	destPath := filepath.Join(destDir, tool.BinaryName)
-	data, err := os.ReadFile(binaryPath)
-	if err != nil {
-		return Result{Tool: tool.Name, Err: err}
-	}
-	if err := os.WriteFile(destPath, data, 0755); err != nil {
+	if err := AtomicInstallBinary(binaryPath, destPath); err != nil {
 		return Result{Tool: tool.Name, Err: err}
 	}
 

internal/installer/github_release.go

@@ -107,11 +107,7 @@ func (g *GitHubReleaseInstaller) Install(tool *registry.Tool, p platform.Platfor
 	}
 
 	destPath := filepath.Join(destDir, tool.BinaryName)
-	data, err := os.ReadFile(binaryPath)
-	if err != nil {
-		return Result{Tool: tool.Name, Err: err}
-	}
-	if err := os.WriteFile(destPath, data, 0755); err != nil {
+	if err := AtomicInstallBinary(binaryPath, destPath); err != nil {
 		return Result{Tool: tool.Name, Err: err}
 	}