Why Cupola installs from a disk image, not Terminal

Some Mac apps install by having you paste a line into Terminal that downloads a script and runs it straight away. Cupola offered that early on. It doesn't any more: you download Cupola.dmg, open it, and drag Cupola to Applications. Here's why.

What a one-line Terminal install asks of you

A command that fetches a script and hands it straight to the shell does two things in one breath: it downloads code and runs it, with no pause in between where you might look at what you're running. You're trusting the server that sends it, the network in between, and the script itself to check what it downloads before it touches your Mac.

A careful script can do all of that properly. Cupola's did: it checked the download's checksum and the app's code signature before copying anything into Applications. But it was still a script doing by hand what macOS already does itself, and you had to take its word for it.

Why we stopped offering it

Pasting a command into Terminal has also become one of the most common ways Mac malware spreads. Fake download pages, fake "fix this error" prompts and look-alike ads tell people to paste a line into Terminal, and that line installs something nasty.

The habit worth having is simple: don't paste a command from a website into Terminal unless you know exactly what it does. Cupola won't ask you to. If a page that claims to be Cupola's ever does, it isn't us.

What the disk image does instead

Cupola is signed with an Apple Developer ID certificate and notarized by Apple, Apple's automated check of apps for known malicious content before they can be distributed outside the App Store. The first time you open it, Gatekeeper verifies that signature and the notarization ticket, automatically, before Cupola runs at all. That's the check the old script did for itself, now done by macOS, every time.

After that, Cupola keeps itself up to date. Updates are signed too, and the app checks them before it installs them.

If you followed an old link to Cupola's Terminal installer, it now does nothing but point you here: it installs nothing and changes nothing on your Mac. Get Cupola from trycupola.com/app/Cupola.dmg instead.

Why Cupola isn't on the App Store

If Cupola is signed and notarized, why not use the App Store? Cupola reads and writes real checklists and tables in Apple Notes and talks to Reminders in ways the App Store's sandbox doesn't allow. That's a sandbox limitation, not a choice to avoid review; see the FAQ on trycupola.com for the exact wording. A signed, notarized disk image plus signed updates is the trade-off.

The bottom line

Download Cupola from trycupola.com, open the disk image, drag Cupola to Applications. macOS does the verifying, and there's nothing to paste anywhere. If you'd like the full walkthrough, start at installing Cupola, or check troubleshooting if something didn't go as expected.

Sources

Give your notch something to do.

Try Cupola free for 7 days, then pay once ($20) to keep it.