Mactoy v0.8.0: Safer writes

This release is about trust in what Mactoy writes: images are checked before and after flashing, you can cancel, and Mactoy is stricter about writing only to the drive you confirmed. It's the first of two releases on the way to 1.0.

Flash Image checks the image and the drive

• Check the image first. Paste the SHA-256 from the image's download page, or click Load from File… and pick its .sha256 or SHA256SUMS file. Mactoy checks the image against it before erasing the drive. For a compressed download, use the checksum of the file you downloaded.
• Check the drive after. With Check the drive after writing on (the default), Mactoy reads the drive back and compares it with the image. This adds some time, and can catch a failing drive or one that's smaller than it claims.
• Compressed images are decompressed while writing. .img.xz and .img.gz files no longer have to fit in memory: a 1.5 GB image flashes with under 100 MB of memory. A file Mactoy can't read is caught before anything is written, and an image too big for the drive is refused up front when its size is known (raw and .xz files).

Cancel

• Install and Update can be cancelled until Mactoy starts writing the drive, and nothing is written. After that, Cancel is refused: stopping between Ventoy's partition writes would leave a drive that neither starts nor mounts.
• Flash Image can be stopped at any point. Mactoy asks first, since the drive is left partly written if writing has begun.
• A cancel during the Ventoy download takes effect when the download finishes.

Writing only to the drive you confirmed

• The check that it's still the same drive now includes the drive's serial number, so a different drive of the same model and size is caught. (It's compared when both drives report one; some cheap USB adapters and card readers don't.)
• A fresh install checks the drive once more right before formatting it, after the wait for macOS to see the new partitions.
• The app opens the image to flash with your own permissions and hands it to the helper. Before, the helper read it as root, so on a Mac with several accounts a user could flash a file they can't read.
• If the connection to the helper breaks partway through, Mactoy stops and offers Retry instead of starting the run again by itself.
• Fixed: Mactoy never recognised a drive as external, because it read a diskutil key that doesn't exist. Writes were still allowed through the removable and ejectable flags USB drives set, and the Mac's own disk was still refused, but one of the two checks never worked. It does now.

Fewer files left behind

• Downloads no longer leave a web cache or an HTTPStorages folder in your Library (old ones are deleted).
• The helper deletes its Ventoy downloads before it's removed after an install. If you keep the helper, Mactoy > Clear Ventoy Downloads clears them.

Install

• Homebrew (new): brew install --cask mactoy, or brew upgrade --cask mactoy if you have it. Homebrew picks up new releases shortly after they're published.
• DMG: download Mactoy-0.8.0.dmg below and drag Mactoy to Applications, replacing the old copy.

The helper changed in this release. If macOS asks you to approve it again, that's why.

How this was tested

No physical USB drive was needed. Every point where Mactoy meets the hardware is tested without one:

• 717 automated tests, now run on every pull request.
• What macOS reports about each kind of drive (USB sticks, USB and Thunderbolt SSDs, SD cards, the Mac's own SSD, disk images), and where each one's serial number comes from. This found the external-drive bug above.
• The app and the helper over real XPC: the image handed over as an open file, Cancel, Clear Ventoy Downloads, errors and a lost connection; and the real drivers through that same path onto a disk image.
• The real Ventoy and flash code on disk images (scripts/e2e): Ventoy installs with MBR and GPT; raw, .xz and .gz images written byte for byte and read back; wrong checksums, damaged files, too-big images and device paths refused; Cancel pressed at many points, with the drive left as the message says.
• Booted in QEMU: fresh installs start to the Ventoy menu under UEFI and BIOS, and so does a Ventoy drive flashed from an .img.xz.
• Every new screen state rendered and checked.
• Every change had two rounds of independent code review.

Not yet covered: the helper running as root under launchd. That release check is planned for 1.0 (#19).

If anything looks wrong, please open an issue.

SHA256 of Mactoy-0.8.0.dmg is published below the release assets.