Understanding Casks and the quarantine attribute

[csparker247]

I've been setting up a new cask in a custom tap. It's been working pretty well (thanks to all the Homebrew maintainers who make this magic happen), but I can't seem to figure out how to setup my packages so they can install without the --no-quarantine flag. Whenever I try to launch any apps, even command line ones, the system kills the process. For the GUI, I get the fun "App" is damaged and can't be opened dialog. With the --no-quarantine flag, everything works just fine.

Basically, I'm just trying to better understand the quarantine attribute, when it gets applied, and how any cask gets installed without this flag.

A few points which I think might be relevant:

• The packages are GitHub release artifacts uploaded on GitLab and GitHub CI/CD using the gh CLI. Does the package host make a difference? What about the package format?
• I'm currently not doing any code signing. We don't have an Apple Developer account, everything is being built through CMake, and I've not yet figured out how ad hoc/self-signing works in a CD environment.

[SMillerDev]

I'm currently not doing any code signing. We don't have an Apple Developer account, everything is being built through CMake, and I've not yet figured out how ad hoc/self-signing works in a CD environment.

That's your problem. https://eclecticlight.co/2017/08/15/quarantined-more-about-the-quarantine-extended-attribute/ explains the role of the quarantine attribute.

[csparker247]

Excellent. This is very clear. Thank you!

[csparker247]

Yes, this has been very helpful and I'm now successfully avoiding the "damaged" app issue and getting more normal Gatekeeper prompts.

A quick question for clarification: I've generally see the advice that you don't have to worry about code signing command line applications. But from what I'm experiencing, these also need to be signed before redistribution. This intuitively makes sense to me -- there's not much security difference between an app bundle and a random executable binary -- but I wanted to make sure that I'm not misunderstanding something. Specifically, it seems pretty annoying to have Gatekeeper pop-ups when running a command line application.

[SMillerDev]

That might have been the case on Intel, but on arm everything needs a signature

[csparker247]

That's probably the issue. It's been quite fun trying to find up-to-date information that doesn't involve "Step 1: Load your Xcode project...".

Thanks again!