Best way for an tap maintainer inside the firewall to accept quaratine disablement risks in multi-OS casks

[colindean]

Output of brew config

$ brew config
HOMEBREW_VERSION: 5.1.13-45-g9dc6e22
ORIGIN: https://github.com/Homebrew/brew
HEAD: 9dc6e22cbbdc68d907735a725eb713336973b177
Last commit: 5 hours ago
Branch: main
Core tap HEAD: dc7616766b7ec574749f7592934bf10b14433bec
Core tap last commit: 2 hours ago
Core cask tap: N/A
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_API_DOMAIN: https://artifactory.mycompany.com/artifactory/homebrew-formulae-api/
HOMEBREW_ARTIFACT_DOMAIN: https://artifactory.mycompany.com/artifactory/homebrew/
HOMEBREW_ARTIFACT_DOMAIN_NO_FALLBACK: set
HOMEBREW_BAT_THEME: DarkNeon
HOMEBREW_CASK_OPTS: []
HOMEBREW_DOCKER_REGISTRY_BASIC_AUTH_TOKEN: set
HOMEBREW_DOWNLOAD_CONCURRENCY: 28
HOMEBREW_EDITOR: vim
HOMEBREW_FORBID_PACKAGES_FROM_PATHS: set
HOMEBREW_GITHUB_API_TOKEN: set
HOMEBREW_MAKE_JOBS: 14
HOMEBREW_SORBET_RUNTIME: set
HOMEBREW_USE_INTERNAL_API: set
HOMEBREW_VERIFY_ATTESTATIONS: set
Homebrew Ruby: 4.0.5 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/4.0.5/bin/ruby
CPU: 14-core 64-bit arm_brava
Clang: 21.0.0 build 2100
Git: 2.53.0 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 26.5-arm64
CLT: 26.5.0.0.1777544298
Xcode: N/A
Rosetta 2: false

Output of brew doctor

$ brew doctor
Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some installed casks are deprecated or disabled.
You should find replacements for the following casks:
  fx-cast-bridge
  qlcolorcode
  qlprettypatch
  qlstephen

Warning: Some installed formulae are deprecated or disabled.
You should find replacements for the following formulae:
  bsdmake
  qt@5

Warning: Unbrewed dylibs were found in /usr/local/lib.
If you didn't put them there on purpose they could cause problems when
building Homebrew formulae and may need to be deleted.

Unexpected dylibs:
  /usr/local/lib/libMsgCom.dylib
  /usr/local/lib/libSysCtlCom.dylib
  /usr/local/lib/libwep_airdrop.dylib
  /usr/local/lib/libwep_burn.dylib
  /usr/local/lib/libwep_cbcarbon.dylib
  /usr/local/lib/libwep_cbcocoa.dylib
  /usr/local/lib/libwep_chrome.dylib
  /usr/local/lib/libwep_dutil.dylib
  /usr/local/lib/libwep_ff.dylib
  /usr/local/lib/libwep_icloud.dylib
  /usr/local/lib/libwep_mail.dylib
  /usr/local/lib/libwep_post.dylib
  /usr/local/lib/libwep_pref.dylib
  /usr/local/lib/libwep_printer.dylib
  /usr/local/lib/libwep_proxy.dylib
  /usr/local/lib/libwep_screen.dylib

Warning: Found Ruby file outside tgt/brewhouse tap formula directory.
(/opt/homebrew/Library/Taps/mycompany/homebrew-brewhouse/Formula):
  /opt/homebrew/Library/Taps/mycompany/homebrew-brewhouse/ghe_download_strategy.rb

Found Ruby file outside go-vela/vela tap formula directory.
(/opt/homebrew/Library/Taps/go-vela/homebrew-vela/Formula):
  /opt/homebrew/Library/Taps/go-vela/homebrew-vela/template.rb

Warning: You have unlinked kegs in your Cellar.
Leaving kegs unlinked can lead to build-trouble and cause formulae that depend on
those kegs to fail to run properly once built. Run `brew link` on these:
  openssl@3

Warning: Some taps are not on the default git origin branch and may not receive
updates. If this is a surprise to you, check out the default branch with:
  git -C $(brew --repo mycompany/brew-house) checkout main

Description of issue

I'm in the process of auditing formulae and casks in my company's internal tap. One of things things I want to do, if possible, is move away from binary formulae to using casks for everything that is pre-built (which is about half of the binary formulae).

However, as I complete the first such migration and it passes audit, I run it and… it's quarantined.

There's no chance that I'll be able to convince these dozens of teams to sign their binaries for internal software.

Reading Removing support for --no-quarantine for casks #20755, I think there's no way in the cask DSL to somehow allow unsigned binaries to run with the --no-quaratine and associated options gone.

I think the only option is to run a postflight, right?

  binary "argusctl"

  on_macos do
    postflight do
      system_command "/usr/bin/xattr",
        args: ["-d", "com.apple.quarantine", "#{staged_path}/argusctl"],
        sudo: false,
        must_succeed: false,
        print_stderr: false
    end
  end

This works in my testing, and I as the internal tap maintainer can suffice with this security mechanism disabled, because it was already off anyway when this cask was a formula.

Or am I silly in wanting to move these to casks? These formulae are largely pre-compiled for ARM64 macOS and x86_64 Linux, so they've got on_macos and on_linux that is very simplified in the cask DSL.

[p-linnane]

If you're willing to accept the risk, then removing quarantine via postflight is your best path forward here.

[colindean]

Thank you!