macos: Clearing the quarantine extended attribute from downloaded applications

Apple doc: 在 Mac 上安全地打开 App

When I’m packaging an application for deployment, I normally download the latest version from the vendor. If it’s a drag-and-drop install, where the application is a self-contained bundle, it will get the com.apple.quarantine extended attribute associated with it.

The quarantine attribute is added by the OS so that it can ask for user confirmation the first time the downloaded program is run. Gatekeeper in Lion and Mountain Lion also uses the com.apple.quarantine attribute to determine if an application should be checked (and blocked if needed.)

To avoid issues with both unwanted messages and Gatekeeper, I normally clear this attribute as part of my packaging. Here’s how to check to see if your application has the com.apple.quarantine attribute associated with it:

1. Open Terminal
2. Run the following command:

xattr /path/to/MyApp.app

If the com.apple.quarantine attribute is associated with the application, you should see the following output:

computername:Applications username$ xattr /path/to/MyApp.app
com.apple.quarantine
computername:Applications username$

Note: Other attributes may also be listed, with com.apple.FinderInfo being a common one.

To remove the quarantine attribute, you would then run the following command:

sudo xattr -r -d com.apple.quarantine /path/to/MyApp.app

That will recursively remove the com.apple.quarantine attribute from the application. The -r option will allow the quarantine attribute of all files inside the application to be selected, while the -d option causes the given attribute name (and associated value) to be removed.