Few weeks ago I've installed a CLI application from Homebrew that wasn't signed or notarised (what's Apple calls from an "unidentified developer").

To run this application I've followed the well know steps from Apple and called it a day.

Now I want to revoke this exception to be able to test the new version of the same CLI application that will come signed and notarised by the developer.

I've tried to follow the instruction from posts that suggest the change Gatekeeper rules using spctl like this question without success.

It looks like the rules managed using spctl are not involved in this context, because I've tried to do:

$ spctl --reset-default

$ spctl --list > list.before.txt

and then I've authorised the app to run using System Preferences > Security & Privacy > 'Allow'

$ spctl --list > list.after.txt

and after run a compare between the two:

$ diff list.before.txt list.after.txt
(no differences)

The CLI app continue to run no matter what I do with the spctl utility.

How can I revert the permission to run to this unidentified developer's CLI app? 😭

  • May I know the name of CLI application? I can try to help you with this ?
    – Udhy
    Commented Dec 3, 2019 at 10:49
  • Yep, I've testing formulae.brew.sh/formula/arduino-cli, currently not signed or notarised.
    – zmoog
    Commented Dec 3, 2019 at 17:08
  • But I'm having the same issue with other CLI apps as well, such as jtool from Homebrew (via cask). I'd love to know how the OS saves these exceptions and how to revert this choice later and be able to test the code-signed and notarised version of the same application later from a clean state. So thank you @Udhy for your interest, if you have any experience to share on this, please share it here! :-D
    – zmoog
    Commented Dec 3, 2019 at 17:17

1 Answer 1


The permission is actually persisted by removing a specific attribute from the file's metadata.

You mentioned in comments that you were having this problem with jtool from Homebrew Cask. When you install that program, you'll see the attributes listed by running:

xattr -l /usr/local/bin/jtool 

It will display something like this:

com.apple.quarantine: 0291;5df6a9fa;Homebrew\x20Cask;1E71AF5A-2719-340C-9A49-DDB4D10769BE

You can remove that attribute with the following command:

xattr -d com.apple.quarantine /usr/local/bin/jtool

Now you won't get the prompt.

Add the attribute again to restore the prompt:

xattr -w com.apple.quarantine "0291;5df6a9fa;Homebrew\x20Cask;1E71AF5A-2719-340C-9A49-DDB4D10769BE" /usr/local/bin/jtool


  • @david-anderson Why add a dot to the end of the answer?
    – jksoegaard
    Commented Dec 4, 2019 at 2:07
  • When code is long enough, a scrollbar is added to the webpage. When I view this webpage, I see a scrollbar below xattr -w com.apple.quarantine "0291;5df6a9fa;Homebrew\x20Cask;1E71AF5A-2719-340C-9A49-DDB4D10769BE" /usr/local/bin/jtool. If I reload the webpage, then the scrollbar stops working. One way to fix this problem is to add text after the code entry. I used a dot. I changed this to a nonbreaking space which will not appear to the viewer. Commented Dec 4, 2019 at 3:25
  • Really odd! - I didn't see that here (using Safari), so I guess it must be a problem with some other browsers. Nice fix with the non-breaking space - makes it look much less weird :-)
    – jksoegaard
    Commented Dec 4, 2019 at 9:05
  • First, @jksoegaard thank you for writing your answer! Unfortunately this is not the same prompt I was looking to restore. The com.apple.quarantine it's an extended attribute added to downloaded files by applications that download some binaries/applications from the Internet. This is done by Apple own software (such as Safari web browser) and even 3rd party software (like the Transmission BitTorrent client github.com/transmission/transmission/blob/…).
    – zmoog
    Commented Dec 4, 2019 at 9:37
  • The situation I'm trying to recreate it's the one described on support.apple.com/en-us/HT202491 in the section named "If you see a warning message and can't install an app.". It's a perfectly legit message because from the system, the binary it's not signed or notarized, and I want back that situation to test the new signed binary (and of course, I also want to understand how the security mechanism is working for the sake of it ^^).
    – zmoog
    Commented Dec 4, 2019 at 9:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .