21

I have a little open-source Qt app I wrote and then compiled on my Mac. I ran macdeployqt and copied it to my /Applications folder, and it runs without complaint.

Ultimately I plan to sign this app with an Apple developer certificate and upload it to GitHub as a binary release. But my question is: why am I able to run this app locally from /Applications without macOS complaining, even though I haven't yet signed it? Is this because of some special attribute or permission that's been set on the app's binary by the system's compiler? If so, how can I view this attribute for myself?

5
  • Do you have Apple developer account which has been added to Xcode -> Preferences -> Account? Sep 5 at 8:33
  • Nope. And also: % codesign -dv --verbose=4 /Applications/towerofhanoi.app /Applications/towerofhanoi.app: code object is not signed at all
    – mshroyer
    Sep 5 at 9:11
  • What's your setting of System Preferences -> Security & Privacy -> General -> Allow apps downloaded from ? Sep 5 at 9:25
  • Allow apps downloaded from: "App Store and identified developers"
    – mshroyer
    Sep 5 at 9:26
  • 3
    I have checked Xcode and in Signing & Capabilities Signing Certificate dropdown list by has an option "Sign to Run Locally". Is this option set in your app ? Sep 5 at 9:33
27

com.apple.quarantine

The locally built application does not have the quarantine attribute set. Without this extended file attribute, the application bypasses macOS's Gatekeeper and verification steps.

The quarantine attribute is set when the application is downloaded or copied onto the computer.

Try uploading a compressed copy of your application onto a web server, then downloading the file. After downloading and expanding the application, macOS will now apply Gatekeeper and verify the contents.

See How to set (restore) the com.apple.quarantine attribute?

2
  • 5
    No need to upload the binary to anywhere else. I often test whether signing was successful by just creating an ad-hoc HTTP file server in the binary's directory, e.g. using Python: python3 -m http.server. Now just download the file from localhost:8000. Sep 6 at 12:50
  • 3
    (Of course you could instead also just set the quarantine extended attribute on the file, but where would be the fun?) Sep 6 at 12:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .