21

I have a little open-source Qt app I wrote and then compiled on my Mac. I ran macdeployqt and copied it to my /Applications folder, and it runs without complaint.

Ultimately I plan to sign this app with an Apple developer certificate and upload it to GitHub as a binary release. But my question is: why am I able to run this app locally from /Applications without macOS complaining, even though I haven't yet signed it? Is this because of some special attribute or permission that's been set on the app's binary by the system's compiler? If so, how can I view this attribute for myself?

Improve this question
5
  • Do you have Apple developer account which has been added to Xcode -> Preferences -> Account?
    – Blazej SLEBODA
    Sep 5, 2021 at 8:33
  • Nope. And also: % codesign -dv --verbose=4 /Applications/towerofhanoi.app /Applications/towerofhanoi.app: code object is not signed at all
    – mshroyer
    Sep 5, 2021 at 9:11
  • What's your setting of System Preferences -> Security & Privacy -> General -> Allow apps downloaded from ?
    – Blazej SLEBODA
    Sep 5, 2021 at 9:25
  • Allow apps downloaded from: "App Store and identified developers"
    – mshroyer
    Sep 5, 2021 at 9:26
  • 3
    I have checked Xcode and in Signing & Capabilities Signing Certificate dropdown list by has an option "Sign to Run Locally". Is this option set in your app ?
    – Blazej SLEBODA
    Sep 5, 2021 at 9:33

1 Answer 1

Reset to default
27

com.apple.quarantine

The locally built application does not have the quarantine attribute set. Without this extended file attribute, the application bypasses macOS's Gatekeeper and verification steps.

The quarantine attribute is set when the application is downloaded or copied onto the computer.

Try uploading a compressed copy of your application onto a web server, then downloading the file. After downloading and expanding the application, macOS will now apply Gatekeeper and verify the contents.

See How to set (restore) the com.apple.quarantine attribute?

Improve this answer
2
  • 5
    No need to upload the binary to anywhere else. I often test whether signing was successful by just creating an ad-hoc HTTP file server in the binary's directory, e.g. using Python: python3 -m http.server. Now just download the file from localhost:8000.
    – Konrad Rudolph
    Sep 6, 2021 at 12:50
  • 3
    (Of course you could instead also just set the quarantine extended attribute on the file, but where would be the fun?)
    – Konrad Rudolph
    Sep 6, 2021 at 12:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .