Gatekeeper and binaries rejected by spctl

Question

Created May ’23

Replies 2

Boosts 0

Views 1k

Participants 3

I noticed jq (installed from Homebrew) has an ad hoc signature and is rejected by spctl but runs fine. I don't remember ever being prompted by my Mac as to whether this binary should be allowed to run.

I repeated the experiment with another binary (aescrypt) downloaded from Homebrew.

Should Gatekeeper prevent these binaries from executing until I intervene?

Is there any online documentation explaining the conditions that allow some binaries that are rejected by spctl and have no signature chain rooted at Apple to execute?

(Or am I just not understanding how to use Gatekeeper and spctl?)

codesign analysis:

% codesign -vvd &#x2F;opt&#x2F;homebrew&#x2F;bin&#x2F;aescrypt
Executable=&#x2F;opt&#x2F;homebrew&#x2F;Cellar&#x2F;aescrypt&#x2F;0.7&#x2F;bin&#x2F;aescrypt
Identifier=aescrypt
Format=Mach-O thin (arm64)
CodeDirectory v=20400 size=545 flags=0x20002(adhoc,linker-signed) hashes=14+0 location=embedded
Signature=adhoc
Info.plist=not bound
TeamIdentifier=not set
Sealed Resources=none
Internal requirements=none

And checking spctl analysis:

% spctl --assess -vvv &#x2F;opt&#x2F;homebrew&#x2F;bin&#x2F;aescrypt
&#x2F;opt&#x2F;homebrew&#x2F;bin&#x2F;aescrypt: rejected

Answered by galad87 in 752427022

The alert is shown only if there is a quarantine flag set on the app/executable. Homebrew doesn't add such flag.

Boost

Answer 1

galad87 OP

May ’23

Accepted Answer

The alert is shown only if there is a quarantine flag set on the app/executable. Homebrew doesn't add such flag.

2

Answer 2

DTS Engineer OP

Apple

May ’23

galad87’s answer is essentially correct.

Gatekeeper has to walk a delicate line between protecting folks from malware and keeping the Mac a Mac (and so allowing things like Homebrew). Right now Gatekeeper’s primary focus is on quarantined programs, although there are some situations where it runs even if the code is quarantined. The exact details have changed in the past and I fully expect them to continue evolving over time.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

1