On macOS, an app downloaded through a web browser is blocked on first launch, but the identical file fetched with curl opens immediately. What mechanism explains the difference?

## Quarantine is metadata, not a scan The first thing to understand is that macOS is not inspecting the bytes of the file to decide it is "from the internet". It is reading a label that the downloading application chose to attach. That label is an extended attribute named `com.apple.quarantine`, and applications opt into setting it — historically via the `LSFileQuarantineEnabled` key in their Info.plist, and automatically for sandboxed apps. ```sh $ xattr -l ~/Downloads/Example.app com.apple.quarantine: 0083;65f0a1b2;Safari;... $ xattr -l /tmp/example-from-curl.app # nothing — no attribute at all ``` That is the whole difference. Safari, Chrome, Mail and Messages set it. `curl`, `wget`, `scp`, `git clone` and a tarball extracted with `tar` do not. It is a provenance hint, deliberately cheap, and it is why "download it with curl instead" is a well-known workaround — and equally why it is a bad security habit. ## What Gatekeeper does when it sees the flag Gatekeeper is the policy engine that runs on **first launch of a quarantined executable**. Its assessment asks: 1. **Is the code signed at all, and is the signature intact?** A signature covers every byte of the bundle. If someone edited a file inside the app after signing, the seal is broken. That is what the confusing "the application is damaged and can't be opened" dialog usually means — not disk corruption, but a broken or missing signature. 2. **Who signed it?** A Developer ID certificate issued by Apple to an identified developer, an App Store signature, or nothing recognisable. 3. **Is it notarized?** Notarization is a separate step in which the developer uploads the signed build to Apple's notary service, Apple runs an automated malware scan, and returns a ticket. The developer normally *staples* that ticket into the bundle with `xcrun stapler staple`; if it is not stapled, macOS looks it up online. Only if all of that passes does the app launch quietly. Otherwise the user gets a blocking dialog. Once the user approves an app, the decision is remembered and the quarantine flag is cleared, which is why the prompt appears exactly once. ## Signing, notarization and the App Store are three different things Candidates routinely merge these: - **Code signing** proves integrity and identity. It says "this is the bundle developer X produced, unmodified". Anyone with a Developer ID certificate can sign, and signing happens on the developer's machine. - **Notarization** is Apple's automated check of an already-signed build. It is not review, no human looks at it, and it does not judge quality — it scans for malware and for signing and hardening mistakes. It requires the Hardened Runtime. - **App Store review** is a human process with its own rules, and distributes through a different channel entirely. An app distributed outside the App Store on modern macOS needs the first two. ## App Translocation, the surprising side effect When a quarantined app is launched from a location like `~/Downloads`, macOS may run it from a randomised, read-only path rather than where it sits — a feature usually called App Translocation or Gatekeeper path randomisation, added in macOS 10.12. It exists to stop an attacker shipping a legitimate app in a disk image next to a malicious library it will load relatively. The visible symptom is an app that cannot find files it expects beside itself, or that appears not to save its settings, until the user drags it to `/Applications` — which clears quarantine and stops the translocation. ## Clearing quarantine, and why not to make it a habit ```sh $ spctl --assess --verbose=4 /Applications/Example.app /Applications/Example.app: rejected source=Unnotarized Developer ID $ xattr -d com.apple.quarantine /Applications/Example.app ``` Removing the attribute makes the file look local and Gatekeeper stops assessing it. That is a reasonable move for a binary you built yourself or one whose provenance you verified another way. Doing it reflexively for anything downloaded discards the one check that stands between the user and a trojaned installer. The user-facing approval path has tightened over releases: the old "Control-click, Open" shortcut was the standard way to run an unnotarized app, and in macOS 15 Sequoia that route was removed in favour of an explicit approval in System Settings under Privacy & Security. Expect the exact clicks to keep moving; the underlying quarantine-plus-assessment model has been stable for years.