docs: install with curl, which carries no quarantine flag - #32
Merged
Conversation
A browser download plus a double-click is a hard stop, not a warning: macOS refuses to open an un-notarised binary at all. The fix was in the README, but underneath the step that gets you blocked. Chrome sets com.apple.quarantine and it survives extraction onto the binary; curl sets nothing. Lead with curl, keep the browser route with the xattr line and the reason it is there. Same for the release notes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GvMacYD6T9EoWqc7C247Hr
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Downloading the tarball in a browser and double-clicking the binary gets you a hard stop, not a warning: "Apple could not verify termit is free of malware", with Move to Trash as the default button. The build is not notarised, so that is expected — but the README buried the fix under the download step, where you read it after being blocked.
The quarantine flag is set by whatever fetches the file. Chrome sets it (verified on a real download:
com.apple.quarantine: 0281;…;Chrome;…, and it survives extraction onto the binary).curlsets nothing (verified: a freshcurl … | tar xzleaves onlycom.apple.provenance, and the binary runs).So the install section now leads with curl, which just works, and keeps the browser route with the
xattrline and an explanation of why it is needed. The release-notes template says the same.Untouched: the only way to make a browser download plus a Finder double-click work with no command at all is Developer ID signing plus notarisation, which needs an Apple Developer account.
🤖 Generated with Claude Code
https://claude.ai/code/session_01GvMacYD6T9EoWqc7C247Hr