v4.9.2 Quarantine of FileBot.app issue... anyone else?

Support for macOS users and the Mac App Store package
Post Reply
jprokos
Posts: 107
Joined: 09 Oct 2016, 02:01

v4.9.2 Quarantine of FileBot.app issue... anyone else?

Post by jprokos »

I am using the FileBot beta version downloaded via homebrew (not the MAS version) and I get a warning each time I run FileBot. Allowing the app to bypass Gatekeeper using Admin credentials doesn't change this because the FileBot.app has a quarantine flag set. I am unsure why. Anyone familiar with this?? I did find a few articles:

how-macos-overrides-app-behaviour-including-quarantine
quarantine-apps

In the past on macOS once you have approved an app that is from an "unidentified developer" the system will keep a record of that exception and stop pestering you with warnings. This doesn't work with the homebrew installed version of FileBot. I am assuming because it's not signed at all? (although other unsigned applications installed with homebrew don't exhibit this behavior)

These are the typical windows we are used to, but allowing this app to run once doesn't resolve the warning for the second launch because it has a quarantine flag set.

Image Image

To make sure gatekeeper's list of overrides includes my new exception for FileBot.app:

Code: Select all

$ spctl --list | grep -i filebot
2718[UNLABELED] P0 allow execute [/Applications/FileBot.app]
That shows the override rule was indeed created. Yet each time I launch FileBot.app I get the same warning.
Checking to see if the application is signed shows that it is not signed.

Code: Select all

$ codesign -dvvvv /Applications/FileBot.app 
/Applications/FileBot.app: code object is not signed at all
$ codesign --verify -vv /Applications/filebot.app
/Applications/filebot.app: code object is not signed at all
In architecture: x86_64
Checking to see if this app is quarantined shows it was.

Code: Select all

xattr -l /Applications/FileBot.app
I removed the quarantine attribute using this command:

Code: Select all

sudo xattr -d com.apple.quarantine /Applications/FileBot.app
Now FileBot runs without warning me that it "is an application downloaded from the internet." Except whenever I update the beta I will need to perform this dance again.

disable-the-use-of-the-com-apple-quarantine-extended-attribute-on-mojave
How do I stop the “Are you sure you want to open it?” dialog box from displaying when I open an app?
User avatar
rednoah
The Source
Posts: 18986
Joined: 16 Nov 2011, 08:59
Location: Taipei
Contact:

Re: v4.9.2 Quarantine of FileBot.app issue... anyone else?

Post by rednoah »

Does installing with --no-quarantine do the trick?

e.g.
https://github.com/Homebrew/homebrew-cask/issues/85164


:!: Note that FileBot 4.9.2 nightly builds (latest beta, no official release as of yet) are not currently available via brew cask install filebot. Perhaps we're talking about FileBot 4.9.1 the most recent stable release?
:idea: Please read the FAQ and How to Request Help.
jprokos
Posts: 107
Joined: 09 Oct 2016, 02:01

Re: v4.9.2 Quarantine of FileBot.app issue... anyone else?

Post by jprokos »

Excellent, you found what I could not. This was the trouble.

:arrow: I am using this command to install filebot betas via Homebrew. Thanks for the suggestion ;)

Code: Select all

brew cask install https://raw.githubusercontent.com/filebot/plugins/master/brew/filebot-latest.rb
To test I:
Uninstalled FileBot
Removed the cached download of filebot-latest in /Users/admin/Library/Caches/Homebrew/downloads/
Added the "--no-quarantine" flag to my .bash_profile
Restarted terminal
Attempted to install the beta version again using the above link.

But it wasn't picked up by brew cask install. So I just appended it to the install arguments and installed again

Code: Select all

$ brew cask install https://raw.githubusercontent.com/filebot/plugins/master/brew/filebot-latest.rb --no-quarantine
==> Downloading https://raw.githubusercontent.com/filebot/plugins/master/brew/filebot-latest.rb.
==> Downloading https://get.filebot.net/filebot/BETA/FileBot_4.9.2.app.tar.xz
######################################################################## 100.0%
==> No SHA-256 checksum defined for Cask 'filebot-latest', skipping verification.
==> Installing Cask filebot-latest
Warning: macOS's Gatekeeper has been disabled for this Cask
==> Moving App 'FileBot.app' to '/Applications/FileBot.app'.
==> Linking Binary 'filebot.sh' to '/usr/local/bin/filebot'.
==> Linking Binary 'filebot_completion' to '/usr/local/etc/bash_completion.d/filebot'.
🍺  filebot-latest was successfully installed!
User avatar
rednoah
The Source
Posts: 18986
Joined: 16 Nov 2011, 08:59
Location: Taipei
Contact:

Re: v4.9.2 Quarantine of FileBot.app issue... anyone else?

Post by rednoah »

I've tried with FileBot 4.9.1 and the default Launcher behaviour is indeed that macOS doesn't let you start it, but that's been default behaviour for years.


If you launch the app via Finder -> Right-Click Application -> Open then you are an "advanced user" as far as Apple is concerned, and macOS will give you the option to launch the application anyway:
https://support.apple.com/guide/mac-hel ... h40616/mac


Image
:idea: Please read the FAQ and How to Request Help.
jprokos
Posts: 107
Joined: 09 Oct 2016, 02:01

Re: v4.9.2 Quarantine of FileBot.app issue... anyone else?

Post by jprokos »

rednoah wrote: 28 Sep 2020, 10:20 I've tried with FileBot 4.9.1 and the default Launcher behaviour is indeed that macOS doesn't let you start it, but that's been default behaviour for years.

If you launch the app via Finder -> Right-Click Application -> Open then you are an "advanced user" as far as Apple is concerned, and macOS will give you the option to launch the application anyway:
https://support.apple.com/guide/mac-hel ... h40616/mac
Yes, I know. That is why the behavior was so confusing. There have been changes lately with Mojave and Catalina and I am sure with the upcoming Big Sur.

Usually allowing it with admin privileges (control-click) permanently allowed it by adding a rule to Gatekeeper. I think this is the case unless a quarantine flag is also set (I have no clue what triggers this) then you get a reminder window whether you previously allowed it or not. Which is what Homebrew had been doing for FileBot - setting the quarantine flag.

Previous to adding the Homebrew "no quarantine rule", quarantining wasn't consistent. I have found Homebrew cask apps that are installed and unsigned that didn't have a quarantine flag, and also cask apps that have signatures and have a quarantine flag. I checked every app I've installed via homebrew cask and found both situations. FileBot happened to be an unsigned app that was blocked by Gatekeeper and also Quarantined. Allowing the app by adding the spctl rule and either manually removing the quarantine flag or setting brew to remove it was the key.

Possibly the difference in the homebrew install is that I installed a beta, not the release version? I am not familiar with homebrew's internal rules. I would rather not uninstall the beta and test on the release version of filebot since there are features like de-duplication that I am using. However, if it will be useful for you to know I will.
User avatar
rednoah
The Source
Posts: 18986
Joined: 16 Nov 2011, 08:59
Location: Taipei
Contact:

Re: v4.9.2 Quarantine of FileBot.app issue... anyone else?

Post by rednoah »

I've tried with FileBot 4.9.1 (i.e. just called brew cask install filebot) on macOS Catalina and things work as advertised for me at the very least. Right-Click Application -> Open and it works. I'll double-check again after upgrading macOS Big Sur to see if anything has changed in this regard.
:idea: Please read the FAQ and How to Request Help.
Post Reply