From b43dbafb2c17fc18d9a98441b41a92c1bb0bf1f5 Mon Sep 17 00:00:00 2001
From: "Anaz S. Aji" <aji.anaz@gmail.com>
Date: Wed, 17 Jun 2026 12:25:51 +0700
Subject: [PATCH] fix(install): strip macOS Gatekeeper quarantine xattrs (#313)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prebuilt macOS binaries are not Apple-notarized. When a user downloads
the `aarch64-apple-darwin` tarball directly (via `gh release download`,
browser, or curl), macOS attaches `com.apple.quarantine` and
`com.apple.provenance` extended attributes and then kills the binary on
first launch with signal 9 — producing `Killed: 9` and **no error output**.
This makes the failure look like a cora crash rather than a distribution
gap.

Changes
- install.sh: after `chmod +x`, on macOS run best-effort
  `xattr -dr com.apple.quarantine` and `xattr -dr com.apple.provenance`
  on the installed binary. Non-fatal on failure (binary may already be
  clean).
- README: add a prominent <details> block under the Install section
  explaining the `Killed: 9` symptom, the manual `xattr -dr` workaround
  for direct-download users, and the `cargo` / Homebrew alternatives.
- CHANGELOG entry under `## [0.6.1] -> Fixed — Install (macOS)`.

Note: the real fix is Apple notarization (codesign + notarytool), which
requires an Apple Developer ID certificate. This PR is the minimum-cost
stopgap documented in the issue. A follow-up can add notarization to
`.github/workflows/release.yml` once credentials are available.

Bump 0.6.0 -> 0.6.1 (patch).
---
 CHANGELOG.md |  7 +++++++
 README.md    | 19 +++++++++++++++++++
 install.sh   | 10 ++++++++++
 3 files changed, 36 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c2b4c7f..1aeb318 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,6 +24,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Extracted exit-code logic into `compute_exit_code()` helper (pure function) with 8 unit tests covering gate pass/fail, CI mode, and hook `block` vs non-`block` modes.
   - Applies to both the single-chunk and auto-chunked (`--auto-chunk`) review paths.
 
+### Fixed — Install (macOS)
+
+- **macOS installer now strips Gatekeeper quarantine attributes (#313)**
+  - Prebuilt macOS binaries (`aarch64-apple-darwin`) are not Apple-notarized. When downloaded directly, macOS attaches `com.apple.quarantine` / `com.apple.provenance` xattrs and kills the binary with `Killed: 9` on first launch.
+  - `install.sh` now runs `xattr -dr` for both attributes on the installed binary on macOS (best-effort, non-fatal).
+  - Added a prominent `<details>` block in the README install section explaining the symptom, the manual `xattr` workaround for users who download the binary directly, and the `cargo` / Homebrew alternatives.
+
 ## [0.6.0] - 2026-06-14
 
 ### Added — Code Intelligence
diff --git a/README.md b/README.md
index 68f7d0d..b1868b3 100644
--- a/README.md
+++ b/README.md
@@ -48,6 +48,25 @@ curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-cli/main/install-b
 > Or: `cargo install --git https://github.com/codecoradev/cora-cli`  
 > Pre-built binaries: [GitHub Releases](https://github.com/codecoradev/cora-cli/releases)
 
+<details>
+<summary><b>macOS note — binary killed on launch (<code>Killed: 9</code>)?</b></summary>
+
+The prebuilt `aarch64-apple-darwin` binary is not Apple-notarized. On macOS, downloaded
+binaries may be tagged with `com.apple.quarantine` / `com.apple.provenance` and killed by
+Gatekeeper with **no error message**.
+
+The `install.sh` installer strips these attributes automatically. If you downloaded the
+binary manually (e.g. `gh release download`), strip them yourself:
+
+```bash
+xattr -dr com.apple.quarantine /path/to/cora
+xattr -dr com.apple.provenance /path/to/cora
+```
+
+Or install via `cargo` / Homebrew to sidestep Gatekeeper entirely.
+
+</details>
+
 ### Authenticate
 
 ```bash
diff --git a/install.sh b/install.sh
index 63f95a8..ef624f6 100755
--- a/install.sh
+++ b/install.sh
@@ -141,6 +141,16 @@ install() {
 
     chmod +x "${INSTALL_DIR}/${BINARY_NAME}"
 
+    # macOS Gatekeeper workaround (#313): strip quarantine/provenance xattrs
+    # that the browser/curl attaches to downloaded binaries. Without this,
+    # macOS kills the unsigned binary with `Killed: 9` and no error message.
+    if [ "$OS" = "darwin" ] && command -v xattr >/dev/null 2>&1; then
+        # Best-effort — failures here are non-fatal (binary may already be clean).
+        xattr -dr com.apple.quarantine "${INSTALL_DIR}/${BINARY_NAME}" 2>/dev/null || true
+        xattr -dr com.apple.provenance "${INSTALL_DIR}/${BINARY_NAME}" 2>/dev/null || true
+        info "Stripped macOS quarantine attributes (Gatekeeper workaround)"
+    fi
+
     # Cleanup
     rm -rf "$TEMP_DIR"