bug: macOS binary release killed by Gatekeeper quarantine (com.apple.quarantine/provenance)

[ajianaz]

Bug

On macOS, the prebuilt binary release asset (cora-aarch64-apple-darwin-v0.6.0.tar.gz) cannot be executed directly after extraction — it is immediately killed by the kernel with no error output:

$ ./cora --version
Killed: 9

Environment

• cora-cli v0.6.0
• macOS (Apple Silicon, aarch64-apple-darwin)
• Binary downloaded via gh release download v0.6.0 --pattern 'cora-aarch64-apple-darwin-*.tar.gz'

Root cause

The extracted binary carries extended attributes that Gatekeeper uses to block unsigned/notarized binaries:

$ xattr ~/.local/bin/cora
com.apple.provenance

After download/extract, com.apple.quarantine is also typically attached (removed here after first failure, but com.apple.provenance persists). macOS then refuses to launch the binary and kills it with signal 9 (Killed: 9) — no error message is shown to the user, making the failure look like a crash in cora itself.

Reproduce

cd /tmp && rm -rf cora-test && mkdir cora-test && cd cora-test
gh release download v0.6.0 --repo codecoradev/cora-cli   --pattern 'cora-aarch64-apple-darwin-*.tar.gz' --clobber
tar -xzf cora-aarch64-apple-darwin-v0.6.0.tar.gz
./cora --version
# → Killed: 9

Workaround (what the user has to do today)

1. xattr -dr com.apple.quarantine /path/to/cora (not always sufficient — com.apple.provenance persists)
2. Or bypass via System Settings → Privacy & Security → "Allow Anyway"
3. Or — what I ended up doing — cargo install cora-cli --version 0.6.0 --locked (builds from source, no quarantine)

Impact

• First-run experience on macOS is broken for the official binary distribution path.
• Failure mode (Killed: 9, no output) is indistinguishable from a cora bug — users will file misleading issues.
• The checksums are fine; this is purely a macOS code-signing/notarization gap.

Suggested fix

One or more of:

1. Codesign + notarize the macOS release artifacts (codesign --sign "Developer ID Application: ..." --options runtime cora, then xcrun notarytool submit ...).
2. Document the workaround prominently in the install section of the README and the release notes (e.g. "macOS users: if the binary is killed on launch, run xattr -dr com.apple.quarantine $(which cora)").
3. Add a Homebrew tap so macOS users install via brew install (Homebrew handles the Gatekeeper story for them).
4. Ship a universal .pkg installer that is properly signed.

Option 1 (notarize) is the real fix; option 2 is the minimum-cost stopgap.

Context

Observed while running cora scan on a downstream project (codecoradev/rungu). Cora itself works perfectly once it can actually run — the issue is purely the distribution/install path on macOS.