Installing an app with notifications enabled

[apastuszak]

MacOS question

I recently discovered the --no-quarantine switch, which is great, since I install everything I can with Homebrew and use upgrade --greedy to update.

When I launch certain apps after I upgrade them, I get the MacOS popup about enabling notifications for the app. Is there some way to set that to enabled using a switch on the brew install command? If not, there any way to do this from the terminal in MacOS?

[SMillerDev]

Wait, what do you think no-quarantine does? Because it disables security features so it's not recommended to use everywhere. As for setting notification permissions, Homebrew can't change any app settings.

[apastuszak]

I only use --no-quarantine on the apps that are not signed, like VScodium. For those app, I normally install them and then have to right click on them and choose Open. Then I get prompted to allow it to open, and then it opens without warning after that. I assume that is no different than using --no-quarantine?

Am I mistaken?

[SMillerDev]

The reason you have that flow normally is because Homebrew marks the app as downloaded an therefore macOS is extra careful when opening the application including checking the signing. With --no-quarantine Homebrew doesn't add that mark and the app runs without guardrails like you developed it locally.

[apastuszak]

I assume the result is the same. If I don't use --no-quarantine and do the whole right click and open the result is the same as usiong --no-qurantine. The right click→open process doesn't provide any more long-term security.

Is there a way to force certain casks to always use --no-quarantine? I odn't want to turn it off globally. Just fot casks I trust.

[SMillerDev]

I assume the result is the same. If I don't use --no-quarantine and do the whole right click and open the result is the same as usiong --no-qurantine. The right click→open process doesn't provide any more long-term security.

You'd assume wrong though. Executables with the quarantine flag set have to pass full gatekeeper validation (where only the signing is overridable on intel by the user as far as I know) and write an entry in the quarantine database when used so that there is a record of user confirmation. Using --no-quarantine skips any security checking and just forces the app to be completely trusted.

Therefore there is also no way to turn this off beyond passing the flag on every install.

[apastuszak]

But once the app is written to the quarantine database, MacOS does MacOS do any further checks on that app when launched and run vs signed apps?

[SMillerDev]

It's not that signed apps aren't checked, it's that they pass the check