{
	"id": "32bd8c6c-8483-42be-b47f-b331506cd1ff",
	"created_at": "2026-04-06T00:14:16.337021Z",
	"updated_at": "2026-04-10T03:20:25.684652Z",
	"deleted_at": null,
	"sha1_hash": "a0fd82d0a4e373c3e7df64003aaf9e99e0bf4951",
	"title": "Clearing the quarantine extended attribute from downloaded applications",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 81120,
	"plain_text": "Clearing the quarantine extended attribute from downloaded\r\napplications\r\nBy rtrouton\r\nPublished: 2012-11-20 · Archived: 2026-04-05 15:30:02 UTC\r\nHome \u003e Mac administration, Mac OS X \u003e Clearing the quarantine extended attribute from\r\ndownloaded applications\r\nWhen I’m packaging an application for deployment, I normally download the latest version from the vendor. If it’s\r\na drag-and-drop install, where the application is a self-contained bundle, it will get the com.apple.quarantine\r\nextended attribute associated with it.\r\nThe quarantine attribute is added by the OS so that it can ask for user confirmation the first time the downloaded\r\nprogram is run. Gatekeeper in Lion and Mountain Lion also uses the com.apple.quarantine attribute to determine\r\nif an application should be checked (and blocked if needed.)\r\nTo avoid issues with both unwanted messages and Gatekeeper, I normally clear this attribute as part of my\r\npackaging. Here’s how to check to see if your application has the com.apple.quarantine attribute associated with\r\nit:\r\n1. Open Terminal\r\n2. Run the following command:\r\nxattr /path/to/MyApp.app\r\nIf the com.apple.quarantine attribute is associated with the application, you should see the following output:\r\ncomputername:Applications username$ xattr /path/to/MyApp.app\r\ncom.apple.quarantine\r\ncomputername:Applications username$\r\nhttps://derflounder.wordpress.com/2012/11/20/clearing-the-quarantine-extended-attribute-from-downloaded-applications/\r\nPage 1 of 2\n\nNote: Other attributes may also be listed, with com.apple.FinderInfo being a common one.\r\nTo remove the quarantine attribute, you would then run the following command:\r\nsudo xattr -r -d com.apple.quarantine /path/to/MyApp.app\r\nThat will recursively remove the com.apple.quarantine attribute from the application. The -r option will allow\r\nthe quarantine attribute of all files inside the application to be selected, while the -d option causes the given\r\nattribute name (and associated value) to be removed.\r\nSource: https://derflounder.wordpress.com/2012/11/20/clearing-the-quarantine-extended-attribute-from-downloaded-applications/\r\nhttps://derflounder.wordpress.com/2012/11/20/clearing-the-quarantine-extended-attribute-from-downloaded-applications/\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://derflounder.wordpress.com/2012/11/20/clearing-the-quarantine-extended-attribute-from-downloaded-applications/"
	],
	"report_names": [
		"clearing-the-quarantine-extended-attribute-from-downloaded-applications"
	],
	"threat_actors": [],
	"ts_created_at": 1775434456,
	"ts_updated_at": 1775791225,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/a0fd82d0a4e373c3e7df64003aaf9e99e0bf4951.pdf",
		"text": "https://archive.orkl.eu/a0fd82d0a4e373c3e7df64003aaf9e99e0bf4951.txt",
		"img": "https://archive.orkl.eu/a0fd82d0a4e373c3e7df64003aaf9e99e0bf4951.jpg"
	}
}