Unzipped application is damaged and can’t be opened and you should move it to the Trash

[aonez]

Some applications contained in a ZIP package appear to be damaged after being extracted by Keka.

In fact, the app is not damaged at all, but the system applies a quarantine flag that renders it unusable. Since Keka is sandboxed, right now there's no permanent fix to that.

The reason might be the same as described here. There're some workarounds:

• Simply copy/paste the application. The pasted one will not have this issue.
• Or manually remove the quarantine flag. Using the terminal:

  xattr -d -r com.apple.quarantine <APP_PATH>

This issue is connected with #215, but only affects to some ZIP files.
First reported here: https://twitter.com/the_jannis/status/1010259254043955200

[alvarnell]

This hasn't been my experience, in fact I found just the opposite was true in #176. Perhaps I need to do some checks with the latest version. I also don't understand how the application of a quarantine flag would prevent a legitimate app from being used. All the quarantine flag does is cause the file to be scanned by XProtect to find known malware and by Gatekeeper to make sure that it's Apple Developer ID signature hasn't been revoked or alert the user that it isn't signed with an Apple Developer ID. In the latter case, all the user has to do is Right-click / Command-click on the app and choose open to get a dialog box allowing them to launch the app. In my experience, if the dialog says it's damaged and must be trashed then it's something that will harm the OS or user. Removing the quarantine flag prevents these checks and may cause unwanted consequences.

…

-Al-

[gingerbeardman]

Can anybody compare the app before and after extraction? Package contents, binary, attributes on all files?

[aonez]

Maybe a md5 or similar is enough

[aonez]

@alvarnell I think you had this one: #215. As you can see depending on I don't really know yet what it can be #215, #294 or this one.

[aonez]

Can anybody compare the app before and after extraction? Package contents, binary, attributes on all files?

Thanks @gingerbeardman for that. xScope package and Sublime Merge (from #294) have extended attributes files inside. The bundled macOS archiver applies them, Keka does not. Those files might be the reason of those issues.

@alvarnell you were right, removing the quarantine just skips the signature/integrity check. The problem is not in the quarantine files.

[aonez]

This is as well fixed in 1.1.6 👌🏼