Repository navigation
readme does not say what to do when macOS or Windows block the downloaded binary #16
Description
Measured
.github/workflows/release.ymldoes not sign with an Apple certificate or Authenticode:grep -c -E "codesign|notarytool|signtool" .github/workflows/release.yml→ 0.- The README Install section (
README.md:39-61) does not mention Gatekeeper or SmartScreen.
Why it matters
Beta testers on macOS and Windows who download with the browser: the system blocks or warns about the executable and the README does not tell them how to proceed. It is the first step of the evaluation.
Acceptance criteria
- The Install section explains, per platform, what to do after verifying with cosign: on macOS, remove the quarantine attribute or download with
curl; on Windows,Unblock-Fileor «Más información → Ejecutar de todos modos» (More info → Run anyway). - It makes clear that cosign verification is the integrity proof.
- It has been tested on macOS 15 and Windows 11 with a browser download.
Depends on
Nothing. Platform signing, which would make this unnecessary, is #50.
Activity
[-]el readme no dice qué hacer cuando macOS o Windows bloquean el binario descargado[/-][+]readme does not say what to do when macOS or Windows block the downloaded binary[/+]d0ubl3g commentedon Oct 7, 2026
Documentation landed in 0.2.0 (#63): the README section "If macOS or Windows blocks the binary" covers the macOS quarantine attribute and the
curldownload, WindowsUnblock-File, and "More info → Run anyway". It states that the cosign check is the proof of integrity. Since 0.2.0 the Windows binary is also signed (#50).Still open: testing those steps on macOS 15 and Windows 11 with a browser download. No result is recorded yet.
d0ubl3g commentedon Oct 10, 2026
Partial results for the Windows steps, with v0.3.0, on Windows Server 2022 (build 20348) in a VM, not Windows 11. The session had no interactive desktop, so anything that needs a browser download or a dialog could not be observed.
Measured:
hodeishield.exeboth have valid Authenticode signatures (Hodeitek S.L., timestamped). The zip is not Authenticode-signed, as expected. SHA-256 of the zip and MSI matchSHA256SUMS.Zone.Identifierstream added by hand), becauseInvoke-WebRequestdoes not set it. With the mark on the MSI, a silent install still succeeded (exit 0).Unblock-Fileremoves the mark from the zip. On Windows PowerShell 5.1,Expand-Archivenever copies the mark to the unpacked files, with or withoutUnblock-File. Unblocking therefore only matters for Explorer's "Extract All" or other tools that carry the mark over. A README sentence could say so.Not measured yet: SmartScreen on a double-click of the exe or on opening the MSI, the UAC publisher prompt, a real browser download, Windows 11, and macOS 15. This issue stays open for those.
d0ubl3g commentedon Oct 15, 2026
Progress on the macOS steps, with v0.4.4 on macOS 27.0.1 (arm64), not macOS 15.
SHA256SUMSmatches andcosign verify-blobprints "Verified OK" (cosign v3.1.3).codesignshows an ad-hoc signature with no Team ID,spctlrejects it and no notarization ticket is stapled.hodeishield --versionprinted 0.4.4.xattr -d com.apple.quarantineremoves the block: the binary then runs with no dialog, and a secondxattr -dreports "No such xattr".curldownload carries no quarantine flag and runs without a dialog.tarin Terminal keeps the quarantine flag on the binary, so the block still applies.Not tested yet: a real browser download, macOS 15 and Windows 11. Windows results so far are in the earlier comment (Windows Server 2022). The README gets a small update (the System Settings route, that
tarkeeps the flag, and that the dialog text follows the system language). This issue stays open for the remaining checks.d0ubl3g commentedon Oct 15, 2026
0.5.0 adds to the README the System Settings route for a blocked macOS binary (Privacy & Security → Open Anyway), that unpacking with
tarin Terminal keeps the block, and that the dialog follows the system language; thexattrand WindowsUnblock-Filesteps were already there. Still open: confirming both with a real browser download on macOS 15 and Windows 11.d0ubl3g commentedon Oct 16, 2026
Status 2026-10-16: the README on
mainnow covers both platforms (README.md, sections on macOS Gatekeeper and Windows SmartScreen /Unblock-File). The remaining acceptance check is manual: download the 0.5.0 archive with a browser on macOS 15 and on Windows 11, follow the README steps, and record the result here.d0ubl3g commentedon Oct 18, 2026
Windows part of this check, on a clean Windows 11 machine, with the 0.5.0 release assets:
Supported by the run:
SHA256SUMS, andcosign verify-blobpasses for both.hodeishield.exeand the MSI have valid Authenticode signatures.Unblock-Fileon the zip or on the exe, the binary runs and printshodeishield 0.5.0.Not covered yet:
The README now links the Install section to the unblock steps and gives the Windows steps for every version (#209). The issue stays open until a browser download is tested on Windows 11 and on macOS.
d0ubl3g commentedon Oct 19, 2026
Browser download on Windows 11, version 0.5.0: Edge saved the zip with the download mark (
Zone.IdentifierZoneId=3); unpacking it with File Explorer carried the mark over tohodeishield.exe; starting the executable from Explorer showed Microsoft Defender SmartScreen "Windows protected your PC" (unrecognized app) although the binary has a valid Authenticode signature. That matches the README: unblock the archive before unpacking, or choose "More info → Run anyway". The macOS part is still to be checked.