macOS: gcloud-crc32c blocked by Gatekeeper (com.apple.provenance not stripped post-install)

[ramjee-ganti-glean]

Problem

On macOS, binaries installed by this plugin retain com.apple.provenance extended attributes from the download. This causes macOS Gatekeeper to block gcloud-crc32c, which breaks gcloud storage commands (cp, rsync, etc.) in non-interactive contexts.

Symptoms

• gcloud storage cp or gcloud storage rsync hangs silently after completing the transfer (e.g., "Completed files 0/1 | 235.1MiB/235.1MiB")
• The hang occurs because gcloud calls should_use_gcloud_crc32c(install_if_missing=True) for checksum verification, finds the binary is Gatekeeper-rejected, and falls back to interactive component installation — which hangs with no TTY
• In terminal (TTY available), users get a Gatekeeper dialog. If they click "Cancel" or "Move to Trash", the binary is permanently blocked

Root cause

The bin/install script downloads the SDK tarball and extracts it, but does not strip macOS quarantine/provenance attributes from the extracted binaries:

# bin/install (line ~35)
tar -zxf "${ASDF_DOWNLOAD_PATH}/${gcs_object}" -C "${ASDF_INSTALL_PATH}" --strip-components=1

After extraction, binaries like gcloud-crc32c retain com.apple.provenance, and spctl --assess rejects them:

$ xattr ~/.local/share/mise/installs/asdf-mise-plugins-mise-gcloud/564.0.0/bin/gcloud-crc32c
com.apple.provenance

$ spctl --assess ~/.local/share/mise/installs/asdf-mise-plugins-mise-gcloud/564.0.0/bin/gcloud-crc32c
rejected

How Homebrew handles this

Homebrew strips quarantine attributes as part of its cask/formula install process. This plugin does not.

Suggested fix

Add Gatekeeper attribute stripping after extraction in bin/install, before running install.sh:

# Strip macOS Gatekeeper quarantine attributes after extraction
if [[ "$(uname)" == "Darwin" ]]; then
    xattr -cr "${ASDF_INSTALL_PATH}" 2>/dev/null || true
fi

Note: xattr -cr clears com.apple.quarantine (which prevents the initial Gatekeeper assessment). com.apple.provenance may require elevated privileges to remove, but stripping quarantine before first execution should prevent Gatekeeper from flagging the binaries in the first place.

Environment

• macOS Sequoia (15.x)
• mise 2025.x
• gcloud SDK 564.0.0 (installed via asdf:mise-plugins/mise-gcloud)

Workaround

Set CLOUDSDK_STORAGE_CHECK_HASHES=never before any gcloud storage commands to bypass gcloud-crc32c entirely. Download integrity can be verified by other means (e.g., successful tar extraction).