fix: remove macOS quarantine from the installed compiler

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

3 files changed, 17 insertions, 1 deletions

diff --git a/AGENTS/ARCH.md b/AGENTS/ARCH.md
index f5738d1..181c207 100644
--- a/AGENTS/ARCH.md
+++ b/AGENTS/ARCH.md
@@ -87,7 +87,9 @@ and runs in a minimal chroot without LLVM/lli. Windows EMBEDDED is untested.
 On Linux, `make -C build install` builds the manual and calls the POSIX
 `install.sh` to copy `cpsc` and `doc/cpsc.1` into `CMAKE_INSTALL_PREFIX/bin` and
 `CMAKE_INSTALL_PREFIX/share/man/man1` (default prefix `/usr/local`). The script
-also supports `--prefix`, `--source-dir` and `DESTDIR` staging. Ordinary builds
+also supports `--prefix`, `--source-dir` and `DESTDIR` staging. On macOS it removes
+`com.apple.quarantine` from the installed executable if present; attribute inspection
+or removal failures abort installation with a diagnostic. Ordinary builds
 do not require Pandoc; `doc`, installation and release packaging do. The modular
 `cmake/Manual.cmake` target defers Pandoc discovery until manual generation, prefers
 the extracted executable, and sets its local runtime/data paths as needed. System
diff --git a/doc/install.md b/doc/install.md
index 365a1c1..f1746e5 100644
--- a/doc/install.md
+++ b/doc/install.md
@@ -28,6 +28,10 @@ You can also run `./install.sh --source-dir build --prefix "$HOME/.local"`
 directly after building `cpsc` and running `make -C build doc`.
 `DESTDIR` is supported for staging, for example `DESTDIR=/tmp/cpsc-stage make -C build install`.
 
+On macOS, `install.sh` also removes `com.apple.quarantine` from the installed
+executable when present. An executable without that attribute installs normally;
+failure to inspect or remove the attribute is reported as an installation error.
+
 ## Unix release packages
 
 Create an installation archive with:
diff --git a/install.sh b/install.sh
index eded452..43a4a42 100755
--- a/install.sh
+++ b/install.sh
@@ -56,6 +56,16 @@ install -m 755 "$source_dir/cpsc" "$bin_dir/cpsc" \
 install -m 644 "$source_dir/doc/cpsc.1" "$man_dir/cpsc.1" \
     || die "cannot install the manual to $man_dir; check permissions"
 
+if [ "$(uname -s)" = Darwin ]; then
+    command -v xattr >/dev/null 2>&1 || die "required command not found: xattr"
+    attributes=$(xattr "$bin_dir/cpsc") \
+        || die "cannot read extended attributes of $bin_dir/cpsc"
+    if printf '%s\n' "$attributes" | grep -qx 'com\.apple\.quarantine'; then
+        xattr -d com.apple.quarantine "$bin_dir/cpsc" \
+            || die "cannot remove quarantine from $bin_dir/cpsc; check permissions"
+    fi
+fi
+
 printf 'Installed %s\nInstalled %s\n' "$bin_dir/cpsc" "$man_dir/cpsc.1"
 if [ -z "$destdir" ]; then
     case ":${PATH:-}:" in