Homebrew-cask: 1Password cannot communicate with browsers while quarantined

[yuusharo]

General troubleshooting steps

• [x] I have retried my command with --force and the issue is still present.
• [x] I have checked the instructions for reporting bugs.
• [x] I made doubly sure this is not a checksum does not match error.
• [x] I ran brew update-reset && brew update and retried my command.
• [x] I ran brew doctor, fixed as many issues as possible and retried my command.
• [x] I checked there are no open issues for the same problem.
• [x] I understand that if I ignore these instructions, my issue may be closed without review.

Description of issue

1Password installed via brew cask remains quarantined, resulting in it being unable to communicate with the browser extensions on Chrome and Safari

Command that failed

brew cask install 1password

Output of command with --force --verbose --debug

Updating Homebrew...
==> Hbc::Installer#install
==> Printing caveats
==> Hbc::Installer#fetch
==> Satisfying dependencies
==> Downloading
==> Downloading https://c.1password.com/dist/1P/mac7/1Password-7.1.1.zip
Already downloaded: /Users/jason/Library/Caches/Homebrew/downloads/462657e72c950e77ba6d45d1a03945dfefaad1f2f860b293314fa386827fc619--1Password-7.1.1.zip
==> Quarantine is available.
==> Verifying Gatekeeper status of /Users/jason/Library/Caches/Homebrew/downloads/462657e72c950e77ba6d45d1a03945dfefaad1f2f860b293314fa386827fc619--1Password-7.1.1.zip
/usr/bin/xattr -p com.apple.quarantine /Users/jason/Library/Caches/Homebrew/downloads/462657e72c950e77ba6d45d1a03945dfefaad1f2f860b293314fa386827fc619--1Password-7.1.1.zip
==> /Users/jason/Library/Caches/Homebrew/downloads/462657e72c950e77ba6d45d1a03945dfefaad1f2f860b293314fa386827fc619--1Password-7.1.1.zip is quarantined
==> Downloaded to -> /Users/jason/Library/Caches/Homebrew/downloads/462657e72c950e77ba6d45d1a03945dfefaad1f2f860b293314fa386827fc619--1Password-7.1.1.zip
==> Verifying SHA-256 checksum for Cask '1password'.
==> Installing Cask 1password
==> Hbc::Installer#stage
zipinfo -1 /Users/jason/Library/Caches/Homebrew/downloads/462657e72c950e77ba6d45d1a03945dfefaad1f2f860b293314fa386827fc619--1Password-7.1.1.zip
==> Extracting primary container
==> Using container class UnpackStrategy::Zip for /Users/jason/Library/Caches/Homebrew/downloads/462657e72c950e77ba6d45d1a03945dfefaad1f2f860b293314fa386827fc619--1Password-7.1.1.zip
unzip /Users/jason/Library/Caches/Homebrew/downloads/462657e72c950e77ba6d45d1a03945dfefaad1f2f860b293314fa386827fc619--1Password-7.1.1.zip -d /var/folders/vq/gxw_cvrd4d3158yhsxr550yr0000gn/T/d20180905-23654-1eukld3
cp -pR /var/folders/vq/gxw_cvrd4d3158yhsxr550yr0000gn/T/d20180905-23654-1eukld3/1Password\ 7.app/. /usr/local/Caskroom/1password/7.1.1/1Password\ 7.app
==> Quarantine is available.
==> Verifying Gatekeeper status of /Users/jason/Library/Caches/Homebrew/downloads/462657e72c950e77ba6d45d1a03945dfefaad1f2f860b293314fa386827fc619--1Password-7.1.1.zip
/usr/bin/xattr -p com.apple.quarantine /Users/jason/Library/Caches/Homebrew/downloads/462657e72c950e77ba6d45d1a03945dfefaad1f2f860b293314fa386827fc619--1Password-7.1.1.zip
==> /Users/jason/Library/Caches/Homebrew/downloads/462657e72c950e77ba6d45d1a03945dfefaad1f2f860b293314fa386827fc619--1Password-7.1.1.zip is quarantined
==> Propagating quarantine from /Users/jason/Library/Caches/Homebrew/downloads/462657e72c950e77ba6d45d1a03945dfefaad1f2f860b293314fa386827fc619--1Password-7.1.1.zip to /usr/local/Caskroom/1password/7.1.1
/usr/bin/xattr -p com.apple.quarantine /Users/jason/Library/Caches/Homebrew/downloads/462657e72c950e77ba6d45d1a03945dfefaad1f2f860b293314fa386827fc619--1Password-7.1.1.zip
/usr/bin/xattr -w -rs com.apple.quarantine 0081\;5b9044f5\;Homebrew\\x20Cask\;39A83169-241C-46D4-A562-B0EF5D9F6409 /usr/local/Caskroom/1password/7.1.1
==> Creating metadata directory /usr/local/Caskroom/1password/.metadata/7.1.1/20180905232717.884.
==> Creating metadata subdirectory /usr/local/Caskroom/1password/.metadata/7.1.1/20180905232717.884/Casks.
==> Installing artifacts
==> 2 artifact/s defined
#<SortedSet:0x00007fe00b22a450>
==> Installing artifact of class Hbc::Artifact::App
Warning: It seems there is already an App at '/Applications/1Password 7.app'; overwriting.
==> Removing App '/Applications/1Password 7.app'.
==> Moving App '1Password 7.app' to '/Applications/1Password 7.app'.
🍺  1password was successfully installed!

Output of brew cask doctor

==> Homebrew Cask Version
Homebrew Cask 1.7.3-36-g88bf60d
Homebrew/homebrew-cask (git revision 04ee5; last commit 2018-09-06)
==> macOS
10.13.6
==> SIP
Enabled
==> Java
N/A
==> Homebrew Cask Install Location
<NONE>
==> Homebrew Cask Staging Location
/usr/local/Caskroom
==> Homebrew Cask Taps:
/usr/local/Homebrew/Library/Taps/homebrew/homebrew-cask (4046 casks)
/usr/local/Homebrew/Library/Taps/homebrew/homebrew-cask-versions (195 casks)
/usr/local/Homebrew/Library/Taps/homebrew/homebrew-cask-eid (11 casks)
/usr/local/Homebrew/Library/Taps/homebrew/homebrew-cask-fonts (1175 casks)
/usr/local/Homebrew/Library/Taps/homebrew/homebrew-cask-drivers (151 casks)
==> Contents of $LOAD_PATH
/Library/Ruby/Gems/2.3.0/gems/did_you_mean-1.0.0/lib
/Library/Ruby/Site/2.3.0
/Library/Ruby/Site/2.3.0/x86_64-darwin17
/Library/Ruby/Site/2.3.0/universal-darwin17
/Library/Ruby/Site
/System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/ruby/vendor_ruby/2.3.0
/System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/ruby/vendor_ruby/2.3.0/x86_64-darwin17
/System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/ruby/vendor_ruby/2.3.0/universal-darwin17
/System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/ruby/vendor_ruby
/System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/ruby/2.3.0
/System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/ruby/2.3.0/x86_64-darwin17
/System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/ruby/2.3.0/universal-darwin17
/usr/local/Homebrew/Library/Homebrew
==> Environment Variables
LC_ALL="en_US.UTF-8"
PATH="/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/Homebrew/Library/Homebrew/shims/scm"
SHELL="/bin/bash"

Output of brew tap

buo/cask-upgrade
homebrew/cask
homebrew/cask-drivers
homebrew/cask-eid
homebrew/cask-fonts
homebrew/cask-versions
homebrew/core
vitorgalvao/tiny-scripts

[yuusharo]

Two things to note:

First, using --no-quarantine does not seem to do anything. Cask will output a warning about bypassing Gatekeeper, but will still flag the application with the quarantine flag.

The app also appears to be running TransLocation mode, even though it's physically located in /Applications

Second, the only workaround seems to be to remove the quarantine extended attribute. This works in 10.13.6, but others have said that Mojave 10.14 lacks the -r argument for xattr

xattr -r -d com.apple.quarantine /Applications/1Password\ 7.app

It seems like quarantining cask applications is having a severe negative side-effect across the board. Multiple apps I've updated or reinstalled in the past few days complain about not being located in /Applications, or breaks inter-app communications like 1Password and Google Chrome.

[idoo]

I have another issue with Chrome + 1password or Opera + 1password

fixed it by xattr -r -d com.apple.quarantine /Applications/Google\ Chrome.app/

[JigSawFr]

Same problem, manually installed ... thanks for your PR !

[cameronmalek]

Basically all my apps (installed since this issue began) are broken right now. Thanks for fixing this!

Some further notes on the consequences of this issue for future reference: I have the same 1Password issue, but also with every Cask-installed browser with a 1Password extension. Every single Cask-installed app makes me set up brand new rules with Little Snitch (firewall app) every single time I launch it. Dropbox is completely broken and one of its processes will run at >100% CPU utilization as well.

[vitorgalvao]

Dropbox is completely broken and one of its processes will run at >100% CPU utilization as well.

What happens with our quarantining issues is that apps run as if they were opened directly from the DMG. If running from the DMG causes 100% CPU usage, that’s a bug they should fix.

Everything else is broken as expected. We’re on the case (@amyspark, mainly).

[Jahhein]

If not already stated along these issues popping up, this has something to do with macOS' App Translocation & zip files. article about the security measure that is somewhat new.

[fgimian]

Hey there folks, perhaps I'm missing something, but I just installed Mojave fresh yesterday with a new fresh installation of Homebrew and encountered this issue with 1Password.

Simply performing a brew cask install 1password caused it to be quarantined. I had to explicitly use --no-quarantine to get around this and that solved the issue. Is that the expected behaviour? The implication of the pull request (if I read it correctly) is that quarantining is now an opt-in behaviour and therefore --no-quarantine should not be required?

If anyone can kindly clarify, that would be great.

Thanks!
Fotis

[yuusharo]

The wonderful folks here, especially @amyspark, patched Cask a few weeks ago that fixes the original issue mentioned here. Apps installed via Cask are still be quarantined by default, but they now behave correctly once the user launches it for the first time and is allowed by Gatekeeper. The --no-quarantine argument now works as expected, but I don't believe it's necessary to use outside of troubleshooting.

1Password should now be working correctly with whichever browser you use, even though it still has that flag (that's a good thing!). Hope that clears things up!

[claui]

Thanks @yuusharo for the thorough (and AFAIK correct) explanation, and for the kind words! 🍻

One remaining hiccup with the 1password cask is 1Password’s built-in updater, which currently doesn’t deliver updates for me. (No idea why; hints are welcome.) Other than that, 1Password appears to work indeed perfectly fine.

[yuusharo]

Hmm, that has not been my experience. I'm running on Mojave 10.14 release, but even on High Sierra I recall 1Password updating just fine on its own. In fact, it often downloaded and installed updates faster than I could read the release notes.

By coincidence, 7.2.1 just released today (submitting a PR 😅). I was able to update from my cask installation just fine using the built-in updater.

I'll play around with it a bit this afternoon. I wonder what the issue is. =/

[fgimian]

Thanks so much for your explanation @yuusharo. I'm afraid though that this wasn't my experience with 1Password. When I would start the app, I am seeing the following in my system log:

...
Sep 25 23:59:47 Fotsies-MacBook-Pro com.apple.xpc.launchd[1] (2BUA8C4S2C.com.agilebits.onepassword7-helper[48119]): Could not find and/or execute program specified by service: 155: Refusing to execute/trust quarantined program/file: 2BUA8C4S2C.com.agilebits.onepassword7-helper
Sep 25 23:59:47 Fotsies-MacBook-Pro com.apple.xpc.launchd[1] (com.agilebits.onepassword7-launcher[48118]): Could not find and/or execute program specified by service: 155: Refusing to execute/trust quarantined program/file: com.agilebits.onepassword7-launcher
Sep 25 23:59:47 Fotsies-MacBook-Pro com.apple.xpc.launchd[1] (2BUA8C4S2C.com.agilebits.onepassword7-helper[48119]): Service exited with abnormal code: 78
Sep 25 23:59:47 Fotsies-MacBook-Pro com.apple.xpc.launchd[1] (2BUA8C4S2C.com.agilebits.onepassword7-helper): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Sep 25 23:59:47 Fotsies-MacBook-Pro com.apple.xpc.launchd[1] (com.agilebits.onepassword7-launcher[48118]): Service exited with abnormal code: 78
Sep 25 23:59:47 Fotsies-MacBook-Pro com.apple.xpc.launchd[1] (com.agilebits.onepassword7-launcher): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Sep 25 23:59:57 Fotsies-MacBook-Pro com.apple.xpc.launchd[1] (com.agilebits.onepassword7-launcher[48121]): Could not find and/or execute program specified by service: 155: Refusing to execute/trust quarantined program/file: com.agilebits.onepassword7-launcher
Sep 25 23:59:57 Fotsies-MacBook-Pro com.apple.xpc.launchd[1] (2BUA8C4S2C.com.agilebits.onepassword7-helper[48120]): Could not find and/or execute program specified by service: 155: Refusing to execute/trust quarantined program/file: 2BUA8C4S2C.com.agilebits.onepassword7-helper
Sep 25 23:59:57 Fotsies-MacBook-Pro com.apple.xpc.launchd[1] (2BUA8C4S2C.com.agilebits.onepassword7-helper[48120]): Service exited with abnormal code: 78
Sep 25 23:59:57 Fotsies-MacBook-Pro com.apple.xpc.launchd[1] (2BUA8C4S2C.com.agilebits.onepassword7-helper): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Sep 25 23:59:57 Fotsies-MacBook-Pro com.apple.xpc.launchd[1] (com.agilebits.onepassword7-launcher[48121]): Service exited with abnormal code: 78
Sep 25 23:59:57 Fotsies-MacBook-Pro com.apple.xpc.launchd[1] (com.agilebits.onepassword7-launcher): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.

I spent several hours trying to track this down. When installing 1Password via the package or ZIP file directly downloaded from the 1Password website, everything worked perfectly. But using brew cask install 1password sadly did not.

The only way I could get it working with Homebrew Cask was to use the --no-quarantine option.