Homebrew-cask: cask install breaks signature of app emacs-mac

[railwaycat]

General troubleshooting steps

• [x] I have retried my command with --force.
• [x] I ran brew update-reset && brew update and retried my command.
• [x] I ran brew doctor, fixed as many issues as possible and retried my command.
• [x] I have checked the instructions for reporting bugs.
• [x] I made doubly sure this is not a checksum does not match error.
• [x] I checked there are no open issues for the same problem.
• [x] I understand that if I ignore these instructions, my issue may be closed without review.

Description of issue

Emacs-mac is from this tap: https://github.com/railwaycat/homebrew-emacsmacport

Install emacs-mac from brew cask, and the app bundle installed to /Applications has signature broken:

% spctl --assess --verbose /Applications/Emacs.app
/Applications/Emacs.app: rejected
source=no usable signature

But if I download the zipball directly from the address in cask formula https://github.com/railwaycat/homebrew-emacsmacport/releases/download/emacs-26.2-rc1-mac-7.5/emacs-26.2-rc1-mac-7.5-10.14.3.zip and unzip it from Finder. The signature is correct:

% spctl --assess --verbose Emacs.app
Emacs.app: accepted
source=Developer ID

So that means something happened when brew cask installation which broke the signature of bundle?

Command that failed

brew cask install emacs-mac
# no command failed exactly, but the signature of app bundle is broken

Output of command with --force --verbose --debug

% brew cask install --force --verbose --debug emacs-mac
==> Cask::Installer#install
==> Printing caveats
==> Cask::Installer#fetch
==> Satisfying dependencies
==> Downloading
==> Downloading https://github.com/railwaycat/homebrew-emacsmacport/releases/download/emacs-26.2-rc1-mac-7.5/emacs-26.2-rc1-mac-7.5-10.14.3.zip
/usr/bin/curl -q --show-error --user-agent Homebrew/2.0.6-107-g1337da0\ \(Macintosh\;\ Intel\ Mac\ OS\ X\ 10.14.4\)\ curl/7.54.0 --location --silent --head --request GET https://github.com/railwaycat/homebrew-emacsmacport/releases/download/emacs-26.2-rc1-mac-7.5/emacs-26.2-rc1-mac-7.5-10.14.3.zip
Already downloaded: /Users/xinx/Library/Caches/Homebrew/downloads/72305805d4cc35b439efc489478d1e3a1d16821fbe20478cf4215e65ecfce50f--emacs-26.2-rc1-mac-7.5-10.14.3.zip
==> Checking quarantine support
/usr/bin/xattr
/usr/bin/swift /usr/local/Homebrew/Library/Homebrew/cask/utils/quarantine.swift
==> Quarantine is available.
==> Verifying Gatekeeper status of /Users/xinx/Library/Caches/Homebrew/downloads/72305805d4cc35b439efc489478d1e3a1d16821fbe20478cf4215e65ecfce50f--emacs-26.2-rc1-mac-7.5-10.14.3.zip
/usr/bin/xattr -p com.apple.quarantine /Users/xinx/Library/Caches/Homebrew/downloads/72305805d4cc35b439efc489478d1e3a1d16821fbe20478cf4215e65ecfce50f--emacs-26.2-rc1-mac-7.5-10.14.3.zip
==> /Users/xinx/Library/Caches/Homebrew/downloads/72305805d4cc35b439efc489478d1e3a1d16821fbe20478cf4215e65ecfce50f--emacs-26.2-rc1-mac-7.5-10.14.3.zip is quarantined
==> Downloaded to -> /Users/xinx/Library/Caches/Homebrew/downloads/72305805d4cc35b439efc489478d1e3a1d16821fbe20478cf4215e65ecfce50f--emacs-26.2-rc1-mac-7.5-10.14.3.zip
==> Verifying SHA-256 checksum for Cask 'emacs-mac'.
==> Installing Cask emacs-mac
==> Cask::Installer#stage
zipinfo -1 /Users/xinx/Library/Caches/Homebrew/downloads/72305805d4cc35b439efc489478d1e3a1d16821fbe20478cf4215e65ecfce50f--emacs-26.2-rc1-mac-7.5-10.14.3.zip
==> Extracting primary container
==> Using container class UnpackStrategy::Zip for /Users/xinx/Library/Caches/Homebrew/downloads/72305805d4cc35b439efc489478d1e3a1d16821fbe20478cf4215e65ecfce50f--emacs-26.2-rc1-mac-7.5-10.14.3.zip
unzip /Users/xinx/Library/Caches/Homebrew/downloads/72305805d4cc35b439efc489478d1e3a1d16821fbe20478cf4215e65ecfce50f--emacs-26.2-rc1-mac-7.5-10.14.3.zip -d /var/folders/vr/4gn8r4z57c7f4wr5yyx2lj4c0000gy/T/d20190404-78243-17frafd
cp -pR /var/folders/vr/4gn8r4z57c7f4wr5yyx2lj4c0000gy/T/d20190404-78243-17frafd/Emacs.app/. /usr/local/Caskroom/emacs-mac/emacs-26.2-rc1-mac-7.5/Emacs.app
chmod -Rf +w /var/folders/vr/4gn8r4z57c7f4wr5yyx2lj4c0000gy/T/d20190404-78243-17frafd
==> Verifying Gatekeeper status of /Users/xinx/Library/Caches/Homebrew/downloads/72305805d4cc35b439efc489478d1e3a1d16821fbe20478cf4215e65ecfce50f--emacs-26.2-rc1-mac-7.5-10.14.3.zip
/usr/bin/xattr -p com.apple.quarantine /Users/xinx/Library/Caches/Homebrew/downloads/72305805d4cc35b439efc489478d1e3a1d16821fbe20478cf4215e65ecfce50f--emacs-26.2-rc1-mac-7.5-10.14.3.zip
==> /Users/xinx/Library/Caches/Homebrew/downloads/72305805d4cc35b439efc489478d1e3a1d16821fbe20478cf4215e65ecfce50f--emacs-26.2-rc1-mac-7.5-10.14.3.zip is quarantined
==> Propagating quarantine from /Users/xinx/Library/Caches/Homebrew/downloads/72305805d4cc35b439efc489478d1e3a1d16821fbe20478cf4215e65ecfce50f--emacs-26.2-rc1-mac-7.5-10.14.3.zip to /usr/local/Caskroom/emacs-mac/emacs-26.2-rc1-mac-7.5
/usr/bin/xattr -p com.apple.quarantine /Users/xinx/Library/Caches/Homebrew/downloads/72305805d4cc35b439efc489478d1e3a1d16821fbe20478cf4215e65ecfce50f--emacs-26.2-rc1-mac-7.5-10.14.3.zip
/usr/bin/xargs -0 -- /bin/chmod -h u\+w
/usr/bin/xargs -0 -- /usr/bin/xattr -w -s com.apple.quarantine 0181\;5ca61524\;Homebrew\\x20Cask\;EE3C1DE2-ADD9-4DFB-8CEE-9529E6A0544C
==> Creating metadata directory /usr/local/Caskroom/emacs-mac/.metadata/emacs-26.2-rc1-mac-7.5/20190404151519.628.
==> Creating metadata subdirectory /usr/local/Caskroom/emacs-mac/.metadata/emacs-26.2-rc1-mac-7.5/20190404151519.628/Casks.
==> Installing artifacts
==> 6 artifact/s defined
#<SortedSet:0x00007fcebcd5d148>
==> Installing artifact of class Cask::Artifact::App
Warning: It seems there is already an App at '/Applications/Emacs.app'; overwriting.
==> Removing App '/Applications/Emacs.app'.
==> Moving App 'Emacs.app' to '/Applications/Emacs.app'.
==> Installing artifact of class Cask::Artifact::Binary
==> Linking Binary 'Emacs' to '/usr/local/bin/emacs'.
/bin/ln -h -f -s -- /Applications/Emacs.app/Contents/MacOS/Emacs /usr/local/bin/emacs
==> Installing artifact of class Cask::Artifact::Binary
==> Linking Binary 'ebrowse' to '/usr/local/bin/ebrowse'.
/bin/ln -h -f -s -- /Applications/Emacs.app/Contents/MacOS/bin/ebrowse /usr/local/bin/ebrowse
==> Installing artifact of class Cask::Artifact::Binary
==> Linking Binary 'emacsclient' to '/usr/local/bin/emacsclient'.
/bin/ln -h -f -s -- /Applications/Emacs.app/Contents/MacOS/bin/emacsclient /usr/local/bin/emacsclient
==> Installing artifact of class Cask::Artifact::Binary
==> Linking Binary 'etags' to '/usr/local/bin/etags'.
/bin/ln -h -f -s -- /Applications/Emacs.app/Contents/MacOS/bin/etags /usr/local/bin/etags
🍺  emacs-mac was successfully installed!

Output of brew cask doctor

% brew cask doctor
==> Homebrew Version
2.0.6-107-g1337da0
==> macOS
10.14.4
==> SIP
Enabled
==> Java
1.8.0_91
==> Gatekeeper support
Enabled
==> Homebrew Cask Install Location
<NONE>
==> Homebrew Cask Staging Location
/usr/local/Caskroom
==> Homebrew Cask Taps:
/usr/local/Homebrew/Library/Taps/homebrew/homebrew-cask (4000 casks)
/usr/local/Homebrew/Library/Taps/railwaycat/homebrew-emacsmacport (4 casks)
==> Contents of $LOAD_PATH
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/simplecov-cobertura-1.3.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/ruby-macho-2.2.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/rubocop-rspec-1.32.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/rubocop-0.66.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/unicode-display_width-1.5.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/ruby-progressbar-1.10.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/rspec-wait-0.0.9/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/rspec-retry-0.6.1/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/rspec-its-1.2.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/rspec-3.8.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/rspec-mocks-3.8.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/rspec-expectations-3.8.2/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/rspec-core-3.8.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/rspec-support-3.8.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/ronn-0.7.3/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/rdiscount-2.2.0.1/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/extensions/universal-darwin-18/2.3.0/rdiscount-2.2.0.1
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/rainbow-3.0.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/psych-3.1.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/extensions/universal-darwin-18/2.3.0/psych-3.1.0
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/plist-3.5.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/parser-2.6.2.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/parallel_tests-2.28.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/parallel-1.16.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/mustache-1.1.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/mechanize-2.7.6/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/webrobots-0.1.2/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/ntlm-http-0.1.1/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/nokogiri-1.10.2/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/extensions/universal-darwin-18/2.3.0/nokogiri-1.10.2
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/mini_portile2-2.4.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/net-http-persistent-3.0.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/net-http-digest_auth-1.4.1/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/mime-types-3.2.2/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/mime-types-data-3.2018.0812/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/jaro_winkler-1.5.2/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/extensions/universal-darwin-18/2.3.0/jaro_winkler-1.5.2
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/http-cookie-1.0.3/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/hpricot-0.8.6/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/extensions/universal-darwin-18/2.3.0/hpricot-0.8.6
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/domain_name-0.5.20180417/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/unf-0.1.4/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/unf_ext-0.0.7.5/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/extensions/universal-darwin-18/2.3.0/unf_ext-0.0.7.5
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/diff-lcs-1.3/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/coveralls-0.8.22/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/thor-0.19.4/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/term-ansicolor-1.7.1/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/tins-1.20.2/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/simplecov-0.16.1/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/simplecov-html-0.10.2/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/docile-1.3.1/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/json-2.2.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/extensions/universal-darwin-18/2.3.0/json-2.2.0
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/connection_pool-2.2.2/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/backports-3.12.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/ast-2.4.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/activesupport-5.2.3/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/tzinfo-1.2.5/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/thread_safe-0.3.6/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/minitest-5.11.3/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/i18n-1.6.0/lib
/usr/local/Homebrew/Library/Homebrew/vendor/bundle/bundler/../ruby/2.3.0/gems/concurrent-ruby-1.1.5/lib
/Library/Ruby/Gems/2.3.0/gems/did_you_mean-1.0.0/lib
/Library/Ruby/Site/2.3.0
/Library/Ruby/Site/2.3.0/x86_64-darwin18
/Library/Ruby/Site/2.3.0/universal-darwin18
/Library/Ruby/Site
/System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/ruby/vendor_ruby/2.3.0
/System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/ruby/vendor_ruby/2.3.0/x86_64-darwin18
/System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/ruby/vendor_ruby/2.3.0/universal-darwin18
/System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/ruby/vendor_ruby
/System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/ruby/2.3.0
/System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/ruby/2.3.0/x86_64-darwin18
/System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/ruby/2.3.0/universal-darwin18
/usr/local/Homebrew/Library/Homebrew
==> Environment Variables
LC_ALL="en_US.UTF-8"
PATH="/usr/local/Homebrew/Library/Homebrew/shims/scm:/usr/bin:/bin:/usr/sbin:/sbin"
SHELL="/bin/zsh"

Output of brew tap

% brew tap
homebrew/cask
homebrew/core
railwaycat/emacsmacport

[vitorgalvao]

Install the cask with --no-quarantine. Does it work?

[railwaycat]

--no-quarantine works, but this is not the way cask should work...

[vitorgalvao]

--no-quarantine works, but this is not the way cask should work...

I asked to confirm the cause.

Pinging @amyspark.

[amyspark]

@vitorgalvao, @railwaycat, I can confirm this. Code signing attributes are being removed when installing via Cask:

amalia@Sakura:~ $ shasum -a 256 /Users/amalia/Library/Caches/Homebrew/Cask/emacs-mac--emacs-26.2-rc1-mac-7.5.zip 
1761ec15f9739d6f96e64f905f990d04b35bfbbdb844d82ff9cc5038436fe9ae  /Users/amalia/Library/Caches/Homebrew/Cask/emacs-mac--emacs-26.2-rc1-mac-7.5.zip
amalia@Sakura:~ $ shasum -a 256 ~/Downloads/emacs-26.2-rc1-mac-7.5-10.13.6.zip 1761ec15f9739d6f96e64f905f990d04b35bfbbdb844d82ff9cc5038436fe9ae  /Users/amalia/Downloads/emacs-26.2-rc1-mac-7.5-10.13.6.zip
amalia@Sakura:~ $ spctl --assess --verbose ~/Downloads/Emacs.app
/Users/amalia/Downloads/Emacs.app: accepted
source=Developer ID
amalia@Sakura:~ $ codesign --verify  ~/Downloads/Emacs.app
amalia@Sakura:~ $ diff -u ~/Downloads/Emacs.app/Contents/_CodeSignature/CodeResources /Applications/Emacs.app/Contents/_CodeSignature/CodeResources 
amalia@Sakura:~ $ xattr ~/Downloads/Emacs.app/Contents/MacOS/Emacs.sh 
com.apple.cs.CodeDirectory
com.apple.cs.CodeRequirements
com.apple.cs.CodeRequirements-1
com.apple.cs.CodeSignature
com.apple.quarantine
amalia@Sakura:~ $ xattr -l /Applications/Emacs.app/Contents/MacOS/Emacs.sh 
com.apple.quarantine: 0181;5ca69dc5;Homebrew\x20Cask;709B59D5-F853-4721-8C89-070540B75921

[amyspark]

My tests show that unzip is stripping all extended attributes when unpacking. As per the High Sierra man page, I think it tries to merge them in the original file (which obviously fails). The -J flag to restore the original behaviour doesn't work in my system; and even if it were, @reitermarkus's change in 81cbab846f1ab26215f5976eaa4f5e08a131c5dc will delete the metadata before we can merge it.

ping @Homebrew/maintainers, I think we should move to ditto for Casks altogether?

[MikeMcQuaid]

ping @Homebrew/maintainers, I think we should move to ditto for Casks altogether?

@amyspark Would be fine with me 👍

[vitorgalvao]

Changing to ditto as the default would be fine with me as well. @reitermarkus recently added it as the backup (after unzip), so it’d be a matter of inverting the order.

[vitorgalvao]

Also reported (for another app) in https://github.com/Homebrew/homebrew-cask/issues/61481.

[compuguy]

Yes @vitorgalvao, the sublime-merge cask is having the same issue.

Edit: I think unzip is also causing issues with the icon not displaying during the install of the nrlquaker-winbox cask as well...

[iMichka]

I did not test this, but we have also an unzip formula in homebrew-core. Not sure how different it is from the unzip on mac. It is keg-only. Maybe worth a try.