From 7483efd2a9141bea17238724f7e9f65976e5f419 Mon Sep 17 00:00:00 2001
From: Tam Nguyen Duc <1218621+tamnd@users.noreply.github.com>
Date: Tue, 7 Jul 2026 08:39:54 +0700
Subject: [PATCH] Dequarantine the brew cask binary on install (#67)

Homebrew quarantines cask artifacts and Gatekeeper SIGKILLs quarantined
binaries that are only ad-hoc signed, which cross-compiled Go binaries
are. shirabe hit this first: brew install worked but the binary died
with exit 137 until the attribute was stripped by hand. Add the same
postflight xattr hook here so casks from the next release run first
try.
---
 .goreleaser.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 0b0689c..a4b49ce 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -159,6 +159,15 @@ homebrew_casks:
     commit_author:
       name: Duc-Tam Nguyen
       email: tamnd87@gmail.com
+    # Homebrew quarantines cask artifacts, and Gatekeeper kills quarantined
+    # binaries that are only ad-hoc signed (which cross-compiled Go binaries
+    # are). Strip the attribute at install so the binary runs first try.
+    hooks:
+      post:
+        install: |
+          if system_command("/usr/bin/xattr", args: ["-h"]).exit_status.zero?
+            system_command "/usr/bin/xattr", args: ["-dr", "com.apple.quarantine", "#{staged_path}/kage"]
+          end
 
 scoops:
   # Scoop manifest for Windows, pushed to the bucket repository. It installs the