Overview
- As of macOS Ventura 13.4.1, Apple has changed the default behavior for Safari when downloading
.zipfiles. It now auto-extracts them in the user's Downloads folder. - This causes an issue as Apple automatically flags any
.appfile in Downloads, Documents, or Desktop with the Quarantine flag, which will prevent the installer from functioning properly.
Product and Environment
- Sophos Endpoint for macOS
- macOS Ventura 13.4.1 and later
Impact
- Installations may fail, or show the downloading bar for an extended period before failing.
- The installer is stuck at the 'Starting services' phase during installation on macOS 27 Golden Gate.
- In the Sophos Diagnostics logs, paths including
AppTranslocationwill be seen.
For example:2023-06-30 17:25:55.034605+0530 Sophos Installer[99092]: install debug : ExecutablePath = /var/folders/rs/h3kn2hk50rxbfnrn_np2s_3w0000gn/T/AppTranslocation/F660838F-5D7E-431C-AA65-C1638C36FE44/d/Sophos Installer.app/Contents/MacOS/Sophos Installer, bundlePath = /var/folders/rs/h3kn2hk50rxbfnrn_np2s_3w0000gn/T/AppTranslocation/F660838F-5D7E-431C-AA65-C1638C36FE44/d/Sophos Installer.app
What to do?
There are three different workarounds for this issue:
- Download the Sophos Installer using Chrome.
- Turn off the auto extraction in Safari.
- Open Safari.
- Click Safari in the upper left.
- Click Settings.
- Clear Open "safe" files after downloading.
- Download the Sophos Installer.
- Remove the quarantine attribute from the installer, as seen below.
- To check if the quarantine attribute has been set, open Terminal, then do the following:
Note: This assumes the files are extracted into the user's Downloads folder. If your location is different, you will need to adjust the paths. - Run:
xattr ~/Downloads/SophosInstall/Sophos\ Installer.app - This will likely display com.apple.quarantine. If this exists, continue.
- Run:
sudo xattr -r -d com.apple.quarantine ~/Downloads/SophosInstall/Sophos\ Installer.app - Run the installer normally.
- To check if the quarantine attribute has been set, open Terminal, then do the following: