Tart.app version 2.30.5 is quarantined, the Contents/MacOS/tart executable is blocked: "A Notarization ticket is not stapled to this application", "Invalid resource directory (directory or signature have been modified)" #1187
Description
The tart.tar.gz archive downloaded from https://github.com/cirruslabs/tart/releases/tag/2.30.5 contains Tart.app which is quarantined (xattr -l /Applications/Tart.app).
In turn, this blocks the execution of Contents/MacOS/tart.
This can be remediated by removing the quarantine attribute (xattr -dr com.apple.quarantine /Applications/Tart.app), but I wonder why code-signing is incorrect, and why the app isn't notarized??
alias tart=/Applications/Tart.app/Contents/MacOS/tart/Applications/tart.app/Contents/MacOS/tart --version
“Tart.app” is damaged and can’t be opened. You should move it to the Bin.
I guess this is a related PR? #1007 (comment)
syspolicy_check distribution /Applications/Tart.app
==>
syspolicy_check distribution /Applications/Tart.app
App has failed one or more pre-distribution checks.
---------------------------------------------------------------
Codesign Error
File: Tart.app
Severity: Fatal
Full Error: Invalid resource directory (directory or signature have been
modified). Please re-sign using the latest version of macOS and
codesign.
Type: Notary Error
Notary Ticket Missing
File: Tart.app
Severity: Fatal
Full Error: A Notarization ticket is not stapled to this application.
Type: Distribution Error
---------------------------------------------------------------
codesign --verify --verbose=4 /Applications/Tart.app (or spctl -a -vvv -t install /Applications/Tart.app or spctl -a -vvv -t open --context context:primary-signature /Applications/Tart.app)
==>
/Applications/Tart.app: invalid resource directory (directory or signature have been modified)
codesign --display --verbose=4 /Applications/Tart.app ==>
Executable=/Applications/tart.app/Contents/MacOS/tart
Identifier=tart
Format=bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=277808 flags=0x10000(runtime) hashes=8671+7 location=embedded
VersionPlatform=1
VersionMin=851968
VersionSDK=1703936
Hash type=sha256 size=32
CandidateCDHash sha256=144fffd0dda79672c7fee53e7f3bab9912f30632
CandidateCDHashFull sha256=144fffd0dda79672c7fee53e7f3bab9912f3063222f654f79cd406d5efce597a
Hash choices=sha256
CMSDigest=144fffd0dda79672c7fee53e7f3bab9912f3063222f654f79cd406d5efce597a
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=12337152
Executable Segment flags=0x1
Page size=4096
CDHash=144fffd0dda79672c7fee53e7f3bab9912f30632
Signature size=8985
Authority=Developer ID Application: Cirrus Labs, Inc. (9M2P8L4D89)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=29 Jan 2026 at 17:17:51
Info.plist=not bound
TeamIdentifier=9M2P8L4D89
Runtime Version=26.0.0
Sealed Resources=none
Internal requirements count=1 size=164