From 6c5bb2294883d848ed5838038186c571ce7dedc2 Mon Sep 17 00:00:00 2001
From: patryk4815 <patryk.sondej@grupawp.pl>
Date: Sun, 24 Aug 2025 20:36:27 +0200
Subject: [PATCH] fix: handle quarantine flag during portable startup on macOS
 (#3266)

---
 nix/portable.nix | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/nix/portable.nix b/nix/portable.nix
index 27b11d74c..2e5e90088 100644
--- a/nix/portable.nix
+++ b/nix/portable.nix
@@ -55,12 +55,28 @@ let
       export PATH="$dir/bin/:$PATH"
     '';
 
+  macosQuarantine = lib.optionalString pkgs.stdenv.isDarwin ''
+    libpython="libpython${python3.pythonVersion}.dylib"
+
+    if command -v xattr >/dev/null 2>&1 && command -v grep >/dev/null 2>&1; then
+      if xattr -x "$dir/lib/$libpython" 2>/dev/null | grep -q com.apple.quarantine; then
+        echo "Error: The pwndbg is marked as quarantined by macOS."
+        echo "To fix this, run the following command:"
+        echo ""
+        echo "  xattr -rd com.apple.quarantine \"$dir\""
+        echo ""
+        exit 1
+      fi
+    fi
+  '';
+
   wrapperBinPy =
     file:
     pkgs.writeScript "pwndbg-wrapper-bin-py" ''
       #!/bin/sh
       dir="$(cd -- "$(dirname "$(dirname "$(realpath "$0")")")" >/dev/null 2>&1 ; pwd -P)"
       ${commonEnvs}
+      ${macosQuarantine}
       exec ${ldLoader} "$dir/exe/python3" "$dir/${file}" "$@"
     '';
   wrapperBin =
@@ -69,6 +85,7 @@ let
       #!/bin/sh
       dir="$(cd -- "$(dirname "$(dirname "$(realpath "$0")")")" >/dev/null 2>&1 ; pwd -P)"
       ${commonEnvs}
+      ${macosQuarantine}
       exec ${ldLoader} "$dir/${file}" "$@"
     '';