macOS 信任 Python whl 文件，但不信任 tar 文件

Question

I provide my python c extension as both as a tar file, as well as a whl file.

On macOS, I am surprised that there are no problems installing the wheel for my extension. When setting PYTHONPATH to my python extension in the tarball, I am immediately met with the dialog about unverified developers.

Could someone please explain why macOS trusts my unsigned python extension, but has no problem if I package it in a wheel file.

Update: This is the error I see after I close the dialog box:

>>> import devsim
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/jsanchez/Downloads/devsim_macos_v2.3.7rc1/lib/devsim/__init__.py", line 8, in <module>
    from .devsim_py3 import *
ImportError: dlopen(/Users/jsanchez/Downloads/devsim_macos_v2.3.7rc1/lib/devsim/devsim_py3.so, 0x0002): tried: '/Users/jsanchez/Downloads/devsim_macos_v2.3.7rc1/lib/devsim/devsim_py3.so' (code signature in <ED44BB00-36CF-39A8-8999-8309CBA016E4> '/Users/jsanchez/Downloads/devsim_macos_v2.3.7rc1/lib/devsim/devsim_py3.so' not valid for use in process: library load disallowed by system policy)

Could someone please explain why macOS trusts my unsigned python extension, but has no problem if I package it in a wheel file.

Update 2:

From what I can see. If I download the tgz to my Downloads folder using Chrome, I am getting the error. If I download the tgz using curl, it works. I am thinking that Chrome is adding this bad attribute.

Answer 1

Thanks to @GordonDavisson for his tip concerning the attributes. It turns out the issue was related to google chrome. If I download the file from Github using Chrome I get:

    com.apple.macl       72 
    com.apple.metadata:kMDItemWhereFroms        655 
    com.apple.quarantine         57 

and using curl I get no attributes.

I have lax security permissions in Chrome (no safe browsing), but this still occurs. I will be sure to look out for this the next time I encounter it.

Update

I found this very useful post concerning the current macOS landscape: https://eclecticlight.co/2021/02/18/code-signing-requirements-for-scripts-and-apps-in-big-sur/