workaround for https://github.com/anthropics/claude-code/issues/12531

gistfile1.txt

#!/usr/bin/env bash
# verify-claude.sh — Verify Claude Code is signed by Anthropic, then clear
# the quarantine xattr that triggers Gatekeeper after each `brew upgrade`.
#
# macOS code signing pins identity via the Apple-issued Team ID, which is
# bound to a Developer ID certificate. Bundle IDs are not authoritative —
# anyone can claim `com.anthropic.claude-code`, but only Anthropic has
# Team ID Q6L2SF6YDW.
#
# Steps:
#   1. `codesign --verify` checks the CMS signature, the cert chain to
#      Apple Root CA, and re-hashes every code page against the
#      CodeDirectory. Any byte modified post-signing → mismatch → fail.
#   2. Pin on Team ID.
#   3. Only if (1) and (2) pass, remove com.apple.quarantine.
#
# Usage:
#   ./verify-claude.sh              # uses `which claude`
#   ./verify-claude.sh /path/to/bin
#
# Run after every `brew upgrade --cask claude-code`.

set -euo pipefail

readonly EXPECTED_TEAM_ID="Q6L2SF6YDW"  # Anthropic PBC

binary="${1:-$(command -v claude || true)}"

if [[ -z "$binary" || ! -e "$binary" ]]; then
  echo "error: claude binary not found" >&2
  echo "usage: $0 [path-to-claude]" >&2
  exit 1
fi

# 1. Cryptographic verification. codesign exits non-zero on any failure:
#    bad signature, broken cert chain, or modified code pages.
if ! codesign --verify --strict --verbose=2 "$binary" >/dev/null 2>&1; then
  echo "FAIL: codesign verification failed for $binary" >&2
  codesign --verify --strict --verbose=2 "$binary" >&2 || true
  exit 2
fi

# 2. Team ID pin.
team_id="$(codesign -dv --verbose=4 "$binary" 2>&1 \
           | awk -F= '/^TeamIdentifier/{print $2}')"

if [[ "$team_id" != "$EXPECTED_TEAM_ID" ]]; then
  echo "FAIL: Team ID '$team_id' != expected '$EXPECTED_TEAM_ID'" >&2
  echo "      this binary is not signed by Anthropic PBC" >&2
  exit 3
fi

echo "OK  signature valid, Team ID=$team_id (Anthropic PBC)"

# 3. Clear quarantine xattr. Safe only after checks above pass.
if xattr "$binary" 2>/dev/null | grep -q '^com\.apple\.quarantine$'; then
  if ! xattr -d com.apple.quarantine "$binary" 2>/dev/null; then
    sudo xattr -d com.apple.quarantine "$binary"
  fi
  echo "OK  quarantine cleared"
fi