Sometimes, strange things happen on Macs, and the reasons and solutions are far from obvious.

You discover that you need an old app, which came on a disk image. When you try to run its installing app from that disk image, it crashes. You can’t copy the installer from the disk image onto your startup volume, because the files that it needs to install aren’t visible and couldn’t move with it. What’s the problem, and how to solve it?

This is only likely to happen in Sierra or later, and results from a change in the way that Gatekeeper works.

From macOS 10.12 onwards, Gatekeeper runs some additional checks when you first try to run any app. If the app is on a mounted unsigned disk image, or an ISO optical disk image, or in your Downloads folder or a Zip archive, and is marked with the quarantine flag, then Gatekeeper forces that app to be launched from a semi-random hidden folder.

This is to prevent perfectly good signed apps from being subverted to run malicious code from that disk image, etc., and is App Translocation.

The solution, adopted by almost every developer who supplies software outside the App Store (it doesn’t apply to App Store apps, which are in any case installed directly into /Applications), is one of the following:

• the developer signs the disk image,
• the developer supplies the app in a signed Installer package,
• the developer changes the method of installation so that it doesn’t require you to run an installer app,
• the user moves the app to another location, such as the main Applications folder, before running it.

If this is an old, pre-Sierra installer, you may find that the developer now provides an updated version which uses one of the first three solutions. If you can’t, and need to install from the original download, you should try copying its contents, including any hidden folders containing payload for its installer, into a folder in Applications, and running it from there. Be absolutely certain that it doesn’t contain any malicious payload before doing that.

There is another workaround which you can try if all else fails: before mounting the disk image, or extracting the archive, etc., remove the quarantine flag from it, using the command tool xattr, or my free xattr editor xattred (from Downloads above). You must do that before processing the image/archive in any way. When you decompress a Zip archive which bears a quarantine flag, that flag is propagated to every single file within its contents: removing the flag from each of those is extremely tedious.

Removing a quarantine flag is a serious step. If it works, it prevents Gatekeeper from performing a full check on the image/archive and its contents, which could let malware slip through. It also confirms that the code signing of applications only applies to the data forks of files contained within the app bundle – something that I will discuss in another article slightly later today.

The best solution for all other software which you want to install from outside the App Store is simple: don’t try running it from its disk image or anywhere else. Just drop it straight into your Applications folder, and it shouldn’t be forced to undergo App Translocation.

Finally, one tip for developers and support staff: if a user provides a crash report which gives the app as running from a weird folder, it’s not because they have strange disk habits, but because they ran the app in translocation. Get them to install it properly first, and chances are the crash will resolve.