`entire enable` fails due to malware check

[dipree]

Originally posted by @etburke on Feb 12, 2026 in Discussion #307 (Q&A)

I installed entire using brew, but when I try running entire enable on a repo I see this dialog and it fails with zsh: killed entire enable.

---

Migrated from GitHub Discussions

[linear]

from evis:

Will investigate this

[toothbrush]

Hey @etburke, sorry to hear you're having trouble. You mention installing via Homebrew, could you please share the output of a few diagnostic commands?

# what's installed?
brew info entireio/tap/entire
command -v entire
ls -lah "$(command -v entire)"

# is it properly notarized?
spctl -a -vvv -t install "$(command -v entire)"

# how about the Homebrew binary?
spctl -a -vvv -t install /opt/homebrew/Caskroom/entire/0.4.5/entire

# just in case, for bonus points:
echo "$PATH"

Hopefully that can shed some light on the issue!

[etburke]

Hi @toothbrush ,

Here you go:

brew info entireio/tap/entire
==> entire ✔: 0.4.3
https://github.com/entireio/cli
Installed
/opt/homebrew/Caskroom/entire/0.4.3 (15.3MB)
  Installed on 2026-02-12 at 08:48:00
From: https://github.com/entireio/homebrew-tap/blob/HEAD/Casks/entire.rb
==> Name
entire
==> Description
CLI for Entire
==> Artifacts
entire (Binary)
completions/entire.bash (Bash Completion)
completions/entire.zsh (Zsh Completion)
completions/entire.fish (Fish Completion)

command -v entire
/opt/homebrew/bin/entire

ls -lah "$(command -v entire)"
lrwxr-xr-x@ 1 tburke  admin    42B Feb 12 08:48 /opt/homebrew/bin/entire -> /opt/homebrew/Caskroom/entire/0.4.3/entire

spctl -a -vvv -t install "$(command -v entire)"
/opt/homebrew/bin/entire: accepted
source=Notarized Developer ID
origin=Developer ID Application: Entire Inc (JN5KA88ZK5)

echo "$PATH"
/Users/tburke/.bun/bin:/Users/tburke/google-cloud-sdk/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/Users/tburke/.local/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/opt/pmk/env/global/bin:/Applications/iTerm.app/Contents/Resources/utilities

[toothbrush]

Weird, that all looks completely reasonable! Especially the bit about /opt/homebrew/bin/entire: accepted makes it look like the signature is fine. I'll think about this tonight, but in the meantime i notice you're running an older build. brew update && brew upgrade entireio/tap/entire should get you to https://github.com/entireio/cli/releases/tag/v0.4.5. I don't expect that to fix the issue though ☹️

[toothbrush]

One other thing to look at might be:

$ xattr -l /opt/homebrew/bin/entire
com.apple.quarantine: 0xxx;699xxxx;Homebrew\x20Cask;BB488E2D-xxxx-xxxx-xxxx-xxxx

That's what mine shows, but it still happily executes 🤔

[etburke]

I think you might be on to something:

xattr -l /opt/homebrew/bin/entire
com.apple.provenance:
com.apple.quarantine: 0381;698e043f;;4B7BE033-B985-4FC7-8E9F-DB3CCEC8A9D1

That empty value for provenance seems like a problem.

[toothbrush]

xattr -l /opt/homebrew/bin/entire
com.apple.provenance:
com.apple.quarantine: 0381;698e043f;;4B7BE033-B985-4FC7-8E9F-DB3CCEC8A9D1

That empty value for provenance seems like a problem.

The workaround for this is usually to remove the provenance extended attribute. Basically xattr -d com.apple.provenance BINARY. Beware that the files in /opt/homebrew/bin are symlinks, and i don't recall if you need to readlink $(command -v entire) and operate on the actual binary, or whether you can just xattr -d com.apple.provenance $(command -v entire).

Fair warning is that this can be a bit of a mess to get right. For instance, myself i use Alacritty terminal, and have to enable a few security settings in the "Privacy & Security" preferences pane (Full Disk Access, Developer Tools, App Management from memory), then making sure to completely restart all terminal app instances.

Sorry about this – this is rather an achilles heel on distributing macOS apps via Homebrew generally.

I'll leave this issue open until you confirm the workaround, but my feeling is that this is more of a Homebrew/macOS problem. I do say that with a degree of uncertainty because i don't want to be unnecessarily shifting blame. Let us know how you go and thank you for your patience.

[ashtom]

@etburke We are closing this issue for now, but feel free to re-open if this is still blocking you.