Re: [platform-dev] MacOS .dmg vs .tar.gz

[Alex Blewitt <alex.blewitt@xxxxxxxxx>]

On 11 Nov 2020, at 07:28, Liviu Ionescu <ilg@xxxxxxxxxx> wrote:

On Wed, 11 Nov 2020 at 05:31, Marc-Andre Laperle <malaperle@xxxxxxxxx> wrote:

I see the same behavior with the tar.gz, it adds the attribute.

But it starts ok.

Then what's the point? Why tar.gz is evil and "should be avoided at all cost"?

Since in the latest EPP run we already have both .dmg and .tar.gz, why not make public links in the download pages to both and let the user choose?

I downloaded eclipse-committers-2020-12-M2-macosx-cocoa-x86_64.{dmg,tar.gz} and both of the downloaded archives had the com.apple.quarantine bit, as expected.

Upon loading, I doubled clicked on both.

The tar.gz expanded using Archive Utility, the dmg mounted in Volumes.

√ Downloads % xattr eclipse-committers-2020-12-M2-macosx-cocoa-x86_64.*

eclipse-committers-2020-12-M2-macosx-cocoa-x86_64.dmg: com.apple.metadata:kMDItemDownloadedDate

eclipse-committers-2020-12-M2-macosx-cocoa-x86_64.dmg: com.apple.metadata:kMDItemWhereFroms

eclipse-committers-2020-12-M2-macosx-cocoa-x86_64.dmg: com.apple.quarantine

eclipse-committers-2020-12-M2-macosx-cocoa-x86_64.tar: com.apple.quarantine

Note that the .dmg also had the ‘where from’ dialog that the .tar.gz did not. I suspect this is because the information was on the .tar.gz, but when uncompressed, the ‘where from’ bit was lost. It is possible that this is the field is used to display the dialog (“Are you sure”).

When mounting the .dmg image, the quarantine bit is not present on the Eclipse.app. However, it is present on the one expanded from the .tar.gz download.

√ Downloads % open eclipse-committers-2020-12-M2-macosx-cocoa-x86_64.*                            √ Downloads % xattr Eclipse.app                                                                   com.apple.quarantine

√ Downloads % xattr /Volumes/Eclipse/Eclipse.app/                                                 √ Downloads %                                                                                     

When dragging it from the volume mount, the quarantine bit is added again. Running it shows this dialog, which identifies the download location.

When opening the one from the .tar.gz I am presented with the following:

So the TL;DR is that using a .dmg will show the user the information from the kMDItemWhereFrom, while using a .tar.gz will not maintain that. Furthermore, the user will still have to open the archive to get at the Eclipse application.

Therefore the .dmg is strictly better here, and provides an easy way to drag-and-drop to the Applications folder in the same way that almost all other macOS applications work.

On macOS, the .dmg approach is strictly better experience than the .tar.gz approach, so continuing to use this makes sense to me.

(Note that if the archive was .tgz instead of .tar.gz then some of these problems go away; it copies the correct wherefrom attributes and shows the right name. However the .tar.gz name is strictly worse than .tgz.)

Alex