Escaping macOS quarantine for SQLite extensions

sqlpkg is a package manager for SQLite, like npm for JavaScript or pip for Python.

With the new 0.2.0 release, it helps to escape quarantine on macOS and tells exactly which extension to load. There are also some nice features for package authors.

'which' command

To load an extension into SQLite after installing it with sqlpkg, you'll need the path to the extension file. Run the which command to see it:

sqlpkg which nalgeon/stats

/Users/anton/.sqlpkg/nalgeon/stats/stats.dylib

Use this path to load the extension with a .load shell command, a load_extension() SQL function, or other means. See this guide for details:

How to Install an SQLite Extension

De-quarantine extension files on macOS

By default, macOS disables unsigned binaries and prevents extensions from loading in SQLite. To solve this problem, you typically run a command like this:

xattr -d com.apple.quarantine /path/to/extension.dylib

But now sqlpkg automatically removes installed extensions from the operating system quarantine, so you can use them right away.

Latest version support

This feature is intended for package authors.

Previously, you had to explicitly specify the version number in the package spec file. Now sqlpkg supports the latest version for GitHub-hosted packages. It will automatically resolve the version to the latest GitHub release. For example:

{
    "owner": "nalgeon",
    "name": "stats",
    "version": "latest" // resolves automatically
    // ...
}

Checksums

This feature is intended for package authors.

To have sqlpkg validate asset checksums, host the checksums.txt file along with the asset files. For example:

https://github.com/nalgeon/sqlean/releases/latest/download/checksums.txt
https://github.com/nalgeon/sqlean/releases/latest/download/sqlean-linux-x86.zip
https://github.com/nalgeon/sqlean/releases/latest/download/sqlean-macos-arm64.zip
https://github.com/nalgeon/sqlean/releases/latest/download/sqlean-macos-x86.zip
https://github.com/nalgeon/sqlean/releases/latest/download/sqlean-win-x64.zip

The contents of checksums.txt should match the standard POSIX shasum output (using the SHA-256 algorithm):

6bc24897dde2c7f00cf435055a6853358cb06fcb5a2a789877903ebec0b9298d  sqlean-linux-x86.zip
e3de533fdc23e0d953572c2b544ecc2951b890758af0a00b5a42695ae59ee7ac  sqlean-macos-arm64.zip
e3de533fdc23e0d953572c2b544ecc2951b890758af0a00b5a42695ae59ee7ac  sqlean-macos-x86.zip
f0d2d705bbe641bf2950a51253820e85de04373b7f428f109f69df1d85fa0654  sqlean-win-x64.zip

That's it! At this point, I'm pretty happy with the core sqlpkg feature set.

Download sqlpkg 0.2.0

★ Subscribe to keep up with new posts.