Escaping macOS quarantine for SQLite extensions

sqlpkg is a package manager for SQLite, like npm for JavaScript or pip for Python.

With the new 0.2.0 release, it helps to escape quarantine on macOS and tells exactly which extension to load. There are also some nice features for package authors.

'which' command

To load an extension into SQLite after installing it with sqlpkg, you'll need the path to the extension file. Run the which command to see it:

sqlpkg which nalgeon/stats

Use this path to load the extension with a .load shell command, a load_extension() SQL function, or other means. See this guide for details:

How to Install an SQLite Extension

De-quarantine extension files on macOS

By default, macOS disables unsigned binaries and prevents extensions from loading in SQLite. To solve this problem, you typically run a command like this:

xattr -d /path/to/extension.dylib

But now sqlpkg automatically removes installed extensions from the operating system quarantine, so you can use them right away.

Latest version support

This feature is intended for package authors.

Previously, you had to explicitly specify the version number in the package spec file. Now sqlpkg supports the latest version for GitHub-hosted packages. It will automatically resolve the version to the latest GitHub release. For example:

    "owner": "nalgeon",
    "name": "stats",
    "version": "latest" // resolves automatically
    // ...


This feature is intended for package authors.

To have sqlpkg validate asset checksums, host the checksums.txt file along with the asset files. For example:

The contents of checksums.txt should match the standard POSIX shasum output (using the SHA-256 algorithm):


That's it! At this point, I'm pretty happy with the core sqlpkg feature set.

Download sqlpkg 0.2.0

★ Subscribe to keep up with new posts.