bypassing Gatekeeper via symlinks

tl;dr i found that when macOS&rsquo;s Archive Utility extracts a ZIP archive containing symlinks, the symlinks themselves do not inherit the com.apple.quarantine extended attribute. when a user executes the symlink, Gatekeeper checks the symlink&rsquo;s quarantine status (absent) rather than resolving the symlink and checking the target&rsquo;s status (present). this allows unsigned/un-notarized…