Gate Keeper uses the quarantine functionality that has been present for a while to annoy users after they download files.
You can examine a file's quarantine information by reading its
com.apple.quarantine extended attribute. Here I do this for a never before launched
.app copied from a downloaded
$ xattr -l Butler.app/
The first value is the quarantine state (i.e. the interesting part). It's followed by a hex-encoded Unix timestamp (in this case:
date -r 0x50697c0e results in
Mo 1 Okt 2012 13:18:38 CEST), the name of the application creating the file, and a unique identifier (UUID) of the original quarantined item. This last one is inherited by extracted files from their container, in this case, the
The first part of the extended attribute is the quarantine state. When downloaded and never opened, this file has
0002, possibly indicating a web download.
When you double-click the app, but abort when asked for confirmation, it's
0022 (probably to record earlier execution without approval), and when you confirm execution once, it's
0062. In that case, you won't be asked again afterwards. This looks a lot like an octal or hexadecimal representation of a bit field, with the third
4 value bit indicating approval, and the third
2 value bit indicating prior execution.
By resetting this value to the original state after download, you can re-enable the Gate Keeper protection. Just read the value after opening (
xattr -p com.apple.quarantine <filename>) and replace it with the same value, without the "this was already approved" bits (e.g.
xattr -w com.apple.quarantine 0002;[rest of the previous value] <filename>).