15

I'm having trouble on a Ventura macOS 13.0 system where a number of files on my disk have been tagged with a seemingly emtpy xattr called com.apple.provenance. I would not ordinarily concern myself with this, but it's causing an issue where Syncthing is failing to sync due to (I think) that particular xattr being unrecognized on an older Monterey 12.6.1 system.

I've tried to delete this annoying attribute using xattr -d com.apple.provenance /path/to/file but the attribute does not get removed, despite no error message being output. Adding sudo to the command does not make any difference.

Does anyone know anything more about this mysterious attribute and how we can destroy it? I've filed an issue over on the syncthing-macos github repo and posted to the Syncthing forum as well.

update: While it does not answer the original question, the issue that led to my asking it has been resolved. Syncthing developer (Jakob Borg) kindly released v1.22.2-rc.2 which fixes the root cause of the metadata issue in #8657. I'm able to successfully sync again on Ventura!

Improve this question
6
  • 1
    Similar question here apple.stackexchange.com/questions/449773/…
    – Gilby
    Commented Nov 5, 2022 at 22:54
  • Can you not configure SyncThing just to treat the attribute like any other? I use Resilio Sync, which can be set to either sync individual xattrs or ignore them.
    – benwiggy
    Commented Nov 6, 2022 at 9:38
  • There seems to be something problematic about the new com.apple.provenance. I have it set on two (not all) of apps updated since Ventura upgrade. It is set on the app itself and ALL files within the app package. Not set on any documents, etc. The only method of deleting (and only reported by one person) is to move the file somewhere else and move it back.
    – Gilby
    Commented Nov 7, 2022 at 1:31
  • @benwiggy Yes apparently you can however that hasn't solved the issue, yet.
    – luckman212
    Commented Nov 7, 2022 at 18:11
  • Duplicate. I've answered the one who asked additionally why the new xattr has no value. Here
    – Artiphishle
    Commented Apr 4, 2023 at 7:09

7 Answers 7

Reset to default
10

For me, as of 2023-09-95, using macOS 13.5, the com.apple.provenance FILE extended attribute can indeed be removed using Terminal.app with

xattr -d com.apple.provenance FILE

If you see this fail to remove the attribute, validate that terminal.app is granted Full Disk Access permission in Privacy & Security system settings.

Not so with other terminals

However, in my testing, the above command does not work with these other terminals:

Given that the interaction of (xattr with Apple's Terminal.app) is different from the interaction of (xattr with OTHER_TERMINAL_EMULATOR), we can tell something is afoot. But what?

Hypotheses

  1. There is some difference in code or settings of the terminal emulator. Perhaps Terminal.app "does something right" that the others do not. (Note: this isn't persuasive to me.)

  2. While there is nothing substantively different about the terminal emulators themselves, there are metadata differences: Terminal.app is code signed. In this hypothesis, xattr looks at the permissions of the calling process (as determined by code signing and related security measures) to decide if certain attribute modifications are allowed. (Note: this seems highly plausible.)

Lastly, a pedagogical note. Above, I intentionally used the word 'interaction', because I want to illustrate how this change in phrasing makes a difference when exploring possible causes. We should not just think about one component; we should consider how the parts interact.

Improve this answer
3
  • Just adding my 0.02c - I just retried with Terminal as well as iTerm2 and Warp, on macOS 13.6, and got the same result: the com.apple.provenance xattr does not get removed.
    – luckman212
    Commented Sep 24, 2023 at 14:37
  • Well that's crazy.
    – keithpjolley
    Commented Nov 1, 2023 at 1:51
  • This answer helped me. iTerm2 didn't work but the default terminal app did work for me to delete the xattr. Didn't have to disable SIP for what I was trying to do. My guess is you can go to Settings and allow iTerm2 to do similar things, but was easy enough to use term for this!
    – shaunakde
    Commented Nov 30, 2023 at 7:56
7

Ventura introduces a new extended attribute com.apple.provenance, used to mark successful clearance of quarantine. It’s protected by SIP too.

https://eclecticlight.co/2023/03/13/ventura-has-changed-app-quarantine-with-a-new-xattr/

xattr has no value: it's like a boolean flag, indicates the clearance from quarantine, no value necessary.

xattr deletion:

If you have a reason to delete the flag, you can try variation 1 which worked for me, best if not many files or if you have same kind of files (script)

  1. move code out from files and paste into new ones (avoiding critical operations)
  2. move the file/directory elsewhere and back, and avoid b)the file/folders away and back
  3. ⚠️ disable SIP* – not recommended

*System Integrity Protection

also found: Duplicate

Improve this answer
0
0

To briefly answer the question in the title: com.apple.provenance appears to be an undocumented attribute from Apple. The attribute can be removed like this:

xattr -d com.apple.provenance FILE
Improve this answer
7
  • 4
    If you'd read the question carefully, you would have come across the 2nd paragraph where I wrote: "I've tried to delete this attribute using xattr -d com.apple.provenance /path/to/file but the attribute does not get removed"
    – luckman212
    Commented Jan 19, 2023 at 13:16
  • 1
    @luckman212 I did read the question carefully, and that command indeed removes the attribute, however it did not solve your specific issue due to the reasons you give in the update. For users that just want to know what the attribute is for and how it can be removed the question itself is confusing (see for example the comment by @Raining).
    – Rob van der Leek
    Commented Jan 19, 2023 at 17:21
  • 2
    Can confirm the attribute is not removed by xattr -d, even with sudo, so your answer is still incorrect. Presenting it as 'undocumented' hardly answers the question of what it does either. That, we already know.
    – Andy Griffiths
    Commented Jan 19, 2023 at 17:39
  • 1
    @RobvanderLeek You're confusing two completely different xattr's— com.apple.provenance cannot be altered by xattr, while com.apple.quarantine can. My question is not and never was about the quarantine attribute.
    – luckman212
    Commented Jan 20, 2023 at 19:04
  • 5
    I was able to delete com.apple.provenance using Terminal, but not with iTerm2. Same exact syntax in this answer. source (in the comments): eclecticlight.co/2023/03/13/…
    – northben
    Commented Mar 30, 2023 at 0:36
0

I just encountered these xattrs myself which wouldn't delete initially. In my case, the files were symlinks and I just needed to add the -s flag to xattr to make it operate on the symlinks instead of following them. xattr -ds com.apple.provenance /path/to/symlink

Improve this answer
0

Very late, but this "solution" may be useful for others, such as myself, who found this topic from a search engine. I used the following "technique" to remove extended attributes from files without disabling SIP. I was having trouble removing the com.apple.provenance extended attribute. Using Terminal.app over iTerm2.app made no difference for me on MacOS Sonoma 14.2.1. I also did not have another native volume available to me at the time to try the solution available at Eclectic Light Company. All I had at the time was two VMs available to me on my Mac - one Linux, one Windows. I used the Linux VM to provide the additional volume to use. It may be tacky, but this was a quick and painless solution for me, given my options at the time.

  1. Copy the files from the Mac to a Linux server with sftp.
  2. Delete the files from the Mac with rm.
  3. Copy the files from the Linux server to the Mac with sftp.
  4. Delete the files from the Linux sever with rm.

Of course, there are many other options for copying, moving, and deleting. And the Windows VM would almost certainly have sufficed. (But if I used the Windows VM, I may have wound up with file permissions of -rwxrwxrwx and not -rw-r--r--, not that this would be a big issue to correct.)

Improve this answer
0

The thing is you can delete this attribute with any terminal using command:

$ xattr -d com.apple.provenance FILE

But the application you use to start a shell must have Full Disk Access permission in Privacy & Security.

Improve this answer
2
  • 1
    Thanks! This will make a great edit to the main voted answer. On which version of macOS was this tested? Where precisely was the file located?
    – bmike ♦
    Commented Jul 2 at 15:38
  • macOS 14.5. I've stumbled across this behavior in the file location in application bundle in ~/Applications. Probably you will not be able to do it somewhere in /usr
    – Denis Bazhenov
    Commented Jul 3 at 13:26
0

That flag documents quarantine clearance and IMO shouldn’t be messed with.

What happens [… is …] the same until the moment that quarantine is cleared, when macOS now attaches a new extended attribute (xattr) of type com.apple.provenance to the file. This contains an 11-byte binary reference unique to that quarantine event, and may be protected by SIP to make it persist and prevent it from being stripped

Instead, focus on fixing your tools that can’t adapt to this change. The sync tool had a bug / feature and the fix is to update the tool to relax seeing quarantine clearance metadata as a reason to abort a sync. Great work by the OP and team to identify and fix this.

The “current latest release” is v1.27.9 but this should be fixed in v1.22.2

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .