13

I'm having trouble on a Ventura macOS 13.0 system where a number of files on my disk have been tagged with a seemingly emtpy xattr called com.apple.provenance. I would not ordinarily concern myself with this, but it's causing an issue where Syncthing is failing to sync due to (I think) that particular xattr being unrecognized on an older Monterey 12.6.1 system.

I've tried to delete this annoying attribute using xattr -d com.apple.provenance /path/to/file but the attribute does not get removed, despite no error message being output. Adding sudo to the command does not make any difference.

Does anyone know anything more about this mysterious attribute and how we can destroy it? I've filed an issue over on the syncthing-macos github repo and posted to the Syncthing forum as well.

update: While it does not answer the original question, the issue that led to my asking it has been resolved. Syncthing developer (Jakob Borg) kindly released v1.22.2-rc.2 which fixes the root cause of the metadata issue in #8657. I'm able to successfully sync again on Ventura!

Improve this question
6
  • 1
    Similar question here apple.stackexchange.com/questions/449773/…
    – Gilby
    Nov 5, 2022 at 22:54
  • Can you not configure SyncThing just to treat the attribute like any other? I use Resilio Sync, which can be set to either sync individual xattrs or ignore them.
    – benwiggy
    Nov 6, 2022 at 9:38
  • There seems to be something problematic about the new com.apple.provenance. I have it set on two (not all) of apps updated since Ventura upgrade. It is set on the app itself and ALL files within the app package. Not set on any documents, etc. The only method of deleting (and only reported by one person) is to move the file somewhere else and move it back.
    – Gilby
    Nov 7, 2022 at 1:31
  • @benwiggy Yes apparently you can however that hasn't solved the issue, yet.
    – luckman212
    Nov 7, 2022 at 18:11
  • Duplicate. I've answered the one who asked additionally why the new xattr has no value. Here
    – faebster
    Apr 4 at 7:09

4 Answers 4

Reset to default
6

Ventura introduces a new extended attribute com.apple.provenance, used to mark successful clearance of quarantine. It’s protected by SIP too.

https://eclecticlight.co/2023/03/13/ventura-has-changed-app-quarantine-with-a-new-xattr/

xattr has no value: it's like a boolean flag, indicates the clearance from quarantine, no value necessary.

xattr deletion:

If you have a reason to delete the flag, you can try variation 1 which worked for me, best if not many files or if you have same kind of files (script)

  1. move code out from files and paste into new ones (avoiding critical operations)
  2. move the file/directory elsewhere and back, and avoid b)the file/folders away and back
  3. ⚠️ disable SIP* – not recommended

*System Integrity Protection

also found: Duplicate

Improve this answer
2
  • btw the badge with 1 new comment of yours won't disappear even after multiple page reloads, will also delete this comment after acknowledged
    – faebster
    Apr 4 at 13:02
  • feel free to ask on Ask Different Meta about the badge bugs.
    – bmike ♦
    Apr 4 at 13:59
3

For me, as of 2023-09-95, using macOS 13.5, the com.apple.provenance FILE extended attribute can indeed be removed using Terminal.app with

xattr -d com.apple.provenance FILE

Not so with other terminals

However, in my testing, the above command does not work with these other terminals:

Given that the interaction of (xattr with Apple's Terminal.app) is different from the interaction of (xattr with OTHER_TERMINAL_EMULATOR), we can tell something is afoot. But what?

Hypotheses

  1. There is some difference in code or settings of the terminal emulator. Perhaps Terminal.app "does something right" that the others do not. (Note: this isn't persuasive to me.)

  2. While there is nothing substantively different about the terminal emulators themselves, there are metadata differences: Terminal.app is code signed. In this hypothesis, xattr looks at the permissions of the calling process (as determined by code signing and related security measures) to decide if certain attribute modifications are allowed. (Note: this seems highly plausible.)

Lastly, a pedagogical note. Above, I intentionally used the word 'interaction', because I want to illustrate how this change in phrasing makes a difference when exploring possible causes. We should not just think about one component; we should consider how the parts interact.

Improve this answer
2
  • Just adding my 0.02c - I just retried with Terminal as well as iTerm2 and Warp, on macOS 13.6, and got the same result: the com.apple.provenance xattr does not get removed.
    – luckman212
    Sep 24 at 14:37
  • Well that's crazy.
    – keithpjolley
    Nov 1 at 1:51
0

To briefly answer the question in the title: com.apple.provenance appears to be an undocumented attribute from Apple. The attribute can be removed like this:

xattr -d com.apple.provenance FILE
Improve this answer
6
  • 4
    If you'd read the question carefully, you would have come across the 2nd paragraph where I wrote: "I've tried to delete this attribute using xattr -d com.apple.provenance /path/to/file but the attribute does not get removed"
    – luckman212
    Jan 19 at 13:16
  • 1
    @luckman212 I did read the question carefully, and that command indeed removes the attribute, however it did not solve your specific issue due to the reasons you give in the update. For users that just want to know what the attribute is for and how it can be removed the question itself is confusing (see for example the comment by @Raining).
    – Rob van der Leek
    Jan 19 at 17:21
  • 2
    Can confirm the attribute is not removed by xattr -d, even with sudo, so your answer is still incorrect. Presenting it as 'undocumented' hardly answers the question of what it does either. That, we already know.
    – Andy Griffiths
    Jan 19 at 17:39
  • 1
    @luckman212 I indeed used the wrong attribute in my answer and (deleted) comment. I was however able to remove a com.apple.provenance attribute with xattr -d on macOS 13.1 (sudo not needed). If no one can verify this and there remain cases where it's not possible to remove the attribute on the latest macOS, I will delete my answer completely.
    – Rob van der Leek
    Jan 22 at 12:39
  • 3
    I was able to delete com.apple.provenance using Terminal, but not with iTerm2. Same exact syntax in this answer. source (in the comments): eclecticlight.co/2023/03/13/…
    – northben
    Mar 30 at 0:36
0

I just encountered these xattrs myself which wouldn't delete initially. In my case, the files were symlinks and I just needed to add the -s flag to xattr to make it operate on the symlinks instead of following them. xattr -ds com.apple.provenance /path/to/symlink

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .