Type: com.apple.metadata
Subtypes: _kMDItemUserTags
Serialisation: none
Data type: binary property list containing a little UTF-8 text. An NSArray consisting of Strings, each containing a tag name, followed by \n, followed by the colour number (0-7). The array may be empty.
Example: <62706c69 73743030 a1015552 65640a36 080a0000 00000000 01010000 00000000 00020000 00000000 00000000 00000000 0010> «bplist00¡ URed
6 »
macOS: El Capitan, Sierra, High Sierra
System use: almost none
App use: unusual
Document use: more common, depending on the user
Other usage: determined largely by the user

Purpose: contains the names and colours of attached Finder tags
Information:

This does not contain flags to indicate the colour to be shown, but uses a binary Property List which contains colour information. The basic structure of the xattr, in mixed hex and text, is:
bplist00 [named tags with their colour number, or 0 if no colour] 00000000 00000101 00000000 0000 [2 bytes, number of colours + 1] 00000000 00000000 00000000 0000 [2 bytes, length]

Colour numbers used are:

• none, 0
• grey, 1
• green, 2
• purple, 3
• blue, 4
• yellow, 5
• red, 6
• orange, 7.

So the tag name might read Red\n6, or Orange\n7 Green\n2 for two colours, where \n represents the newline character 0a.

When the Finder writes a tag xattr to an item, is also adds a null com.apple.FinderInfo xattr of 32 bytes length, if that xattr is not already present.

An example of two tags in a single xattr:
<62706c69 73743030 a3010203 584f7261 6e67650a 37585965 6c6c6f77 0a355949 6d706f72 74616e74 080c151e 00000000 00000101 00000000 00000004 00000000 00000000 00000000 00000028>
«bplist00£ XOrange
7XYellow
5YImportant (»

Many documents, and some other files, have null tag xattrs, which do not give a tag name or colour. The purpose of these, and which app or tool uses them, is obscure. When tags are removed in the Finder, the entire tag xattr is deleted, so they are not left by the Finder.

Additional examples (given in hex):
62706c69 73743030 a0080000 00000000 01010000 00000000 00010000 00000000 00000000 00000000 0009 null
62706c69 73743030 a1015647 7261790a 31080a00 00000000 00010100 00000000 00000200 00000000 00000000 00000000 000011 grey
62706c69 73743030 a1015747 7265656e 0a32080a 00000000 00000101 00000000 00000002 00000000 00000000 00000000 00000012 green
62706c69 73743030 a1015642 6c75650a 34080a00 00000000 00010100 00000000 00000200 00000000 00000000 00000000 000011 blue
62706c69 73743030 a1015552 65640a36 080a0000 00000000 01010000 00000000 00020000 00000000 00000000 00000000 0010 red
62706c69 73743030 a101584f 72616e67 650a3708 0a000000 00000001 01000000 00000000 02000000 00000000 00000000 00000000 13 orange
62706c69 73743030 a2010257 47726565 6e0a3256 47726179 0a31080b 13000000 00000001 01000000 00000000 03000000 00000000 00000000 00000000 1a green & grey
62706c69 73743030 a2010258 59656c6c 6f770a35 56477261 790a3108 0b140000 00000000 01010000 00000000 00030000 00000000 00000000 00000000 001b yellow & grey
62706c69 73743030 a2010255 5265640a 36564772 61790a31 080b1100 00000000 00010100 00000000 00000300 00000000 00000000 00000000 000018 red & grey
62706c69 73743030 a1015f10 1b506172 616c6c65 6c732076 69727475 616c206d 61636869 6e650a30 080a0000 00000000 01010000 00000000 00020000 00000000 00000000 00000000 0028 Parallels VM, no colour
62706c69 73743030 a1015f10 1f506172 616c6c65 6c732057 696e646f 77732061 70706c69 63617469 6f6e0a30 080a0000 00000000 01010000 00000000 00020000 00000000 00000000 00000000 002c Parallels Windows app, no colour.

Note that the kColor flag in the com.apple.FinderInfo xattr can also be used to set colour tags from within the standard set, but only supports a single colour, not combinations.

Tools: Finder, xattred, tag, xattr
tag is available via Homebrew, MacPorts, and from its Github site.

Unlike other xattrs, Apple provides quite extensive access to and control of tags in the Finder. Interestingly, changing the name of a tag in the Finder’s Preferences dialog changes that name in all existing xattrs, and deleting a tag from the list there deletes the xattr from all files tagged with it. The Finder thus maintains this xattr within the xattr metadata store.

Links: there are several discussions of this xattr, including some specific to their access from different languages, such as Ruby and AppleScript. Among the most useful are two which consider access from the command line:
Boris Herman
Brett Terpstra
See also Inside Finder Tags on this blog.

Original page: 2017-12-26
Last modified: 2017-12-30