xattr: com.apple.cscachefs, iCloud Drive app tag

Type: com.apple.cscachefs
Subtypes: none
Serialisation: none
Data type: binary data without any embedded text. Normally 70 bytes in size.
Example: <be66b51a d6396864 d6545991 fbdb73c6 8399b396 04110000 003c046e 5a000000 00cd686f 15000000 00e0e803 00000000 00014029 916ef5f6 f56a63ec a73b1083 531dcf85 16b6&gt
macOS: Sierra, High Sierra
System use: none
App use: on larger components of all apps imported from another source via iCloud
Document use: none
Other usage: on larger components of apps saved to iCloud from a different Mac

Purpose: unknown
Information:
Added to code and other larger files within applications bundles which have transited through iCloud storage (iCloud Drive) from another system. Not added to smaller files such as property lists, or to folders within bundle. Not seen on the system which originally supplied them to iCloud, only on other systems accessing the app bundle.

Because xattrs are not used in app signature-making or -checking, these xattrs do not affect the normal use of the app. The Gatekeeper quarantine flag is not set on apps copied from iCloud; this may be a non-functional tracking tag in lieu.

Named as a portmanteau from Core Services, cache, File System?

Tools: xattred, xattr

Links:

Original page: 2018-01-28
Last modified: 2018-01-28