The quarantine ‘flag’ is a small item of metadata, an extended attribute, which was introduced with macOS 10.5 in 2007 primarily for apps and executable code, to determine which should be passed to Gatekeeper to undergo its full first run checks. Ever since, quarantine flags have also been set on other files, including documents, but until recently those have been largely ignored.

Then in Mojave users started to experience problems opening some documents using certain apps, which apparently resulted from more widespread setting of quarantine flags. As well as being applied to downloaded documents, sandboxed apps had started setting quarantine flags on every document they saved, and sometimes had merely opened. This caused problems when trying to open those documents with some other apps. For example, if Preview is set to open all PDFs by default, changing that on a single PDF could block other apps from opening it.

In response to this, I developed two utilities, Pratique and Sandstrip, which can solve these frustrating problems.

Pratique changes document (and only document) quarantine flags by setting its quarantine flag to ‘off’, indicating that quarantine has been cleared. This should be sufficient to work through any problems caused by them. It’s careful not to apply this to apps or other code bundles, so shouldn’t interfere with Gatekeeper performing full first run checks on freshly downloaded apps.

Sandstrip works differently, in that it looks to see if any quarantine flag is of the type normally applied by a sandboxed app, with the resource key kCFURLQuarantinePropertiesKey. All those that it finds it then removes completely.

In Catalina, Apple has changed this system again with its new com.apple.macl extended attribute, which is used to enforce per-document privacy protection. This is more complex, and those attributes can’t be removed so easily because they’re protected by SIP. Problems with document quarantine have changed, although all these flags can still occasionally cause trouble.

In the event that a document’s com.apple.macl attribute is giving you grief, replace the original document with a copy, as making copies unlocks SIP protection, allowing you to remove that attribute using my extended attribute utility xattred, if that’s still required.

You can find more details of these behaviours and problems in this article about document quarantine, and this one about com.apple.macl extended attributes. Pratique, Sandstrip and xattred are now all Universal Apps and available from their Product Page.