Why do so many files now have quarantine and other extended attributes, although they’re not apps, and may never have left that Mac?
com.apple.macl
When someone reports the most recent version of Safari that will open their webarchives is 18.6, and that’s the only version that you find can’t open some webarchives. You’ll be only too familiar with the culprit.
New version of this GUI utility for inspecting and editing extended attributes, for High Sierra and later.
Which extended attributes are attached to downloaded archives and apps? How do they fit in with provenance tracking?
What’s blocking you from saving that document: permissions, ACLs, privacy, an extended attribute, or what? Here are some clues.
Quarantine flags first appeared in 2007. This explains how they work, what they do, and the differences between app and document quarantine.
All about xattrs: their origin, where they’re stored, how they’re named and typed, how to find and work with them, and their common problems.
Who’s been ghost notarizing other people’s apps, and is Catalina wasting time to check whether shell scripts are notarized?
Some files rely on these to work properly. What happens when you share such a file using your iCloud account? The answer isn’t simple, but here are full details.
The behaviour of quarantine flags, SIP flags, and the mysterious new com.apple.macl attribute, which never ceases to puzzle.
The Eclectic Light Company 