Signature checks are complex. On first run with a quarantine flag, they include the contents of the Resources folder, but seldom do after that.
General account of xattrs, their storage, types, tools for working with them, and common problems.
One of the great hidden features in macOS, xattrs are rarely used by anyone outside Apple, largely because they are so poorly supported by functions calls and tools.
A simple and concise example of a page from the documentation which we, as a community, could readily produce for macOS. Fancy giving us a hand?
They’re responsible for determining Gatekeeper’s checks, contain Finder information, and much more. With a new free tool too.
If you wanted to mess someone’s Mac up, you could go into their system files and change things around when they were out at lunch.