General account of xattrs, their storage, types, tools for working with them, and common problems.
xattr
Marks a folder or file as being protected by SIP. Widespread among kernel extensions, and Apple’s bundled apps.
This UTF-8 string contains the Gatekeeper score, the system time of download, downloading agent, and the event UUID. Can force a full Gatekeeper check.
Indicates the encoding used for the contents of the text file, e.g. UTF-8, Macintosh, Windows-1252. Used in many text documents.
They may not cause many problems, but xattrs are both very useful and extensively used by macOS and third-party products. It’s time to discover more, and document them.
Even a lean and simple High Sierra system has many xattrs of many types, and plenty of files still have ‘resource forks’. Plus details of some important xattrs used by Apple’s system files.
They’re almost invisible, but surprisingly widely used. xattrs come in very many different types, and contain valuable information. Here are results from analysing most of a Sierra startup volume.
There was an extremely annoying minor bug in window resizing. It’s now fixed.
Unique xattr browser and editor now compatible with both Sierra and High Sierra.
NSDocument is based on the data stored in the data fork of a file. Could it be modified to work with xattrs instead? And dipping my toes into NSTableView.
The Eclectic Light Company 