xattr and provenance

[aredigg]

I have a script that updates some files that are downloaded from the internet, for these they are given the extended attribute of com.apple.provenance, this is Apples way of protecting us from downloading. Which is fine. I can use the included Apple Terminal, and I can use xattr -d -rs to remove this, but for some reason this will not work from ghostty. Anyone have an idea how to solve this?

[Kreeblah]

I'm wondering this, too. That attribute also gets set on files copied from CD ISOs. It's odd having to pop up the macOS terminal to clear this attribute.

[rrotter]

I just noticed the same issue. Interstingly I'm seeing this problem with Ghostty but not Terminal or iTerm, so this isn't just an issue of only working properly with Apple's Terminal. I see these unwanted attributes all over the place in my home directory dating back to the beginning of the year when I started using Ghostty.

• Uninstalling+reinstalling doesn't help
• In System Settings > Privacy & Security, I have Full Disk Access disabled for all three terminals, so that's probably not the issue either

[taylrfnt]

I am not super familiar with using xattr (my knowledge mostly ends at knowing it exists), but if there's a good way to get a consistent test file with the attribute to test with I am happy to try and research this. I tried to download some ISO images, scripts, and miscellaneous files from various hosts and did not manage to find any with the xattr applied (only the usual com.apple.quarantine xattr)

[Kreeblah]

One way to get a test file is by copying a file off of a mounted ISO.

For example, I was able to reproduce this by downloading the FreeDOS 1.3 ISO from https://www.ibiblio.org/pub/micro/pc-stuff/freedos/files/distributions/1.3/official/FD13-LiveCD.zip, extracting it from the ZIP file, and mounting it. After that, I ran cp /Volumes/FD13-LiveCD/COMMAND.COM . and xattr COMMAND.COM, which gave me both com.apple.provenance and com.apple.quarantine.

[taylrfnt]

Awesome, I'll try this out tomorrow & report back!

[taylrfnt]

I was able to successfully get a file with the com.apple.provenance xattr assigned with the method above.

A few observations:

1. The attribute is assigned an empty (or perhaps "invisible" - I didn't bother to look at the output any deeper) value:

> xattr -p com.apple.provenance ~/COMMAND.COM


>

2. I can only seem to find this attribute assigned on a machine enrolled in MDM. My personal test machine does not have the com.apple.provenance attribute set on the exact same file when downloaded following the same steps above.
3. There's only two terminal emulators I've actually been able to successfully remove this attribute with: Terminal.app and Kitty. iTerm2 and Ghostty both successfully run the command with no errors, but don't remove the attribute.

I'll have to start looking into the docs and source for xattr to see if there's any ill-documented behavior, I suppose. I'm intrigued that iTerm2 can't successfully do this either, given their willingness to support almost any feature you can imagine.

[taylrfnt]

Some additional assorted info...

I found some old StackOverflow posts that recommended adding Ghostty (the post was for iTerm, I'm applying it to Ghostty) to the "Developer Tools". That shouldn't be required, since Kitty is NOT on that list for me, but I was in the mood for some testing.

When I tried adding Ghostty into the Developer Tools list and restarted, I started getting an actual error message from xattr:

xattr: [Errno 13]: Permission denied: '/Users/taylor/COMMAND.COM'

That's... strange... to say the least, given that the file is owned by my user:

> ls -l@
[...]
-r-xr-xr-x@ 1 taylor staff 85840 Feb 28 11:51 COMMAND.COM
         com.apple.provenance
         com.apple.quarantine
[...]

After disabling Ghostty's access to Developer Tools, I now see that error persisting across all terminal emulators, including Terminal.app and Kitty. In the meantime, perhaps don't try what I did, haha.

[jasonlyle88]

Looks like this extended attribute is related to MacOS and SIP. I'm was getting this attribute on any new file or directory I was creating with ghostty as well.

See this stack exchange for details: https://apple.stackexchange.com/questions/478422/why-do-iterm2-vscode-on-macos-sequoia-keep-adding-com-apple-provenance-to-my/478430#478430

Once I followed the instructions to go to System Settings > Privacy & Security > Developer Tools, add Ghostty and make sure the toggle was on I had to restart my machine then new files/directories were no longer created with the com.apple.provenance extended attribute and I was also able to remove this extended attribute from other files and directories using the xattr command. Hopefully this helps everyone else as well!

Maybe something to document about the terminal for MacOS users in general?

[taylrfnt]

This is what I tried, and what resulted in my (still) broken setup. Glad it worked for you, though!

I don't think the onus will be on Ghostty to document this, given Apple themselves have not documented this "feature" clearly in their developer or macOS docs, but this discussion is good enough for folks looking for solutions.

[jasonlyle88]

I'm not sure how I managed to skip directly past your post saying almost exactly the same thing mine did. Also glad I got different behavior 😳 So still glad I posted as it worked for me even if it broke you. I may not have tried it if I read your post first!

I also meant to mention that my device isMDM enrolled as well, so it does seem like that is part of this equation.