{"id":38787,"date":"2023-03-16T15:38:01","date_gmt":"2023-03-16T19:38:01","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=38787"},"modified":"2026-04-14T10:33:05","modified_gmt":"2026-04-14T14:33:05","slug":"ventura-adds-com-apple-provenance","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2023\/03\/16\/ventura-adds-com-apple-provenance\/","title":{"rendered":"Ventura Adds com.apple.provenance"},"content":{"rendered":"

Howard Oakley<\/a> (Hacker News<\/a>):<\/p>\n

\n

What happens in macOS Ventura is essentially the same until the moment that quarantine is cleared, when macOS now attaches a new extended attribute (xattr) of type com.apple.provenance<\/code> to the file. This contains an 11-byte binary reference unique to that quarantine event, and may be protected by SIP to make it persist and prevent it from being stripped.<\/p>\n

[…]<\/p>\n

Defeating any SIP protection is simple for the user: when an app with a protected com.apple.provenance<\/code> xattr is copied to another volume, the SIP protection breaks, and the xattr can be deleted in the normal way. However, code that tries to remove that xattr while it’s still protected may fail, and that has resulted in problems reported in Ventura by some users.<\/p>\n

[…]<\/p>\n

Randy has also identified the binary content of this new xattr as containing an 8-byte integer that is that app’s primary key in the provenance_tracking<\/code> table in \/var\/db\/SystemPolicyConfiguration\/ExecPolicy<\/tt>. This would enable macOS to check the previous cdhash and other information about the app, perhaps to determine whether fuller checks are required by Gatekeeper, when the app is launched on subsequent occasions. That would make it a key part of Ventura’s new extended Gatekeeper checks.<\/p>\n<\/blockquote>\n\n

Ethan Schoonover<\/a>:<\/p>\n

A small macOS improvement idea:<\/p>

When I hit command-i on a macOS app, it would be nice if the app would include the website for the developer\/application in the info or comments field.<\/p>

I’ve forgotten about some apps that I’ve installed (i.e. i have no idea what they are even for) and would like to easily pop open the site for them without launching and hoping the URL is in help or about (or just manually searching online).<\/p><\/blockquote>\n\n

Howard Oakley<\/a>:<\/p>\n

\n

While it’s clear that macOS Ventura is now tracking the provenance of apps that have completed their first run with the quarantine flag set, this provenance tracking doesn’t (yet) appear to be used to tailor or modify the checks run by Gatekeeper. It’s possible that provenance tracking isn’t yet mature enough to be used for that purpose, or that it’s intended for something else. Perhaps Ventura 13.3 will reveal more.<\/p>\n<\/blockquote>\n\n

Previously:<\/p>\n