Now that we’re approaching half time in Ventura’s cycle, it’s good that we’re still discovering new features that Apple forgot to mention at WWDC last June. This article outlines how macOS 13 has changed the process of app quarantine, with the addition of a new extended attribute to track the origin of quarantined apps in their provenance.
Clearing quarantine
What used to happen when a file was downloaded using Safari or another app that supports quarantine, was that an extended attribute of type com.apple.quarantine was added to the downloaded file. This contains the quarantine flag itself, indicating whether it’s set or has been cleared, the time of its attachment, the app or agent that attached the flag, and a UUID reference to an entry in the QuarantineEvents database at ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2.
Read more at eclecticlight.co