quarantine extended attribute gets set on every save using macOS Monterey

[shinepixel]

Description

Every time I save a file, the extended attribute com.apple.quarantine gets set for this file:

$ xattr -r file.txt|grep quarantine
file.txt: com.apple.quarantine

This is especially problematic, when editing scripts, because the script cannot run with the attribute set:

$ ./script.sh
-bash: ./script.sh: /usr/bin/env: bad interpreter: Operation not permitted

Interestingly when creating and saving a new file, the attribute is not set. It happens only on subsequent saves.

I do have GateKeeper disabled.

/Applications/CotEditor.app does not have the attribute.

To Reproduce

1. Opening any file
2. Saving the file
3. Open Terminal
4. Check for com.apple.quarantine extended attribute
5. File has attribute set

Expected behavior

File should not have extended attribute set

CotEditor version

4.0.8

macOS version

12.0 Beta (21A5543b)

Additional context

No response

[tiiiecherle]

I am having the same issue.

Additionally if I edit a file with file extension .command e.g. test.command and save macOS says the file is corrupted and asks if I want to move to trash.
If I edit the same file in another editor that does not happen.

Thanks for looking into it.

[1024jp]

Thank you for the report. I have confirmed the phenomenon.
This looks strange, and at the moment, I have no idea why it happens.
Let me have a time.

[1024jp]

I researched this issue and found that the cause is Monterey's system change.
That is, this is a kind of bug by Apple.
For instance, Text Edit.app also have the same issue.
And unfortunately, it is hard to fix by the 3rd party side, because the quarantine extended attribute is one of the security attributes by Apple, which is impossible to edit from CotEditor.
I'll continue trying to find a workaround, but feel it's perhaps better to wait for the fix by Apple.

[GloryAlex]

I found one thing:
After edit and save a .command file by CotEditor, MacOS show attention "the script is created by CotEditor and are you sure to run it", like that:

---

The edit by other editor(e.g., vscode) with no such bug has no such attention too.

[awulf]

I'm experiencing this problem too, making it pretty much unusable to edit bash scripts.
BBEdit gets around it like this: https://www.barebones.com/support/bbedit/quarantine.html
Which seems to work for BBEdit

[rprimmer]

Same issue. I can no longer use CotEditor for any scripting work. :(

The only workaround I've found for editing scripts with CE is to move the script to the /Applications directory. Monterey (12.1) doesn't seem to add to the quarantine attribute on save if the file is in this particular folder.

Alternatively, you need to use a different editor for script files, such as BBEdit or Xcode.

[printmaps]

As workaround the quarantine flag ("com.apple.quarantine") can be manually removed:

Source file has no flag "com.apple.quarantine":
% xattr -l test2-plasma2.zsh
com.apple.TextEncoding: utf-8;134217984
com.apple.lastuseddate#PS: ?#?a

File edited:
CotEditor (4.0.9) ...

New source has now flag "com.apple.quarantine":
~/Plasma-Art % xattr -l test2-plasma2.zsh
com.apple.TextEncoding: utf-8;134217984
com.apple.lastuseddate#PS: ?#?a
com.apple.metadata:kMDLabel_2v5qwirremarxhxf7pup4w7rim: ?)???;??m????????w???uJ??ѩ՘??I?k
?pXCW?/?E?Z?o~k2@.z+??*???{jMt?
com.apple.quarantine: 0086;61dc2843;CotEditor;

Script no longer working/starting:
./test2-plasma2.zsh       
zsh: operation not permitted: ./test2-plasma2.zsh

Workaround: remove flag "com.apple.quarantine" manually:
xattr -d com.apple.quarantine test2-plasma2.zsh

Script working/starting now:
...

Link: https://www.alansiu.net/2021/08/19/troubleshooting-zsh-operation-not-permitted/

[GameParrot]

Building it without sandbox fixed it for me.

[1024jp]

According to my test with macOS 12.3 Beta (21E5206e), this issue will be fixed on macOS 12.3.
Therefore, I do not add extra code to CotEditor for this issue.

[MStraeten]

Issue seems to be back with latest 4.7.2 from apple app store ...

[1024jp]

@MStraeten Thank you for the report. However, I could not reproduce the issue. Do you have any specific conditions to reproduce it?