OSX extended metadata can corrupt bundles

[epaulson10]

Hi, this is not a bug in OPA, but we noticed today that if we downloaded a bundle from Google Cloud Storage's web ui, edited it, and re-uploaded it, the bundle would not load. This is because we are Mac users, and OSX (at least currently) creates tarballs (using /usr/bin/tar) with extended attributes in AppleDouble format (see this Stack Overflow. When we downloaded the tarball via the web UI, OSX tagged it with some extended attributes (com.apple.quarantine) because it probably recognizes Rego files as script files. When the tarball is created, the Mac tar command (by default) causes the tarball to contain hidden AppleDouble files that look like ._original-name-of-my-policy.rego, which OPA tries to read (because Golang's archive/tar, as far as I know, doesn't handle this Apple-specific format).

Again, this is not a bug in OPA, and I don't know if there is a clean, non-hacky way to workaround this in OPA anyway. I just wanted to put it out there in case anyone sees this and searches something like "Open Policy Agent com.apple.quarantine".

I believe that you can disable these files when creating a tarball using the --no-mac-metadata command, setting the COPYFILE_DISABLE=1 environment variable before calling tar, or deleting the attributes from the files using xattr. I personally just downloaded them using gsutil cp instead of Chrome, and they did not get tagged with the com.apple.quarantine attribute that way.

Cheers,

Erik Paulson

[epaulson10]

Closing this as answered, as I just wanted to throw this information out there, and not clutter the issue list for opa.

[charlieegan3]

Thanks Erik 👍

[anderseknert]

Thanks for sharing!