MacOS xattr dilemma

[masterhiggins]

Hi there. I’ve been trying to use xhun ZeroBox on MacOS Monterey and am having trouble with it showing up. At first the AU component validated and showed in logic pro’s plugin manager, but it wouldn’t show up as an instrument to select in the instrument menu. For awhile it let me select it in hostingAU, but now it won’t show anywhere for AU. I’ve tried all kinds of different things, from performing Xattr -xd commands on com.apple.quarantine for the component file to renaming the component to something else and hoping that logic would see it and try to validate it. But nothing helps. Every other xhun plugin works fine in logic. For some reason there’s something permanently broken with the quarantine status of the zerobox component file. I tried to force terminal to show me the current quarantine status of the file, but it mentions that the file com.apple.quarantine doesn’t exist. Does anyone know how I could fix this nightmare? Is there some way to get MacOS to “forget” that it ever saw this damn component file and start off with the default quarantine status? I’ve already been asking xhun support about it, but I’m seeing if anyone had any idea how I could reset the quarantine in such a way that MacOS sees the file again? As of right now even when I unzip the app files and move the component to my computer’s AU plugin folder in Finder MacOS doesn’t even mention that it’s untrusted anymore. It’s like it has memorized that file and will never see it again, even as a malware false flag.

Does anyone have any ideas what could cause this issue?

[Gamma-UT]

I vaguely recall having a problem like this where there was a second attribute blocking the plugin. Unfortunately, I didn't make good notes on it, so can't remember exactly what it was.

If you run the basic xattr command on the file now (no flags, just the path and filename), what does it say? Is it blank or is there another attribute listed?

[masterhiggins]

Thanks for responding. Here's what I get:

When I type this:
xattr ~/Library/Audio/Plug-Ins/Components/ZeroBox.component

I get this:
com.apple.quarantine

When I type this:
xattr com.apple.quarantine ~/Library/Audio/Plug-Ins/Components/ZeroBox.component

I get this:
xattr: No such file: com.apple.quarantine
~/Library/Audio/Plug-Ins/Components/ZeroBox.component: com.apple.quarantine

[Gamma-UT]

With the second command, it's treating the arguments as a list of files, so is looking for file called "com.apple.quarantine". I think the only way to list a bunch of files that have the quarantine attribute set is to pipe the output of xattr to grep. There isn't a flag that just checks for that attribute to my knowledge. The man page is a bit cryptic: https://ss64.com/mac/xattr.html

The blog EclecticLight has some handy background and tool that makes it a bit easier to inspect these things. I think he's also found that moving the offending file/bundle from the system drive to an external volume and back again prevents Gatekeeper from locking the status (this is not something I've had to do but also haven't tried installing anything from Xhun on MacOS for some years): https://eclecticlight.co/2021/12/11/exp ... uarantine/

However, generally this should work:

sudo xattr -r -d com.apple.quarantine /path/to/MyApp.app

Or in this case:

sudo xattr -r -d com.apple.quarantine ~/Library/Audio/Plug-Ins/Components/ZeroBox.component

The sudo should get you past any permissions issues that might prevent the attribute from being cleared, though that might not deal with this "stickiness" issue that I've seen some people refer to.

[masterhiggins]

Thanks. Those didn't work either. It appears I'm experiencing the stickiness issue.

[masterhiggins]

With the second command, it's treating the arguments as a list of files, so is looking for file called "com.apple.quarantine". I think the only way to list a bunch of files that have the quarantine attribute set is to pipe the output of xattr to grep. There isn't a flag that just checks for that attribute to my knowledge. The man page is a bit cryptic: https://ss64.com/mac/xattr.html

The blog EclecticLight has some handy background and tool that makes it a bit easier to inspect these things. I think he's also found that moving the offending file/bundle from the system drive to an external volume and back again prevents Gatekeeper from locking the status (this is not something I've had to do but also haven't tried installing anything from Xhun on MacOS for some years): https://eclecticlight.co/2021/12/11/exp ... uarantine/

However, generally this should work:

sudo xattr -r -d com.apple.quarantine /path/to/MyApp.app

Or in this case:

sudo xattr -r -d com.apple.quarantine ~/Library/Audio/Plug-Ins/Components/ZeroBox.component

The sudo should get you past any permissions issues that might prevent the attribute from being cleared, though that might not deal with this "stickiness" issue that I've seen some people refer to.

Hi again. Do you have any links to discussions about the "stickiness" issue? I can't seem to find any. Maybe I can trace that route. Thanks!

[Gamma-UT]

https://eclecticlight.co/2023/03/13/ven ... new-xattr/

[masterhiggins]

Holy shit I figured out a fix. I have no idea how it works, but....

1. I downloaded the demo and installed it.
2. I downloaded my licensed installer, but didn't just install it.
3. I explored the contents of the DEMO and FULL version .component files. I copied the ZeroBox file from the MacOS folder inside the FULL version and replaced the ZeroBox file in the DEMO version.
4. I installed the library and copy protection file.
5. I relaunch Logic and it validates and opens just fine. I can't believe it!

Thanks though!

[PAK]

5. I relaunch Logic and it validates and opens just fine. I can't believe it!

What this tells you is there's likely to be problems with the contents of the devs full version. Most likely something's wrong with the info.plist.

[masterhiggins]

5. I relaunch Logic and it validates and opens just fine. I can't believe it!

What this tells you is there's likely to be problems with the contents of the devs full version. Most likely something's wrong with the info.plist.

Yeah it might be that. I just had to do the same thing with FilterCult. The demo worked fine, but the full version didn't. Now it works.