Hello,
I'm investigating an unexpected com.apple.macl extended attribute while preparing a macOS application for Developer ID signing.
I have observed the attribute in two places:
On the root of an application bundle, where the recorded 72-byte attribute value changed during testing.
On a Developer ID provisioning profile, where a 72-byte com.apple.macl value is present before signing.
I also created a minimal Xcode reproducer that independently demonstrated the unexpected attribute behavior.
I have not established which process creates or modifies the attribute, or whether its presence affects code-signing integrity.
My questions are:
Is this expected macOS behavior for app bundles and provisioning profiles?
What is the recommended supported method to identify which system component creates or modifies this attribute?
How should developers handle this situation when preparing and validating Developer ID signed applications?
I would prefer to understand the cause rather than remove or suppress the attribute without knowing its security implications.
Thank you.