What causes OS X to mark a folder as Quarantined?

Solution 1:

The com.apple.quarantine extended attributes probably have nothing to do with the issues you are having with Apache. They are part of the file quarantine feature that was added in 10.5:

File Quarantine is a new feature in Leopard designed to protect users from trojan horse attacks. It allows applications which download file content from the Internet to place files in “quarantine” to indicate that the file could be from an untrustworthy source. An application quarantines a file simply by assigning values to one or more quarantine properties which preserve information about when and where the file come from.

When the Launch Services API is used to open a quarantined file and the file appears to be an application, script, or other executable file type, Launch Services will display an alert to confirm the user understands the file is some kind of application.

The com.apple.quarantine extended attributes can be added when:

• You download a file with a quarantine-aware application, like Safari, Chrome, or Transmission. For a few applications like Firefox, quarantine is forced to be enabled in /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/Exceptions.plist.
• You extract an archive with an application like Archive Utility or OS X's tar or zip.
• You create a file with an application that has LSFileQuarantineEnabled set to true in the Info.plist.

The extended attributes have fields for quarantine status, a timestamp, the agent that originated the quarantine event, and sometimes a UUID:

$ xattr -p com.apple.quarantine Worksheet_v10.4.pdf
0042;51ea420b;Safari.app;5E2F48EA-1356-4D57-BFEA-571EE8ADC08C
$ date -r 0x51ea420b
Sat Jul 20 10:53:47 EEST 2013
$ sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 .dump|grep 5E2F48EA-1356-4D57-BFEA-571EE8ADC08C
INSERT INTO "LSQuarantineEvent" VALUES('5E2F48EA-1356-4D57-BFEA-571EE8ADC08C',395999627.472166,'com.apple.Safari','Safari','http://images.apple.com/server/docs/Worksheet_v10.4.pdf',NULL,NULL,0,NULL,'http://images.apple.com/',NULL);

The first field is a hexadecimal bitfield, where for example the seventh bit (2^6 or 0x40) usually gets set after you open a file for the first time.

You can delete the extended attributes with xattr -dr com.apple.quarantine ~/Sites, but it won't probably have any effect on Apache. It will however disable the "is a file downloaded from the Internet" dialogs.