Remove quarantine taint from files on macOS

remove-taint.sh

#!/usr/bin/env bash
#
# Usage: remove-taint.sh <filename>
#
# Remove the annoying mark-of-the-web taint xattrs from a file.
# For some reason macOS ignores a removexattr for these attributes,
# but the taint does not survive a pipe copy and rename.
#
# Note that the com.apple.macl xattr (Apple's analogue of the mark-of-the-web)
# is special, and the system will track it across activity on the data by the
# process that created the file. If you run this script and the attribute is
# not removed, try again from a different terminal.
#
set -euo pipefail

for p in "$@" ; do
    perm="$(stat -f '%Lp' "$p")"    # low-order permission bits, e.g., 644
    t="$(mktemp "$p".XXXXXXXXXXXX)" # in the same directory as the source
    cat "$p" > "$t"

    # Preserve the access bits and modification time from the original.
    chmod "$perm" "$t"
    touch -m -r "$p" "$t"

    # Note: It's not sufficent to just rename, because macOS appears to track
    # the quarantine through the filename even if it's replaced. By removing
    # the original file first, we keep the metadata for the untainted copy.
    # Seriously, Apple, WTAF.
    rm -f -- "$p"
    mv -f -- "$t" "$p"
done