macOS Ventura 13.0 sync fails due to com.apple.provenance metadata

[luckman212]

update: This should be fixed once v1.22.2 is released, scroll down for details...

Since upgrading one of my Macs to Ventura 13.0, my folder will no longer sync (getting stuck on a piece of undocumented metadata called com.apple.provenance

I have tried removing the xattr with sudo xattr -d com.apple.provenance /path/to/file but that isn't working either.

Google has nothing about this really... anyone else running into this? Using syncthing-macos 1.22.0-1

see related post on ST forum

[xor-gate]

Thanks for the report, I have old hardware which doesn't run Ventura. So I need to figure out a way to reproduce this or dig up some documentation. I think it is some sort of extra security mechanism (again). Probably I need some help from other people with this unfortunately.

[luckman212]

Thanks, I've just posted a question over on AskDifferent as well.

[xor-gate]

Hi @calmh I moved it to the https://github.com/syncthing/syncthing project as it is a Syncthing (macOS build) issue and not part of the syncthing-macos application bundle. Thanks!

[xor-gate]

Moved because it is not an syncthing-macos application bundle problem. But the Syncthing daemon itself with trying to sync xattrs between two devices with macOS Ventura 13.0 and macOS < 13.0. See also the forum.

[calmh]

As noted on the forum, this can be disabled by configuration, unfortunately only by hand editing the config at the moment:

<folder id="..." ...>
  <xattrFilter>
    ...
    <entry match="com.apple.provenance" permit="false"/>
    <entry match="*" permit="true"/>
  </xattrFilter>
</folder>

We might want to look into some sort of default black list per operating system perhaps, in the future.

[xor-gate]

I need to document the note on manual file editing in the FAQ so I transfered the issue back to syncthing-macos.

As noted on the forum, this can be disabled by configuration, unfortunately only by hand editing > the config at the moment:

<folder id="..." ...>
 <xattrFilter>
   ...
 <entry match="com.apple.provenance" permit="false"/>
 <entry match="*" permit="true"/>
 </xattrFilter>
</folder>

We might want to look into some sort of default black list per operating system perhaps, in the > future.

See also
#185 (comment)

I leave this open until I have documented this in the README.md

Thanks @luckman212 for reporting

[xor-gate]

The README.md has been updated with appropiate information. Manual editing is the only way for now. See commit 7fa1d1a

[luckman212]

Adding a note here, regarding somewhat-related bug #8657 (since it relates to syncing xattrs)

[xor-gate]

Note from @luckman212 (here #154 (comment)) copied over here for convience:

Just adding this note here related to debugging going on over at https://forum.syncthing.net/t/com-apple-provenance/19262/17

For anyone who wants to increase the logfile size using the macOS bundle, you can use:

# sets logfile size to 50MB, and keep the last 5 during logrotate 
defaults write com.github.xor-gate.syncthing-macosx Arguments '--log-max-size=52428800 --log-max-old-files=5'

And when you're done debugging, use this to revert things back to default:

defaults delete com.github.xor-gate.syncthing-macosx Arguments

I believe you need to fully quit the Syncthing app after each of these changes (not just stop/start the service) for it to take effect.

Thanks @luckman212 !

[xor-gate]

Commenting on your findings:

I believe you need to fully quit the Syncthing app after each of these changes (not just stop/start the service) for it to take effect.

Yes the Arguments are loaded only on startup. Not when changed.

[luckman212]

@xor-gate v1.22.2-rc.1 was pushed that aims to fix this, among other things. Is it possible for me to compile my own bundle to test? I have Xcode 14.1 but I don't have a Developer account so I can only sign locally.

[luckman212]

@xor-gate Answered my own question... and I'm happy to report that this pre-release build has fixed the original issue for me. 🚀 So hopefully once the upstream release drops we can all benefit.

For anyone else who's curious: here are the steps I figured out in order to build a pre-release. It was confusing at first because the default repo branch is develop which is very far out of date from the latest release. I had to clone the 1.22.1-1 branch and build from that in order to get it to work (a full clone and separate git checkout would probably work fine too).

Steps

1. Clone the repo & some prereqs

git clone --depth 1 --branch v1.22.1-1 https://github.com/syncthing/syncthing-macos
cd syncthing-macos
git submodule update --init

2. Change version strings

vi syncthing/Scripts/syncthing-resource.sh

• update SYNCTHING_VERSION (removing the v):

SYNCTHING_VERSION="1.22.2-rc.1"

• update CFBundleShortVersionString in Info.plist:

vi syncthing/Info.plist

3. find & export your developer account / codesigning identity:

security find-identity -v -p codesigning
export SYNCTHING_APP_CODE_SIGN_IDENTITY="Apple Development: you@domain (XXXXXXXXXX)"

4. build

make release

5. look in syncthing-macos/Build/Products/Release/ for your newly minted Syncthing.app

[xor-gate]

syncthing-macos only ships releases no -rcs. The README.md includes some build and release management instructions. I will include this build instructions into the readme when I have some spare time. Thanks for reporting the issue is resolved.

[luckman212]

Not fully out of the woods yet on this one... syncthing/syncthing#8667

[luckman212]

Compiled a build this morning based on v1.22.2-rc.2 and this is now 100% fixed for me 👍

[xor-gate]

Good, we need to wait for the v1.22.2 release window on 6 dec. Then we can close this ticket. Thanks for your effort!

[luckman212]

Still looking good, on 1.22.2-rc.3 now and all is working well.

[xor-gate]

Syncthing macOS is now shipping with release v1.22.2 (see commit bf62e12). Only the auto-updater is broken for some unknown reason, you can wait or download the signed/secure DMG.