{
  "$type": "site.standard.document",
  "contributors": [
    {
      "did": "did:plc:jdrw76zcbtriweixutdr5enn",
      "displayName": "nyan"
    }
  ],
  "description": "macOS was SIGKILL-ing python .so files from homebrew. the code signatures looked fine. the real culprit was a kernel-managed extended attribute that silently survives sudo xattr -d.",
  "path": "/posts/2026-03-14-provenance-xattr/",
  "publishedAt": "2026-03-14T22:00:00.000000Z",
  "site": "at://did:plc:6guvlunah45ryrpsaf2mfr4l/site.standard.publication/self",
  "tags": [
    "debugging",
    "macos"
  ],
  "title": "com.apple.provenance: the xattr you can't remove"
}