On macOS 13, a new file attribute "com.apple.provenance" sometimes gets set on source and build files. There is very little information available about what this signifies. The problem for the build is that we run "xattr" to remove any extended attributes in many copy rules, and this can sometimes fail with this new attribute.

Specifically, we have files being copied in a <module>-copy rule using the install-file macro, where the same rule is also limiting permissions to remove write access (through chmod 444). Then we have the automatically generated copy rule to copy such a file further into the exploded image, which also uses the install-file macro. On macosx, the install-file macro consists of both copy and an xattr to remove unwanted extended attributes. The first copy+xattr works normally, but for the second copy, the file is now write protected, and the xattr will fail.

It would help if we could understand what the new attribute was about, but regardless of this, we need to figure out a way to avoid trying to run xattr on write protected files when we know they will be.