Hi So Apple Support sent me here ... (Case: 102237195769 if anyone has access) My entire file system seems to be tagged with "com.apple.provenance" tags ... they're everywhere drwxr-xr-x@ 3 jon staff 96 20 Jan 2023 .vs-kubernetes com.apple.provenance 11 drwxr-xr-x@ 5 jon staff 160 21 Jun 2023 .vscode com.apple.provenance 11 drwxr-xr-x 12 jon staff 384 28 Feb 00:17 .vscode-server drwxr-xr-x@ 3 jon staff 96 11 Dec 2022 .warp com.apple.provenance 11 -rw-r--r--@ 1 jon staff 691 29 Nov 19:14 .wget-hsts com.apple.provenance 11 -rw-r--r--@ 1 jon staff 361 11 Dec 15:55 .zprofile com.apple.provenance 11 -rw-r--r--@ 1 jon staff 300 23 Jul 2023 .zprofile.bak com.apple.provenance 11 -rw-r--r--@ 1 jon staff 136 4 Dec 2022 .zprofile.pysave com.apple.provenance 11 -rw------- 1 jon staff 16802 27 Feb 22:20 .zsh_history drwx------@ 7 jon staff 224 21 Feb 14:28 .zsh_sessions com.apple.provenance 11 -rw-r--r--@ 1 jon staff 1681 24 Feb 18:24 .zshrc Now I don't know if this is related to the CrossOver (aka Wine) problem we're experiencing, or if it's a coincidence .. however I'd like to understand why every file that gets created ends up with this tag. When installing a Bottle in CO none of the shortcuts appear within the CO App .. which is where we started all of this. jon@ziggy ~ % cd Library/Application\ Support jon@ziggy Application Support % ls -lad@ CrossOver drwxr-xr-x 7 jon staff 224 28 Feb 02:02 CrossOver jon@ziggy Application Support % cd CrossOver jon@ziggy CrossOver % ls -la@ total 784 drwxr-xr-x 7 jon staff 224 28 Feb 02:02 . drwx------+ 184 jon staff 5888 28 Feb 08:56 .. drwxr-xr-x 3 jon staff 96 28 Feb 01:59 Bottles -rw-------@ 1 jon staff 239584 28 Feb 01:59 cxfixes.xml com.apple.provenance 11 -rw-------@ 1 jon staff 256 28 Feb 01:59 cxfixes.xml.sha256 com.apple.provenance 11 -rw-------@ 1 jon staff 155031 28 Feb 02:02 gstreamer-1.0-registry.x86_64.bin com.apple.provenance 11 drwxr-xr-x 5 jon staff 160 28 Feb 01:59 tie Problem Summary The Desktop shortcut keeps randomly vanishing from the Finder Favourites section Every file is tagged as com.apple.provenance and despite trying to clear the tags (which does work) they re-appear moments later. At this stage .. I've run out of ideas, Codeweavers support has gone silent and Apple Support said "try developer.apple.com" ... sigh Last night I flattened my M1 MBP and reinstalled. All looked good until Migration Assistant got involved and then it migrated across whatever is doing this as the problem persists.