whence

Sometimes I want to know where I downloaded a file from. Most web browsers store this information in extended attributes, but there isn’t a particularly friendly way to read it. It’s stored differently on each major platform, and on MacOS, it’s not particularly human-readable if you use the “xattr” command to read it:

bash$ xattr -l lufa-LUFA-170418.zip
com.apple.metadata:kMDItemWhereFroms:
00000000  62 70 6C 69 73 74 30 30 A2 01 02 5F 10 3C 68 74  |bplist00..._.<ht|
00000010  74 70 73 3A 2F 2F 63 6F 64 65 6C 6F 61 64 2E 67  |tps://codeload.g|
00000020  69 74 68 75 62 2E 63 6F 6D 2F 61 62 63 6D 69 6E  |ithub.com/abcmin|
00000030  69 75 73 65 72 2F 6C 75 66 61 2F 7A 69 70 2F 4C  |iuser/lufa/zip/L|
00000040  55 46 41 2D 31 37 30 34 31 38 5F 10 29 68 74 74  |UFA-170418_.)htt|
00000050  70 3A 2F 2F 77 77 77 2E 66 6F 75 72 77 61 6C 6C  |p://www.fourwall|
00000060  65 64 63 75 62 69 63 6C 65 2E 63 6F 6D 2F 4C 55  |edcubicle.com/LU|
00000070  46 41 2E 70 68 70 08 0B 4A 00 00 00 00 00 00 01  |FA.php..J.......|
00000080  01 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00 76                       |........v|
00000099
com.apple.quarantine: 0001;59d47dc6;Chromium;AE65E6B1-F0DB-437C-B645-B1C867485050

Therefore, I wrote a utility called whence, which presents the information in a friendlier format:

bash$ whence lufa-LUFA-170418.zip
lufa-LUFA-170418.zip:
  URL         https://codeload.github.com/abcminiuser/lufa/zip/LUFA-170418
  Referrer    http://www.fourwalledcubicle.com/LUFA.php
  Application Chromium
  Date        Tue Oct  3 23:20:54 PDT 2017

whence works on FreeBSD, Linux, MacOS, and Windows. It normally produces output in a colorized, human-readable form. (Set NO_COLOR to avoid using ANSI color in the terminal.) With the option -j or --json, it will produce JSON output instead.

whence supports the XDG Common Extended Attributes on FreeBSD, Linux, and MacOS. On MacOS, it also supports com.apple.quarantine, com.apple.metadata:kMDItemWhereFroms, and com.apple.metadata:kMDItemDownloadedDate. On Windows, it uses the Zone.Identifier alternate data stream.

These attributes are attached to downloaded files by most web browsers, with the notable exception of Firefox on Linux. You can also get curl to attach extended attributes by using the --xattr command-line option.