This meta ticket tracks implementing a new approach to attribution on macOS, namely "DMG extended attribute" attribution. This approach obsoletes the quarantine DB approach of Bug 1619353.

The technical idea is to deliver Firefox DMGs that have attribution details in an HFS+ extended attribute inside the DMG. This extended attribute can then be read (and potentially cached) at runtime by Firefox.

The tricky technical part is to arrange Firefox DMGs that are both valid and optimized for efficiently modifying the extended attribute as part of Firefox's stub attribution service.

This ticket covers that work and the in-product Firefox client changes required to consume the extended attribute.

We'd best add a test to ensure that macOS installer doesn't lose or otherwise interfere with extended attributes. It might be that staging, which involves an atomic move, does lose extended attributes.