Archives combine untrusted bytes, file names, metadata, and compressed output. Archi therefore validates both what an archive declares and what extraction actually creates before payload files reach your destination.
This page describes implemented controls and their limits. It is not a claim of formal verification or an independent security audit. The repository document links each control to its source and tests.
Threat model and boundaries
Archi treats archive contents, entry names, declared sizes, links, 7-Zip listing output, and extracted files as untrusted. The WebView displays archive metadata, loaded a page at a time, and progress; Rust owns process execution, filesystem traversal, validation, and installation. The main window has a narrow Tauri permission set.
Archi trusts the installed application, macOS, the current user account, and the bundled 7-Zip executable. The 7-Zip child process is not an operating-system sandbox. A vulnerability in 7-Zip could execute before Archi can validate its output.
Extraction architecture
- List7-Zip reads the untrusted archive and emits technical metadata.
- Validate declarationsRust rejects unsafe paths, excessive depth and count, and normalized-name collisions.
- Leave links outLink entries are excluded from what the engine is asked to extract.
- StageExtraction writes into a job-owned staging directory, not the destination.
- MonitorRust checks actual expanded bytes and kills the child process when the configured ceiling is crossed.
- Validate outputThe real filesystem tree is checked for links, special files, escapes, limits, and collisions.
- InstallConflicts and source overlap are preflighted, then validated files are moved into the destination.
Listing and metadata validation
Archi lists before extracting. Its strict technical-list parser rejects lines it cannot represent rather than guessing. Declared paths must be relative and use safe components; depth is limited to 100 components; and the entry ceiling is 1,000,000. Case folding and Unicode normalization detect names that would collide on common filesystems. Declared expansion is compared with the configured limit, and an unknown or excessive total requires explicit approval. A compressed tarball is listed by piping the decompressed stream into a second engine process, without an intermediate file, and listing can be cancelled. Validation rules.
Links
Archi never recreates a link from an archive. Link entries are excluded from the request sent to the engine. A symbolic link is skipped and counted in the result. A hard link that names a regular file in the same archive is written by Archi itself as a separate copy of that file; one that names anything else is skipped. The staged output is still checked independently, so a link created despite this fails the extraction. Link handling.
Private staged extraction and actual-output limits
7-Zip writes into a job-owned payload directory. Entries are named to the engine in a private list file with wildcard matching disabled. While the process runs, Rust periodically measures actual output and terminates the child if the configured byte ceiling is exceeded. It checks once more after the engine exits. The completed tree is then inspected directly; symbolic links, hard links, special files, unsafe paths, excessive depth, excessive entry count, and normalized collisions are rejected. Extraction monitor and security tests.
Staging is placed on the volume that will receive the result. When that is not the volume holding the system temporary folder, staging is a hidden folder beside the destination, removed when the job ends or at the next launch after a crash.
Destination and archive integrity
Before installation, Archi resolves conflicts and refuses to overwrite the source archive. Each validated file is moved from staging to its final name with a rename that refuses to replace an existing file; replacement keeps a backup and restores it if installation fails. When a move is not possible the file is copied beside its destination first. Destination installation source.
exFAT and FAT volumes offer no rename that refuses to replace. There Archi checks that the name is free and then renames, which is not atomic.
Archive modifications operate on a temporary copy beside the original. Archi detects if the source changes during the operation, validates the rewritten archive, preserves a backup during replacement, synchronizes the result, and reports a recoverable copy if commit fails. Replacing an existing file inside an archive, an existing output file, or an existing split-volume set each requires confirmation. Archive rewrite source.
Passwords
Passwords are sent to the engine on standard input, never in process arguments. The password for the archive you have open is kept in memory until you close it, so you are not asked again; it is never written to disk. Password transport.
macOS quarantine
When a source archive carries com.apple.quarantine, Archi
propagates it to staged output, installed files, previews, dragged-out
files, and rewritten archives. If the destination filesystem explicitly
reports that extended attributes are unsupported, propagation is skipped
because the filesystem cannot store the attribute. Permission, read-only,
storage, and other I/O failures remain fatal.
Quarantine source and regression test.
Open, Quick Look, and drag-out
Open and Quick Look extract one selected regular file into an owner-only preview cache. Archi requires a declared size within the configured limit, validates the actual extracted file, and blocks directories, symbolic links, special files, executable extensions, executable permission bits, scripts, Mach-O, PE, and ELF payloads. File contents are never sent through the WebView. Preview validation.
Dragging a file to Finder is an extraction of that one file rather than an Open: it uses the extraction size limit, allows scripts and executables, and keeps the archive's quarantine attribute. Archi never launches it. Preview and drag-out copies are removed when Archi quits and at the next launch.
These restrictions apply to Open and Quick Look. They do not prevent a user from extracting an executable and launching it manually.
Quitting during an operation
While an operation is running, Quit, logout, and closing the window are refused until you choose to stop it. An operation that is already installing its result is allowed to finish first.
What this design cannot guarantee
- It cannot sandbox or eliminate vulnerabilities in 7-Zip, macOS, Tauri, WebKit, or other dependencies.
- It is not antivirus software and does not classify malware or guarantee that another application can safely open a document.
- Resource use during listing and explicitly approved unbounded extraction cannot be fully constrained.
- Files cannot be installed atomically without replacement on filesystems that offer no exclusive rename, such as exFAT.
- ACLs, ownership, extended attributes, hard-link relationships, and platform-specific metadata do not round-trip across every format or filesystem.
- Signing, notarization, hardened runtime, Content Security Policy, and narrow permissions reduce risk but do not create an App Sandbox around 7-Zip.
See the known limitations for the broader product boundary.
Reporting vulnerabilities
Please use GitHub private vulnerability reporting rather than opening a public issue. Archi aims to acknowledge reports within five business days and provide an initial assessment within ten business days. Full instructions are in the security policy.