Archives combine untrusted bytes, file names, metadata, and compressed output. Archi therefore validates both what an archive declares and what extraction actually creates before payload files reach your destination.
This page describes implemented controls and their limits. It is not a claim of formal verification or an independent security audit. The repository document links each control to its source and tests.
Threat model and boundaries
Archi treats archive contents, entry names, declared sizes, links, 7-Zip listing output, and extracted files as untrusted. The WebView displays paginated metadata and progress; Rust owns process execution, filesystem traversal, validation, and installation. The main window has a narrow Tauri permission set.
Archi trusts the installed application, macOS, the current user account, and the bundled 7-Zip executable. The 7-Zip child process is not an operating-system sandbox. A vulnerability in 7-Zip could execute before Archi can validate its output.
Extraction architecture
- List7-Zip reads the untrusted archive and emits technical metadata.
- Validate declarationsRust rejects unsafe paths, links, depth, count, and normalized-name collisions.
- StageExtraction writes into a job-owned temporary directory, not the destination.
- MonitorRust checks actual expanded bytes and kills the child process when the configured ceiling is crossed.
- Validate outputThe real filesystem tree is checked for links, special files, escapes, limits, and collisions.
- InstallConflicts and source overlap are preflighted, then regular files are installed through destination-local temporary files.
Listing and metadata validation
Archi lists before extracting. Its strict technical-list parser rejects lines it cannot represent rather than guessing. Declared paths must be relative and use safe components; links are disabled; depth is limited to 100 components; and the entry ceiling is 1,000,000. Case folding and Unicode normalization detect names that would collide on common filesystems. Declared expansion is compared with the configured limit, and an unknown or excessive total requires explicit approval. Source and validation rules.
Private staged extraction and actual-output limits
7-Zip writes into a job-owned temporary payload directory. While the process runs, Rust periodically measures actual output and terminates the child if the configured byte ceiling is exceeded. It checks once more after the engine exits. The completed tree is then inspected directly; symbolic links, hard links, special files, unsafe paths, excessive depth, excessive entry count, and normalized collisions are rejected. Extraction monitor and security tests.
Destination and archive integrity
Before installation, Archi resolves conflicts and refuses to overwrite the source archive. Each regular file is copied to a temporary file beside its final destination. New files use no-clobber persistence; replacement keeps a backup and restores it if installation fails. Destination installation source.
Archive modifications operate on a temporary copy beside the original. Archi detects if the source changes during the operation, validates the rewritten archive, preserves a backup during replacement, synchronizes the result, and reports a recoverable copy if commit fails. Archive rewrite source.
macOS quarantine
When a source archive carries com.apple.quarantine, Archi
propagates it to staged output, installed files, previews, and rewritten
archives. If the destination filesystem explicitly reports that extended
attributes are unsupported, propagation is skipped because the filesystem
cannot store the attribute. Permission, read-only, storage, and other I/O
failures remain fatal.
Quarantine source and regression test.
Open and Quick Look restrictions
Open and Quick Look extract one selected regular file into an owner-only preview cache. Archi requires a declared size within the configured limit, validates the actual extracted file, and blocks directories, links, special files, executable extensions, executable permission bits, scripts, Mach-O, PE, and ELF payloads. File contents are never sent through the WebView. Preview validation.
These restrictions apply to Open and Quick Look. They do not prevent a user from extracting an executable and launching it manually.
What this design cannot guarantee
- It cannot sandbox or eliminate vulnerabilities in 7-Zip, macOS, Tauri, WebKit, or other dependencies.
- It is not antivirus software and does not classify malware or guarantee that another application can safely open a document.
- Resource use during listing and explicitly approved unbounded extraction cannot be fully constrained.
- ACLs, ownership, extended attributes, and platform-specific metadata do not round-trip across every format or filesystem.
- Signing, notarization, hardened runtime, Content Security Policy, and narrow permissions reduce risk but do not create an App Sandbox around 7-Zip.
See the known limitations for the broader product boundary.
Reporting vulnerabilities
Please use GitHub private vulnerability reporting rather than opening a public issue. Archi aims to acknowledge reports within five business days and provide an initial assessment within ten business days. Full instructions are in the security policy.