Anarchive
Secure
How to report a security problem, which betas get fixes, and how you can tell your copy of Anarchive is genuine.
Reporting a problem
Please report a security problem to feedback@getanarchive.com
with Security in the subject. Say which beta you have
(Anarchive › About Anarchive), what you found and how to make it
happen. Please don’t post it on GitHub, where reports are public, and don’t send private pictures.
There is no bounty. The same address is in
/.well-known/security.txt.
Which betas get fixes
Only the latest beta. Each beta stops working 90 days after the day it was built, and Anarchive › Check for Updates… brings the next. Your libraries and originals are left as they are.
How you know it’s genuine
- Notarised by Apple. Each beta is signed with the developer’s Apple certificate and notarised, so macOS checks it before it first opens.
- Signed updates. Updates come through Sparkle. The list of betas and each update are signed with an EdDSA (Ed25519) key, and Anarchive checks both against the key built into it before installing.
- Checked downloads. Downloads come over HTTPS from
dl.getanarchive.com, and the front page gives each zip’s SHA-256. - Little to attack. The app has no permission from macOS to open a network connection. Two small helpers can: Sparkle’s, for updates, and one that downloads the optional models you ask for. There is no account and no server of Anarchive’s own. The privacy page has everything it does with the internet.
What it’s made of
Everything inside Anarchive that someone else made, besides macOS itself. The full notices are in Help › Acknowledgements….
| Component | Used for | Licence |
|---|---|---|
| Sparkle 2.10.0 | In-app updates and their signatures | MIT, with parts under BSD and zlib |
| RED R3D SDK runtime | N-RAW video | RED’s licence, included unmodified |
| MI-GAN (Places2 512) | Clean Up | MIT |
| SigLIP 2 and DINOv2 model structures, without weights | Visual search and sky, once their weights are downloaded | Apache 2.0 |
| Lensfun lens database | Lens corrections | CC BY-SA 3.0 |
| GeoNames | Place names | CC BY 4.0 |
| Natural Earth | The map | Public domain |
| OpenNGC | The deep-sky catalogue | CC BY-SA 4.0 |
| Constellation boundaries, from Astropy | Naming the constellation a picture is in | BSD 3-Clause |
Downloaded only if you choose, in Settings › Models, each under its own licence, named there and in the notices:
| Model | Used for | Licence |
|---|---|---|
| SAM 2.1 Small, Apple’s Core ML conversion | Better object selection | Apache 2.0 |
| Depth Anything V2 Small, Apple’s Core ML conversion | Make Spatial Photo | Apache 2.0 |
| DINOv2 ViT-S/14 with its ADE20K head | Sky for any picture | Apache 2.0 |
| SigLIP 2 Base/16-224 weights | Search by what pictures look like | Apache 2.0 |
Every AI model, bundled or downloaded, is listed with its licence in Help › Acknowledgements….
This site uses one thing of someone else’s: the Jost typeface, served from the site, under the SIL Open Font Licence 1.1.