PreviewThis site is being prepared. Downloads and test results are not published yet.
Security

Verify a download

Check any arcmac app in five minutes, without trusting this page.

Every command below runs in Terminal on your own Mac. Replace AppName with Rings, Pulse or Clips, and run them in the folder holding the file. If a result does not match what is described, do not open the app and write to [email protected].

The checks

In the order to run them: before opening the DMG, then after installing.

Download checksum

The file you downloaded is byte-for-byte the one published on its app page.

shasum -a 256 ~/Downloads/AppName.dmg
Matches the SHA-256 value in the download box on the app page.

Apple notarization

Apple scanned this build for malware and approved it.

spctl -a -vvv -t install ~/Downloads/AppName.dmg
Shows: accepted, source=Notarized Developer ID.

Notarization ticket stapled

The approval travels with the download, so it opens on a Mac that is offline.

xcrun stapler validate ~/Downloads/AppName.dmg
Shows: The validate action worked!

Developer ID signature

The app is signed by its developer and has not been altered since.

codesign --verify --deep --strict --verbose=2 /Applications/AppName.app
Ends with: valid on disk, and satisfies its Designated Requirement.

Hardened runtime

macOS blocks code injection and other tampering while the app runs.

codesign -dv --verbose=4 /Applications/AppName.app 2>&1 | grep flags
The flags line includes: runtime.

Entitlements review

The special permissions built into the app are limited to what it needs.

codesign -d --entitlements - /Applications/AppName.app
Lists every entitlement the app carries.

What these mean

Signature

A Developer ID signature ties the app to the developer who built it and breaks if anyone changes a file afterwards.

Notarization

Apple scans the build for known malware and records its approval. macOS checks that record the first time you open the app.

Checksum

A SHA-256 value identifies a file exactly. If yours matches the one published on the app page, the file was not changed on the way to you.

Hardened runtime

Stops other code from being injected into the running app.

Results for each app

Test results are recorded on each app page when the build is published.