Well, that’s interesting. It seems that these files were uploaded with quarantine information pre-applied, which further muddies the waters.
I used Safari to download the DepthAnythingV2SmallF16.mlpackage.zip
file. It gets quarantined, just like you’d expect:
% QQuarantine show DepthAnythingV2SmallF16.mlpackage.zip
DepthAnythingV2SmallF16.mlpackage.zip:
LSQuarantineAgentBundleIdentifier: com.apple.Safari
LSQuarantineAgentName: Safari
LSQuarantineEventIdentifier: C985CDAD-C43C-48A1-A4D8-35F6C9045C83
LSQuarantineIsOwnedByCurrentUser: 1
LSQuarantineTimeStamp: 2025-06-17 12:55:46 +0000
LSQuarantineType: LSQuarantineTypeWebDownload
Note QQuarantine
is a small tool I wrote myself to fetch and display a file’s quarantine info. It’s based on the .quarantinePropertiesKey
URL property API.
If I remove the quarantine and then unpack the file, the contents are still quarantined:
% QQuarantine remove DepthAnythingV2SmallF16.mlpackage.zip
% open DepthAnythingV2SmallF16.mlpackage.zip
% … wait …
% QQuarantine show DepthAnythingV2SmallF16.mlpackage
DepthAnythingV2SmallF16.mlpackage:
LSQuarantineAgentName: Slack
LSQuarantineIsOwnedByCurrentUser: 1
LSQuarantineTimeStamp: 2024-06-24 22:54:32 +0000
LSQuarantineType: LSQuarantineTypeSandboxed
…
But look at the dates. This isn’t my quarantine; this quarantine state is coming from the archive itself.
And if I list the archive I see the tell-tale AppleDouble files:
% unzip -l DepthAnythingV2SmallF16.mlpackage.zip
Archive: DepthAnythingV2SmallF16.mlpackage.zip
Length Date Time Name
--------- ---------- ----- ----
0 06-24-2024 23:48 DepthAnythingV2SmallF16.mlpackage/
279 06-24-2024 23:48 __MACOSX/._DepthAnythingV2SmallF16.mlpackage
617 06-24-2024 23:48 DepthAnythingV2SmallF16.mlpackage/Manifest.json
175 06-24-2024 23:48 __MACOSX/DepthAnythingV2SmallF16.mlpackage/._Manifest.json
…
This is obviously wrong. Apple shouldn’t be shipping software that’s pre-quarantined. I encourage you to file a bug against the Core ML Models webpage. And please post your bug number, just for the record.
Fortunately it’s easy for you to work around this: Download the file, unpack it, and remove the quarantine attributes before integrating it into your codebase.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"