feat(mac): automatically insert ElectronAsarIntegrity into Info.plist (…

…#1279)

package.json

@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "@electron/get": "^1.6.0",
-    "asar": "^3.0.0",
+    "asar": "^3.1.0",
     "cross-spawn-windows-exe": "^1.2.0",
     "debug": "^4.0.1",
     "electron-notarize": "^1.1.1",

src/mac.js

@@ -183,13 +183,22 @@ class MacApp extends App {
     return plists.concat(optional.filter(item => item))
   }
 
+  appRelativePath (p) {
+    return path.relative(this.contentsPath, p)
+  }
+
   async updatePlistFiles () {
     const appBundleIdentifier = this.bundleName
     this.helperBundleIdentifier = filterCFBundleIdentifier(this.opts.helperBundleId || `${appBundleIdentifier}.helper`)
 
     const plists = await this.determinePlistFilesToUpdate()
     await Promise.all(plists.map(plistArgs => this.loadPlist(...plistArgs)))
     await this.extendPlist(this.appPlist, this.opts.extendInfo)
+    if (this.asarIntegrity) {
+      await this.extendPlist(this.appPlist, {
+        ElectronAsarIntegrity: this.asarIntegrity
+      })
+    }
     this.appPlist = this.updatePlist(this.appPlist, this.executableName, appBundleIdentifier, this.appName)
 
     const updateIfExists = [

src/platform.js

@@ -1,6 +1,7 @@
 'use strict'
 
 const asar = require('asar')
+const crypto = require('crypto')
 const debug = require('debug')('electron-packager')
 const fs = require('fs-extra')
 const path = require('path')
@@ -191,13 +192,24 @@ class App {
     await fs.copy(src, this.appAsarPath, { overwrite: false, errorOnExist: true })
   }
 
+  appRelativePath (p) {
+    return path.relative(this.stagingPath, p)
+  }
+
   async asarApp () {
     if (!this.asarOptions) {
       return Promise.resolve()
     }
 
     debug(`Running asar with the options ${JSON.stringify(this.asarOptions)}`)
     await asar.createPackageWithOptions(this.originalResourcesAppDir, this.appAsarPath, this.asarOptions)
+    const { headerString } = asar.getRawHeader(this.appAsarPath)
+    this.asarIntegrity = {
+      [this.appRelativePath(this.appAsarPath)]: {
+        algorithm: 'SHA256',
+        hash: crypto.createHash('SHA256').update(headerString).digest('hex')
+      }
+    }
     await fs.remove(this.originalResourcesAppDir)
   }
 

test/darwin.js

@@ -466,4 +466,24 @@ if (!(process.env.CI && process.platform === 'win32')) {
     await util.assertDirectory(t, appPath, 'The Electron.app folder exists')
     await util.assertFile(t, path.join(appPath, 'Contents', 'MacOS', 'Electron'), 'The Electron.app/Contents/MacOS/Electron binary exists')
   }))
+
+  test.serial('asar integrity hashes are not inserted when asar is disabled', darwinTest(async (t, baseOpts) => {
+    const opts = { ...baseOpts, asar: false }
+    const finalPath = (await packager(opts))[0]
+    const plistObj = await parseInfoPlist(t, opts, finalPath)
+    t.is(typeof plistObj.ElectronAsarIntegrity, 'undefined')
+  }))
+
+  test.serial('asar integrity hashes are automatically inserted', darwinTest(async (t, baseOpts) => {
+    const opts = { ...baseOpts, asar: true }
+    const finalPath = (await packager(opts))[0]
+    const plistObj = await parseInfoPlist(t, opts, finalPath)
+    t.is(typeof plistObj.ElectronAsarIntegrity, 'object')
+    t.deepEqual(plistObj.ElectronAsarIntegrity, {
+      'Resources/app.asar': {
+        algorithm: 'SHA256',
+        hash: '27f2dba4273f6c119000ec7059c27d86e27306d5dbbb83cfdfb862d92c679574'
+      }
+    })
+  }))
 }