feat: add file hashes to asar header

README.md

@@ -153,12 +153,20 @@ Structure of `header` is something like this:
                "ls": {
                  "offset": "0",
                  "size": 100,
-                 "executable": true
+                 "executable": true,
+                 "integrity": {
+                   "algorithm": "SHA256",
+                   "hash": "..."
+                 }
                },
                "cd": {
                  "offset": "100",
                  "size": 100,
-                 "executable": true
+                 "executable": true,
+                 "integrity": {
+                   "algorithm": "SHA256",
+                   "hash": "..."
+                 }
                }
              }
            }
@@ -168,7 +176,11 @@ Structure of `header` is something like this:
          "files": {
            "hosts": {
              "offset": "200",
-             "size": 32
+             "size": 32,
+             "integrity": {
+                "algorithm": "SHA256",
+                "hash": "..."
+              }
            }
          }
       }
@@ -187,6 +199,9 @@ precisely represent UINT64 in JavaScript `Number`. `size` is a JavaScript
 because file size in Node.js is represented as `Number` and it is not safe to
 convert `Number` to UINT64.
 
+`integrity` is an object consisting of a hashing `algorithm` and a hex encoded
+`hash` value.
+
 [pickle]: https://chromium.googlesource.com/chromium/src/+/master/base/pickle.h
 [node-pickle]: https://www.npmjs.org/package/chromium-pickle
 [grunt-asar]: https://github.com/bwin/grunt-asar

lib/asar.js

@@ -157,6 +157,10 @@ module.exports.statFile = function (archive, filename, followLinks) {
   return filesystem.getFile(filename, followLinks)
 }
 
+module.exports.getRawHeader = function (archive) {
+  return disk.readArchiveHeaderSync(archive)
+}
+
 module.exports.listPackage = function (archive, options) {
   return disk.readFilesystemSync(archive).listFiles(options)
 }
@@ -199,6 +203,9 @@ module.exports.extractAll = function (archive, dest) {
       // it's a file, extract it
       const content = disk.readFileSync(filesystem, filename, file)
       fs.writeFileSync(destFilename, content)
+      if (file.executable) {
+        fs.chmodSync(destFilename, '755')
+      }
     }
   }
 }

lib/crawlfs.js

@@ -9,22 +9,32 @@ async function determineFileType (filename) {
   const stat = await fs.lstat(filename)
   if (stat.isFile()) {
     return { type: 'file', stat }
-  } else if (stat.isDirectory()) {
-    return { type: 'directory', stat }
   } else if (stat.isSymbolicLink()) {
     return { type: 'link', stat }
+  } else if (stat.isDirectory()) {
+    return { type: 'directory', stat }
   }
 }
 
 module.exports = async function (dir, options) {
   const metadata = {}
   const crawled = await glob(dir, options)
   const results = await Promise.all(crawled.map(async filename => [filename, await determineFileType(filename)]))
+  const links = []
   const filenames = results.map(([filename, type]) => {
     if (type) {
       metadata[filename] = type
+      if (type.type === 'link') links.push(filename)
     }
     return filename
+  }).filter((filename) => {
+    // Newer glob can return files inside symlinked directories, to avoid
+    // those appearing in archives we need to manually exclude theme here
+    const exactLinkIndex = links.findIndex(link => filename === link)
+    return links.every((link, index) => {
+      if (index === exactLinkIndex) return true
+      return !filename.startsWith(link)
+    })
   })
   return [filenames, metadata]
 }

lib/disk.js

@@ -76,7 +76,7 @@ module.exports.readArchiveHeaderSync = function (archive) {
 
   const headerPickle = pickle.createFromBuffer(headerBuf)
   const header = headerPickle.createIterator().readString()
-  return { header: JSON.parse(header), headerSize: size }
+  return { headerString: header, header: JSON.parse(header), headerSize: size }
 }
 
 module.exports.readFilesystemSync = function (archive) {

lib/filesystem.js

@@ -5,6 +5,7 @@ const os = require('os')
 const path = require('path')
 const { promisify } = require('util')
 const stream = require('stream')
+const getFileIntegrity = require('./integrity')
 
 const UINT32_MAX = 2 ** 32 - 1
 
@@ -57,6 +58,7 @@ class Filesystem {
     if (shouldUnpack || dirNode.unpacked) {
       node.size = file.stat.size
       node.unpacked = true
+      node.integrity = await getFileIntegrity(p)
       return Promise.resolve()
     }
 
@@ -86,6 +88,7 @@ class Filesystem {
 
     node.size = size
     node.offset = this.offset.toString()
+    node.integrity = await getFileIntegrity(p)
     if (process.platform !== 'win32' && (file.stat.mode & 0o100)) {
       node.executable = true
     }

lib/index.d.ts

@@ -44,6 +44,27 @@ export type InputMetadata = {
   }
 };
 
+export type DirectoryRecord = {
+  files: Record<string, DirectoryRecord | FileRecord>;
+};
+
+export type FileRecord = {
+  offset: string;
+  size: number;
+  executable?: boolean;
+  integrity: {
+    hash: string;
+    algorithm: 'SHA256';
+  };
+}
+
+export type ArchiveHeader = {
+  // The JSON parsed header string
+  header: DirectoryRecord;
+  headerString: string;
+  headerSize: number;
+}
+
 export function createPackage(src: string, dest: string): Promise<void>;
 export function createPackageWithOptions(
   src: string,
@@ -59,6 +80,7 @@ export function createPackageFromFiles(
 ): Promise<void>;
 
 export function statFile(archive: string, filename: string, followLinks?: boolean): Metadata;
+export function getRawHeader(archive: string): ArchiveHeader;
 export function listPackage(archive: string, options?: ListOptions): string[];
 export function extractFile(archive: string, filename: string): Buffer;
 export function extractAll(archive: string, dest: string): void;

lib/integrity.js

@@ -0,0 +1,62 @@
+const crypto = require('crypto')
+const fs = require('fs')
+const stream = require('stream')
+const { promisify } = require('util')
+
+const ALGORITHM = 'SHA256'
+// 4MB default block size
+const BLOCK_SIZE = 4 * 1024 * 1024
+
+const pipeline = promisify(stream.pipeline)
+
+async function getFileIntegrity (path) {
+  const read = fs.createReadStream(path)
+  const hash = crypto.createHash(ALGORITHM)
+  hash.setEncoding('hex')
+  await pipeline(
+    read,
+    hash
+  )
+
+  const blocks = []
+  let currentBlockSize = 0
+  let currentBlock = []
+
+  await pipeline(
+    fs.createReadStream(path),
+    new stream.PassThrough({
+      decodeStrings: false,
+      transform (_chunk, encoding, callback) {
+        function handleChunk (chunk) {
+          const diffToSlice = Math.min(BLOCK_SIZE - currentBlockSize, chunk.byteLength)
+          currentBlockSize += diffToSlice
+          currentBlock.push(chunk.slice(0, diffToSlice))
+          if (currentBlockSize === BLOCK_SIZE) {
+            blocks.push(Buffer.concat(currentBlock))
+            currentBlock = []
+            currentBlockSize = 0
+          }
+          if (diffToSlice < chunk.byteLength) {
+            handleChunk(chunk.slice(diffToSlice))
+          }
+        }
+        handleChunk(_chunk)
+        callback()
+      },
+      flush (callback) {
+        blocks.push(Buffer.concat(currentBlock))
+        currentBlock = []
+        callback()
+      }
+    })
+  )
+
+  return {
+    algorithm: ALGORITHM,
+    hash: hash.read(),
+    blockSize: BLOCK_SIZE,
+    blocks: blocks.map(block => crypto.createHash(ALGORITHM).update(block).digest('hex'))
+  }
+}
+
+module.exports = getFileIntegrity

test/util/compareFiles.js

@@ -4,6 +4,9 @@ const assert = require('assert')
 const fs = require('../../lib/wrapped-fs')
 
 module.exports = async function (actualFilePath, expectedFilePath) {
+  if (process.env.ELECTRON_ASAR_SPEC_UPDATE) {
+    await fs.writeFile(expectedFilePath, await fs.readFile(actualFilePath))
+  }
   const [actual, expected] = await Promise.all([fs.readFile(actualFilePath, 'utf8'), fs.readFile(expectedFilePath, 'utf8')])
   assert.strictEqual(actual, expected)
 }