fix: compute integrity over transformed bytes when a transform is applied

[claude]

Requested by Samuel Attard · Slack thread

Fixes #277.

Before

When a transform is registered, the transformed content is written to a temporary file and that temp file's bytes are what actually get stored in the archive. The file's size is also taken from the transformed temp file. However, the integrity hash was still computed from the original, pre-transform source stream (getFileIntegrity(streamGenerator())).

As a result, the header's integrity hash (and block hashes) did not match the bytes that were actually stored in the archive. Any consumer that validates the stored content against the recorded integrity would see a mismatch whenever a transform changed the bytes.

After

The integrity is computed over the transformed temp file, so the recorded hash and blocks match the bytes that are actually stored in the archive.

How

In src/filesystem.ts, insertFileAsync now hashes the transformed output instead of re-reading the untransformed source:

-    node.integrity = await getFileIntegrity(streamGenerator());
+    node.integrity = await getFileIntegrity(fs.createReadStream(file.transformed.path));

This mirrors what disk.ts already does when writing the archive body, which reads from transformed.path for transformed files.

A regression test was added (test/asar-spec.ts, under the transform describe block) that packs a file with a byte-changing transform and asserts that the header integrity matches the SHA256 of the actual stored (transformed) bytes returned by extractFile. This test fails without the fix and passes with it.

The test/expected/packthis-transformed.asar fixture was regenerated; the only change is file0.txt's integrity hash, which now reflects the stored (transformed) bytes instead of the original ones — the rest of the header is byte-identical.

Testing

• New regression test fails before the fix, passes after.
• Full Node test suite passes (188 tests). The Electron-runner pass of yarn test was not exercised in this environment because the Electron binary download is blocked here; it runs the same test files unchanged.

---

Generated by Claude Code