asar - npm Package Compare versions

Comparing version 3.0.3 to 3.1.0

CHANGELOG.md

@@ -1,7 +0,7 @@
-## [3.0.3](https://github.com/electron/asar/compare/v3.0.2...v3.0.3) (2020-03-31)
+# [3.1.0](https://github.com/electron/asar/compare/v3.0.3...v3.1.0) (2021-09-09)
 
 
-### Bug Fixes
+### Features
 
-* CreateOptions.transform should return stream or void ([#195](https://github.com/electron/asar/issues/195)) ([c9cc0a1](https://github.com/electron/asar/commit/c9cc0a186c0f621b8e13e57be055035a41b65af7))
+* add file hashes to asar header ([#221](https://github.com/electron/asar/issues/221)) ([94cb8bd](https://github.com/electron/asar/commit/94cb8bdfea6257d7bc67f72ed80a790c2b5dae3a))
 
@@ -8,0 +8,0 @@ # Changes By Version

lib/asar.js

@@ -160,2 +160,6 @@ 'use strict'
 
+module.exports.getRawHeader = function (archive) {
+  return disk.readArchiveHeaderSync(archive)
+}
+
 module.exports.listPackage = function (archive, options) {
@@ -203,2 +207,5 @@ return disk.readFilesystemSync(archive).listFiles(options)
       fs.writeFileSync(destFilename, content)
+      if (file.executable) {
+        fs.chmodSync(destFilename, '755')
+      }
     }
@@ -205,0 +212,0 @@ }

lib/crawlfs.js

@@ -23,7 +23,17 @@ 'use strict'
   const results = await Promise.all(crawled.map(async filename => [filename, await determineFileType(filename)]))
+  const links = []
   const filenames = results.map(([filename, type]) => {
     if (type) {
       metadata[filename] = type
+      if (type.type === 'link') links.push(filename)
     }
     return filename
+  }).filter((filename) => {
+    // Newer glob can return files inside symlinked directories, to avoid
+    // those appearing in archives we need to manually exclude theme here
+    const exactLinkIndex = links.findIndex(link => filename === link)
+    return links.every((link, index) => {
+      if (index === exactLinkIndex) return true
+      return !filename.startsWith(link)
+    })
   })
@@ -30,0 +40,0 @@ return [filenames, metadata]

lib/disk.js

@@ -79,3 +79,3 @@ 'use strict'
   const header = headerPickle.createIterator().readString()
-  return { header: JSON.parse(header), headerSize: size }
+  return { headerString: header, header: JSON.parse(header), headerSize: size }
 }
@@ -82,0 +82,0 @@

lib/filesystem.js

@@ -8,2 +8,3 @@ 'use strict'
 const stream = require('stream')
+const getFileIntegrity = require('./integrity')
 
@@ -61,2 +62,3 @@ const UINT32_MAX = 2 ** 32 - 1
       node.unpacked = true
+      node.integrity = await getFileIntegrity(p)
       return Promise.resolve()
@@ -91,2 +93,3 @@ }
     node.offset = this.offset.toString()
+    node.integrity = await getFileIntegrity(p)
     if (process.platform !== 'win32' && (file.stat.mode & 0o100)) {
@@ -93,0 +96,0 @@ node.executable = true

lib/index.d.ts

@@ -47,2 +47,25 @@ import { IOptions as GlobOptions } from 'glob';
 
+export type DirectoryRecord = {
+  files: Record<string, DirectoryRecord | FileRecord>;
+};
+
+export type FileRecord = {
+  offset: string;
+  size: number;
+  executable?: boolean;
+  integrity: {
+    hash: string;
+    algorithm: 'SHA256';
+    blocks: string[];
+    blockSize: number;
+  };
+}
+
+export type ArchiveHeader = {
+  // The JSON parsed header string
+  header: DirectoryRecord;
+  headerString: string;
+  headerSize: number;
+}
+
 export function createPackage(src: string, dest: string): Promise<void>;
@@ -63,2 +86,3 @@ export function createPackageWithOptions(
 export function statFile(archive: string, filename: string, followLinks?: boolean): Metadata;
+export function getRawHeader(archive: string): ArchiveHeader;
 export function listPackage(archive: string, options?: ListOptions): string[];
@@ -65,0 +89,0 @@ export function extractFile(archive: string, filename: string): Buffer;

package.json

 {
   "name": "asar",
   "description": "Creating Electron app packages",
-  "version": "3.0.3",
+  "version": "3.1.0",
   "main": "./lib/asar.js",
@@ -6,0 +6,0 @@ "types": "./lib/index.d.ts",

README.md

 # asar - Electron Archive
 
-[![CircleCI build status](https://circleci.com/gh/electron/asar/tree/master.svg?style=svg)](https://circleci.com/gh/electron/asar/tree/master)
+[![CircleCI build status](https://circleci.com/gh/electron/asar/tree/main.svg?style=svg)](https://circleci.com/gh/electron/asar/tree/main)
 [![dependencies](http://img.shields.io/david/electron/asar.svg?style=flat-square)](https://david-dm.org/electron/asar)
@@ -156,3 +156,9 @@ [![npm version](http://img.shields.io/npm/v/asar.svg?style=flat-square)](https://npmjs.org/package/asar)
                  "size": 100,
-                 "executable": true
+                 "executable": true,
+                 "integrity": {
+                   "algorithm": "SHA256",
+                   "hash": "...",
+                   "blockSize": 1024,
+                   "blocks": ["...", "..."]
+                 }
                },
@@ -162,3 +168,9 @@ "cd": {
                  "size": 100,
-                 "executable": true
+                 "executable": true,
+                 "integrity": {
+                   "algorithm": "SHA256",
+                   "hash": "...",
+                   "blockSize": 1024,
+                   "blocks": ["...", "..."]
+                 }
                }
@@ -173,3 +185,9 @@ }
              "offset": "200",
-             "size": 32
+             "size": 32,
+             "integrity": {
+                "algorithm": "SHA256",
+                "hash": "...",
+                "blockSize": 1024,
+                "blocks": ["...", "..."]
+              }
            }
@@ -193,4 +211,10 @@ }
 
+`integrity` is an object consisting of a few keys:
+* A hashing `algorithm`, currently only `SHA256` is supported.
+* A hex encoded `hash` value representing the hash of the entire file.
+* An array of hex encoded hashes for the `blocks` of the file.  i.e. for a blockSize of 4KB this array contains the hash of every block if you split the file into N 4KB blocks.
+* A integer value `blockSize` representing the size in bytes of each block in the `blocks` hashes above
+
 [pickle]: https://chromium.googlesource.com/chromium/src/+/master/base/pickle.h
 [node-pickle]: https://www.npmjs.org/package/chromium-pickle
 [grunt-asar]: https://github.com/bwin/grunt-asar

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

35017

increased by12.7%

Number of package files

12

increased by9.09%

Lines of code

682

increased by15.79%

Number of lines in readme file

217

increased by12.44%

Worsened metrics

Number of low supply chain risk alerts

3

increased by50%

No dependency changes