electron-updater - npm Package Compare versions

Comparing version 4.6.5 to 5.0.0-alpha.0

out/AppUpdater.js

@@ -479,3 +479,3 @@ "use strict";
             if (urlPath.endsWith(`.${taskOptions.fileExtension}`)) {
-                return path.posix.basename(urlPath);
+                return path.basename(urlPath);
             }
@@ -482,0 +482,0 @@ else {

out/MacUpdater.d.ts

@@ -7,2 +7,3 @@ import { AllPublishOptions } from "builder-util-runtime";
     private squirrelDownloadedUpdate;
+    private server?;
     constructor(options?: AllPublishOptions, app?: AppAdapter);
@@ -9,0 +10,0 @@ private debug;

out/MacUpdater.js

@@ -11,2 +11,3 @@ "use strict";
 const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
 class MacUpdater extends AppUpdater_1.AppUpdater {
@@ -48,4 +49,4 @@ constructor(options, app) {
             this.debug("Checking for arm64 in uname");
-            const result = child_process_1.execFileSync("uname", ['-a'], { encoding: "utf8" });
-            const isArm = result.includes('ARM');
+            const result = child_process_1.execFileSync("uname", ["-a"], { encoding: "utf8" });
+            const isArm = result.includes("ARM");
             log.info(`Checked 'uname -a': arm64=${isArm}`);
@@ -57,3 +58,3 @@ isArm64Mac = isArm64Mac || isArm;
         }
-        isArm64Mac = isArm64Mac || process.arch === 'arm64' || isRosetta;
+        isArm64Mac = isArm64Mac || process.arch === "arm64" || isRosetta;
         // allow arm64 macs to install universal or rosetta2(x64) - https://github.com/electron-userland/electron-builder/pull/5524
@@ -82,3 +83,3 @@ const isArm64 = (file) => { var _a; return file.url.pathname.includes("arm64") || ((_a = file.info.url) === null || _a === void 0 ? void 0 : _a.includes("arm64")); };
     async updateDownloaded(zipFileInfo, event) {
-        var _a;
+        var _a, _b;
         const downloadedFile = event.downloadedFile;
@@ -89,20 +90,44 @@ const updateFileSize = (_a = zipFileInfo.info.size) !== null && _a !== void 0 ? _a : (await fs_extra_1.stat(downloadedFile)).size;
         this.debug(`Creating proxy server for native Squirrel.Mac (${logContext})`);
-        const server = http_1.createServer();
+        (_b = this.server) === null || _b === void 0 ? void 0 : _b.close();
+        this.server = http_1.createServer();
         this.debug(`Proxy server for native Squirrel.Mac is created (${logContext})`);
-        server.on("close", () => {
+        this.server.on("close", () => {
             log.info(`Proxy server for native Squirrel.Mac is closed (${logContext})`);
         });
         // must be called after server is listening, otherwise address is null
-        function getServerUrl() {
-            const address = server.address();
-            return `http://127.0.0.1:${address.port}`;
-        }
+        const getServerUrl = (s) => {
+            const address = s.address();
+            if (typeof address === "string") {
+                return address;
+            }
+            return `http://127.0.0.1:${address === null || address === void 0 ? void 0 : address.port}`;
+        };
         return await new Promise((resolve, reject) => {
+            const pass = crypto_1.default.randomBytes(64).toString("base64").replace(/\//g, "_").replace(/\+/g, "-");
+            const authInfo = Buffer.from(`autoupdater:${pass}`, "base64");
             // insecure random is ok
             const fileUrl = `/${Date.now().toString(16)}-${Math.floor(Math.random() * 9999).toString(16)}.zip`;
-            server.on("request", (request, response) => {
+            this.server.on("request", (request, response) => {
+                // check for basic auth header
+                if (!request.headers.authorization || request.headers.authorization.indexOf("Basic ") === -1) {
+                    response.statusCode = 401;
+                    response.statusMessage = "Invalid Authentication Credentials";
+                    response.end();
+                    log.warn("No authenthication info");
+                }
+                // verify auth credentials
+                const base64Credentials = request.headers.authorization.split(" ")[1];
+                const credentials = Buffer.from(base64Credentials, "base64").toString("ascii");
+                const [username, password] = credentials.split(":");
+                if (username !== "autoupdater" || password !== pass) {
+                    response.statusCode = 401;
+                    response.statusMessage = "Invalid Authentication Credentials";
+                    response.end();
+                    log.warn("Invalid authenthication credentials");
+                    return;
+                }
                 const requestUrl = request.url;
                 log.info(`${requestUrl} requested`);
                 if (requestUrl === "/") {
-                    const data = Buffer.from(`{ "url": "${getServerUrl()}${fileUrl}" }`);
+                    const data = Buffer.from(`{ "url": "${getServerUrl(this.server)}${fileUrl}" }`);
                     response.writeHead(200, { "Content-Type": "application/json", "Content-Length": data.length });
@@ -121,11 +146,6 @@ response.end(data);
                 response.on("finish", () => {
-                    try {
-                        setImmediate(() => server.close());
+                    if (!errorOccurred) {
+                        this.nativeUpdater.removeListener("error", reject);
+                        resolve([]);
                     }
-                    finally {
-                        if (!errorOccurred) {
-                            this.nativeUpdater.removeListener("error", reject);
-                            resolve([]);
-                        }
-                    }
                 });
@@ -151,7 +171,10 @@ const readStream = fs_1.createReadStream(downloadedFile);
             this.debug(`Proxy server for native Squirrel.Mac is starting to listen (${logContext})`);
-            server.listen(0, "127.0.0.1", () => {
-                this.debug(`Proxy server for native Squirrel.Mac is listening (address=${getServerUrl()}, ${logContext})`);
+            this.server.listen(0, "127.0.0.1", () => {
+                this.debug(`Proxy server for native Squirrel.Mac is listening (address=${getServerUrl(this.server)}, ${logContext})`);
                 this.nativeUpdater.setFeedURL({
-                    url: getServerUrl(),
-                    headers: { "Cache-Control": "no-cache" },
+                    url: getServerUrl(this.server),
+                    headers: {
+                        "Cache-Control": "no-cache",
+                        Authorization: `Basic ${authInfo.toString("ascii")}`,
+                    },
                 });
@@ -172,2 +195,4 @@ // The update has been downloaded and is ready to be served to Squirrel
     quitAndInstall() {
+        var _a;
+        (_a = this.server) === null || _a === void 0 ? void 0 : _a.close();
         if (this.squirrelDownloadedUpdate) {
@@ -174,0 +199,0 @@ // update already fetched by Squirrel, it's ready to install

out/providerFactory.js

@@ -5,3 +5,2 @@ "use strict";
 const builder_util_runtime_1 = require("builder-util-runtime");
-const BintrayProvider_1 = require("./providers/BintrayProvider");
 const BitbucketProvider_1 = require("./providers/BitbucketProvider");
@@ -55,4 +54,2 @@ const GenericProvider_1 = require("./providers/GenericProvider");
         }
-        case "bintray":
-            return new BintrayProvider_1.BintrayProvider(data, runtimeOptions);
         case "custom": {
@@ -59,0 +56,0 @@ const options = data;

out/windowsExecutableCodeSignatureVerifier.js

@@ -40,3 +40,3 @@ "use strict";
             "-Command",
-            `Get-AuthenticodeSignature '${tempUpdateFile}' | ConvertTo-Json -Compress | ForEach-Object { [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($_)) }`,
+            `Get-AuthenticodeSignature -LiteralPath '${tempUpdateFile}' | ConvertTo-Json -Compress | ForEach-Object { [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($_)) }`,
         ], {
@@ -64,3 +64,3 @@ timeout: 20 * 1000,
             catch (e) {
-                logger.warn(`Cannot execute Get-AuthenticodeSignature: ${error}. Ignoring signature validation due to unknown error.`);
+                handleError(logger, e, null);
                 resolve(null);
@@ -106,4 +106,3 @@ return;
     if (stderr) {
-        logger.warn(`Cannot execute Get-AuthenticodeSignature, stderr: ${stderr}. Ignoring signature validation due to unknown stderr.`);
-        return;
+        throw new Error(`Cannot execute Get-AuthenticodeSignature, stderr: ${stderr}. Failing signature validation due to unknown stderr.`);
     }
@@ -110,0 +109,0 @@ }

package.json

 {
-	"name": "electron-updater",
-	"version": "4.6.5",
-	"description": "Cross platform updater for electron applications",
-	"main": "out/main.js",
-	"author": "Vladimir Krivosheev",
-	"license": "MIT",
-	"repository": {
-		"type": "git",
-		"url": "git+https://github.com/electron-userland/electron-builder.git",
-		"directory": "packages/electron-updater"
-	},
-	"bugs": "https://github.com/electron-userland/electron-builder/issues",
-	"homepage": "https://github.com/electron-userland/electron-builder",
-	"files": [
-		"out"
-	],
-	"dependencies": {
-		"@types/semver": "^7.3.6",
-		"builder-util-runtime": "8.9.2",
-		"fs-extra": "^10.0.0",
-		"js-yaml": "^4.1.0",
-		"lazy-val": "^1.0.5",
-		"lodash.escaperegexp": "^4.1.2",
-		"lodash.isequal": "^4.5.0",
-		"semver": "^7.3.5"
-	},
-	"devDependencies": {
-		"@types/fs-extra": "9.0.12",
-		"@types/js-yaml": "4.0.3",
-		"@types/lodash.escaperegexp": "4.1.6",
-		"@types/lodash.isequal": "4.5.5"
-	},
-	"typings": "./out/main.d.ts",
-	"publishConfig": {
-		"tag": "next"
-	}
-}
+  "name": "electron-updater",
+  "version": "5.0.0-alpha.0",
+  "description": "Cross platform updater for electron applications",
+  "main": "out/main.js",
+  "author": "Vladimir Krivosheev",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/electron-userland/electron-builder.git",
+    "directory": "packages/electron-updater"
+  },
+  "bugs": "https://github.com/electron-userland/electron-builder/issues",
+  "homepage": "https://github.com/electron-userland/electron-builder",
+  "files": [
+    "out"
+  ],
+  "dependencies": {
+    "@types/semver": "^7.3.6",
+    "builder-util-runtime": "9.0.0-alpha.0",
+    "fs-extra": "^10.0.0",
+    "js-yaml": "^4.1.0",
+    "lazy-val": "^1.0.5",
+    "lodash.escaperegexp": "^4.1.2",
+    "lodash.isequal": "^4.5.0",
+    "semver": "^7.3.5"
+  },
+  "devDependencies": {
+    "@types/fs-extra": "9.0.13",
+    "@types/js-yaml": "4.0.3",
+    "@types/lodash.escaperegexp": "4.1.6",
+    "@types/lodash.isequal": "4.5.5"
+  },
+  "typings": "./out/main.d.ts",
+  "publishConfig": {
+    "tag": "next"
+  },
+  "readme": "# electron-updater\n\nThis module allows you to automatically update your application. You only need to install this module and write two lines of code!\nTo publish your updates you just need simple file hosting, it does not require a dedicated server.\n\nSee [Auto Update](https://electron.build/auto-update) for more information.\n\nSupported OS:\n - macOS ([Squirrel.Mac](https://github.com/Squirrel/Squirrel.Mac)).\n - Windows (NSIS).\n - Linux (AppImage).\n\n## Credits\n\nThanks to [Evolve Labs](https://www.evolvehq.com) for donating the npm package name.\n"
+}

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Worsened metrics

Total package byte prevSize

406137

decreased by-4.95%

Number of package files

81

decreased by-4.71%

Lines of code

3711

decreased by-0.85%

Number of low quality alerts

1

increased byInfinity%

Dependency changes

• + Addedbuilder-util-runtime@9.0.0-alpha.0(transitive)

• - Removedbuilder-util-runtime@8.9.2(transitive)

• Updatedbuilder-util-runtime@9.0.0-alpha.0