ASAR完整性
平台支持
目前只在 macOS 上支持ASAR完整性检查。
要求
Electron Forge / Electron Packager
如果你使用 >= electron-packager@15.4.0
或 >= @electron-forge/core@6.0.0-beta.61
那么将满足所有需求, 你可以直接跳到 Toggling the Fuse 章节
其他构建系统
为了启用ASAR 完整性检查,你需要确保 app.asar
文件是由支持 asar 完整性的 asar
npm 软件包生成的。 版本 3.1.0
中引入了支持。
Your must then populate a valid ElectronAsarIntegrity
dictionary block in your packaged apps Info.plist
. An example is included below.
<key>ElectronAsarIntegrity</key>
<dict>
<key>Resources/app.asar</key>
<dict>
<key>algorithm</key>
<string>SHA256</string>
<key>hash</key>
<string>9d1f61ea03c4bb62b4416387a521101b81151da0cfbe18c9f8c8b818c5cebfac</string>
</dict>
</dict>
Valid algorithm
values are currently SHA256
only. The hash
is a hash of the ASAR header using the given algorithm. The asar
package exposes a getRawHeader
method whose result can then be hashed to generate this value.
Toggling the Fuse
ASAR integrity checking is currently disabled by default and can be enabled by toggling a fuse. See Electron Fuses for more information on what Electron Fuses are and how they work. When enabling this fuse you typically also want to enable the onlyLoadAppFromAsar
fuse otherwise the validity checking can be bypassed via the Electron app code search path.
require('@electron/fuses').flipFuses(
// 比如 /a/b/Foo.app
pathToPackagedApp,
{
version: FuseVersion.V1,
[FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: true,
[FuseV1Options.OnlyLoadAppFromAsar]: true
}
)