app-builder-lib 26.15.2 → 27.0.0-alpha.0

package/out/asar/asarFileChecker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"asarFileChecker.js","sourceRoot":"","sources":["../../src/asar/asarFileChecker.ts"],"names":[],"mappings":";;AAGA,gDAkBC;AApBD,yDAAqD;AAE9C,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,YAAoB,EAAE,aAAqB;IACpG,MAAM,IAAI,GAAG,MAAM,IAAA,6BAAa,EAAkC,gBAAgB,CAAC,CAAA;IACnF,SAAS,KAAK,CAAC,IAAY;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,aAAa,KAAK,YAAY,aAAa,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,IAAqB,CAAA;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,sDAAsD,CAAC,EAAE,CAAC;YAC/E,MAAM,KAAK,CAAC,mDAAmD,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;IACnC,CAAC;IACD,IAAK,IAA4B,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["import type { FilesystemEntry, FilesystemFileEntry } from \"@electron/asar/lib/filesystem\"\nimport { dynamicImport } from \"../util/dynamicImport\"\n\nexport async function checkFileInArchive(asarFile: string, relativeFile: string, messagePrefix: string): Promise<FilesystemEntry> {\n  const asar = await dynamicImport<typeof import(\"@electron/asar\")>(\"@electron/asar\")\n  function error(text: string) {\n    return new Error(`${messagePrefix} \"${relativeFile}\" in the \"${asarFile}\" ${text}`)\n  }\n  let stat: FilesystemEntry\n  try {\n    stat = asar.statFile(asarFile, relativeFile, false)\n  } catch (e: any) {\n    if (e.message.includes(\"Cannot read properties of undefined (reading 'link')\")) {\n      throw error(\"does not exist. Seems like a wrong configuration.\")\n    }\n    throw error(`is corrupted: ${e}`)\n  }\n  if ((stat as FilesystemFileEntry).size === 0) {\n    throw error(`is corrupted: size 0`)\n  }\n  return stat\n}\n"]}

package/out/asar/asarUtil.d.ts

@@ -1 +0,0 @@
-export {};

package/out/asar/asarUtil.js

@@ -1,285 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AsarPackager = void 0;
-const builder_util_1 = require("builder-util");
-const dynamicImport_1 = require("../util/dynamicImport");
-const fs_1 = require("builder-util/out/fs");
-const fs = require("fs-extra");
-const fs_extra_1 = require("fs-extra");
-const path = require("path");
-const appFileCopier_1 = require("../util/appFileCopier");
-const unpackDetector_1 = require("./unpackDetector");
-const stream_1 = require("stream");
-const os = require("os");
-const resolvePath = async (file) => (file && (await (0, fs_1.exists)(file)) ? fs.realpath(file).catch(() => path.resolve(file)) : undefined);
-const resolvePaths = async (filepaths) => {
-    return Promise.all(filepaths.map(resolvePath)).then(paths => paths.filter((it) => it != null));
-};
-const DENYLIST = resolvePaths([
-    "/usr",
-    "/lib",
-    "/bin",
-    "/sbin",
-    "/etc",
-    "/tmp",
-    "/var", // block whole /var by default. If $HOME is under /var, it's explicitly in ALLOWLIST - https://github.com/electron-userland/electron-builder/issues/9025#issuecomment-3575380041
-    // macOS system directories
-    "/System",
-    "/Library",
-    "/private",
-    // Windows system directories
-    process.env.SystemRoot,
-    process.env.WINDIR,
-]);
-const ALLOWLIST = resolvePaths([
-    os.tmpdir(), // always allow temp dir
-    os.homedir(), // always allow home dir
-]);
-/** @internal */
-class AsarPackager {
-    constructor(packager, config) {
-        this.packager = packager;
-        this.config = config;
-        this.outFile = path.join(config.resourcePath, `app.asar`);
-    }
-    async pack(fileSets) {
-        const orderedFileSets = [
-            // Write dependencies first to minimize offset changes to asar header
-            ...fileSets.slice(1),
-            // Finish with the app files that change most often
-            fileSets[0],
-        ].map(set => this.orderFileSet(set));
-        const streams = await this.processFileSets(orderedFileSets);
-        await this.executeElectronAsar(streams);
-    }
-    async executeElectronAsar(streams) {
-        // override logger temporarily to clean up console (electron/asar does some internal logging that blogs up the default electron-builder logs)
-        const consoleLogger = console.log;
-        console.log = (...args) => {
-            if (args[0] === "Ordering file has 100% coverage.") {
-                return; // no need to log, this means our ordering logic is working correctly
-            }
-            builder_util_1.log.info({ args }, "logging @electron/asar");
-        };
-        const { createPackageFromStreams } = await (0, dynamicImport_1.dynamicImport)("@electron/asar");
-        await createPackageFromStreams(this.outFile, streams);
-        console.log = consoleLogger;
-    }
-    async processFileSets(fileSets) {
-        var _a;
-        const unpackedPaths = new Set();
-        if (this.config.options.smartUnpack !== false) {
-            for (const fileSet of fileSets) {
-                (0, unpackDetector_1.detectUnpackedDirs)(fileSet, unpackedPaths);
-            }
-        }
-        const resultsMap = new Map();
-        const streamOrdering = [];
-        const normalizedUnpackedPaths = Array.from(unpackedPaths).map(p => path.normalize(p));
-        // Check whether a file or directory should be unpacked, using pre-normalized unpacked paths and early returns
-        const isUnpacked = (dir, file, stat) => {
-            var _a, _b;
-            const normalizedDir = path.normalize(dir);
-            // Check file pattern first (most specific)
-            if (!(0, builder_util_1.isEmptyOrSpaces)(file) && stat && ((_b = (_a = this.config).unpackPattern) === null || _b === void 0 ? void 0 : _b.call(_a, file, stat))) {
-                return true;
-            }
-            // Check if path is within any unpacked directory
-            for (const unpackedPath of normalizedUnpackedPaths) {
-                if (normalizedDir === unpackedPath || normalizedDir.startsWith(unpackedPath + path.sep)) {
-                    return true;
-                }
-            }
-            return false;
-        };
-        // First pass: process all files in order, ensuring parent directories exist
-        for (const fileSet of fileSets) {
-            // Don't use Promise.all, we need to retain order of execution/iteration through the already-ordered fileset
-            for (const [index, file] of fileSet.files.entries()) {
-                const transformedData = (_a = fileSet.transformedFiles) === null || _a === void 0 ? void 0 : _a.get(index);
-                const stat = fileSet.metadata.get(file);
-                const destination = path.relative(this.config.defaultDestination, (0, appFileCopier_1.getDestinationPath)(file, fileSet));
-                // Ensure parent directories exist before processing file
-                this.ensureParentDirectories(destination, resultsMap, streamOrdering);
-                const result = await this.processFileOrSymlink({
-                    file,
-                    destination,
-                    fileSet,
-                    transformedData,
-                    stat,
-                    isUnpacked,
-                });
-                if (result && !resultsMap.has(result.path)) {
-                    resultsMap.set(result.path, result);
-                    streamOrdering.push(result.path);
-                }
-            }
-        }
-        // Second pass: propagate unpacked flag to parent directories
-        for (const entry of resultsMap.values()) {
-            if (entry.unpacked) {
-                this.markParentDirectoriesAsUnpacked(entry.path, resultsMap, isUnpacked);
-            }
-        }
-        // Build final results array maintaining processing order
-        return streamOrdering.reduce((streams, path) => {
-            const stream = resultsMap.has(path) ? resultsMap.get(path) : null;
-            if (stream != null) {
-                streams.push(stream);
-            }
-            return streams;
-        }, []);
-    }
-    ensureParentDirectories(destination, resultsMap, streamOrdering) {
-        const parents = [];
-        let current = path.dirname(path.normalize(destination));
-        // Collect all parent directories from deepest to root
-        while (current !== ".") {
-            parents.unshift(current);
-            current = path.dirname(current);
-        }
-        // Add parent directories in order (root to deepest)
-        for (const parentPath of parents) {
-            if (!resultsMap.has(parentPath)) {
-                const dir = {
-                    type: "directory",
-                    path: parentPath,
-                    unpacked: false, // Updated in second pass if needed
-                };
-                resultsMap.set(parentPath, dir);
-                streamOrdering.push(parentPath);
-            }
-        }
-    }
-    markParentDirectoriesAsUnpacked(destination, resultsMap, isUnpacked) {
-        let current = path.dirname(path.normalize(destination));
-        while (current !== ".") {
-            const entry = resultsMap.get(current);
-            if (entry && isUnpacked(current)) {
-                entry.unpacked = true;
-            }
-            current = path.dirname(current);
-        }
-    }
-    async processFileOrSymlink(options) {
-        const { isUnpacked, transformedData, file, destination, stat } = options;
-        const unpacked = isUnpacked(destination, file, stat);
-        // Handle directories
-        if (!stat.isFile() && !stat.isSymbolicLink()) {
-            return { path: destination, unpacked, type: "directory" };
-        }
-        // Handle transformed data (pre-processed content)
-        if (transformedData != null) {
-            const size = Buffer.byteLength(transformedData);
-            return {
-                path: destination,
-                streamGenerator: () => new stream_1.Readable({
-                    read() {
-                        this.push(transformedData);
-                        this.push(null);
-                    },
-                }),
-                unpacked,
-                type: "file",
-                stat: { mode: stat.mode, size },
-            };
-        }
-        // verify that the file is not a direct link or symlinked to access/copy a system file
-        await this.protectSystemAndUnsafePaths(file, await this.packager.info.getWorkspaceRoot());
-        const baseConfig = {
-            path: destination,
-            streamGenerator: () => fs.createReadStream(file),
-            unpacked,
-            stat,
-        };
-        // Handle regular files
-        if (!stat.isSymbolicLink()) {
-            return { ...baseConfig, type: "file" };
-        }
-        // Handle symlinks - make relative to source location
-        let link = await (0, fs_extra_1.readlink)(file);
-        if (path.isAbsolute(link)) {
-            link = path.relative(path.dirname(file), link);
-        }
-        return {
-            ...baseConfig,
-            type: "link",
-            symlink: link,
-        };
-    }
-    orderFileSet(fileSet) {
-        const sortedFileEntries = Array.from(fileSet.files.entries());
-        sortedFileEntries.sort(([, a], [, b]) => {
-            if (a === b) {
-                return 0;
-            }
-            // Place addons last because their signature changes per build
-            const isAAddon = a.endsWith(".node");
-            const isBAddon = b.endsWith(".node");
-            if (isAAddon && !isBAddon) {
-                return 1;
-            }
-            if (isBAddon && !isAAddon) {
-                return -1;
-            }
-            // Otherwise order by name
-            return a < b ? -1 : 1;
-        });
-        let transformedFiles;
-        if (fileSet.transformedFiles) {
-            transformedFiles = new Map();
-            const indexMap = new Map();
-            for (const [newIndex, [oldIndex]] of sortedFileEntries.entries()) {
-                indexMap.set(oldIndex, newIndex);
-            }
-            for (const [oldIndex, value] of fileSet.transformedFiles) {
-                const newIndex = indexMap.get(oldIndex);
-                if (newIndex === undefined) {
-                    throw new Error(`Internal error: ${fileSet.files[oldIndex]} was lost while ordering asar`);
-                }
-                transformedFiles.set(newIndex, value);
-            }
-        }
-        return {
-            src: fileSet.src,
-            destination: fileSet.destination,
-            metadata: fileSet.metadata,
-            files: sortedFileEntries.map(([, file]) => file),
-            transformedFiles,
-        };
-    }
-    async checkAgainstRoots(target, allowRoots) {
-        const resolved = await resolvePath(target);
-        if (resolved == null || (0, builder_util_1.isEmptyOrSpaces)(resolved)) {
-            return false;
-        }
-        for (const root of allowRoots) {
-            if (resolved === root || resolved.startsWith(root + path.sep)) {
-                return true;
-            }
-        }
-        return false;
-    }
-    async protectSystemAndUnsafePaths(file, workspaceRoot) {
-        const resolved = await resolvePath(file);
-        const logFields = { source: file, realPath: resolved };
-        const workspace = await resolvePath(workspaceRoot);
-        // If in workspace, always safe
-        if (workspace && (resolved === null || resolved === void 0 ? void 0 : resolved.startsWith(workspace))) {
-            return;
-        }
-        // Check allowlist (priority)
-        if (await this.checkAgainstRoots(file, await ALLOWLIST)) {
-            return;
-        }
-        // Check denylist
-        if (await this.checkAgainstRoots(file, await DENYLIST)) {
-            builder_util_1.log.error(logFields, `denied access to system or unsafe path`);
-            throw new Error(`Cannot copy file [${file}] symlinked to file [${resolved}] outside the package to a system or unsafe path`);
-        }
-        // Default: outside explicit paths but not explicitly denied
-        builder_util_1.log.debug(logFields, `path is outside of explicit safe paths, defaulting to safe`);
-    }
-}
-exports.AsarPackager = AsarPackager;
-//# sourceMappingURL=asarUtil.js.map

package/out/asar/asarUtil.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"asarUtil.js","sourceRoot":"","sources":["../../src/asar/asarUtil.ts"],"names":[],"mappings":";;;AACA,+CAAmD;AACnD,yDAAqD;AACrD,4CAAiE;AACjE,+BAA8B;AAC9B,uCAAmC;AACnC,6BAA4B;AAG5B,yDAA2E;AAC3E,qDAAqD;AACrD,mCAAiC;AACjC,yBAAwB;AAExB,MAAM,WAAW,GAAG,KAAK,EAAE,IAAwB,EAA+B,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,IAAA,WAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AACnL,MAAM,YAAY,GAAG,KAAK,EAAE,SAAiC,EAAE,EAAE;IAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAA;AAC9G,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,YAAY,CAAC;IAC5B,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IAEN,MAAM;IACN,MAAM,EAAE,gLAAgL;IAExL,2BAA2B;IAC3B,SAAS;IACT,UAAU;IACV,UAAU;IAEV,6BAA6B;IAC7B,OAAO,CAAC,GAAG,CAAC,UAAU;IACtB,OAAO,CAAC,GAAG,CAAC,MAAM;CACnB,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,YAAY,CAAC;IAC7B,EAAE,CAAC,MAAM,EAAE,EAAE,wBAAwB;IACrC,EAAE,CAAC,OAAO,EAAE,EAAE,wBAAwB;CACvC,CAAC,CAAA;AAEF,gBAAgB;AAChB,MAAa,YAAY;IAGvB,YACW,QAA+B,EACvB,MAKhB;QANQ,aAAQ,GAAR,QAAQ,CAAuB;QACvB,WAAM,GAAN,MAAM,CAKtB;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgC;QACzC,MAAM,eAAe,GAAG;YACtB,qEAAqE;YACrE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAEpB,mDAAmD;YACnD,QAAQ,CAAC,CAAC,CAAC;SACZ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;QAEpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAA;QAC3D,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAA;IACzC,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,OAAyB;QACzD,6IAA6I;QAC7I,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAA;QACjC,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,kCAAkC,EAAE,CAAC;gBACnD,OAAM,CAAC,qEAAqE;YAC9E,CAAC;YACD,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAA;QAC9C,CAAC,CAAA;QACD,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,IAAA,6BAAa,EAAkC,gBAAgB,CAAC,CAAA;QAC3G,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACrD,OAAO,CAAC,GAAG,GAAG,aAAa,CAAA;IAC7B,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,QAA2B;;QACvD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;QACvC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,IAAA,mCAAkB,EAAC,OAAO,EAAE,aAAa,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAA;QACpD,MAAM,cAAc,GAAa,EAAE,CAAA;QACnC,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;QAErF,8GAA8G;QAC9G,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAa,EAAE,IAAkB,EAAW,EAAE;;YAC7E,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;YAEzC,2CAA2C;YAC3C,IAAI,CAAC,IAAA,8BAAe,EAAC,IAAI,CAAC,IAAI,IAAI,KAAI,MAAA,MAAA,IAAI,CAAC,MAAM,EAAC,aAAa,mDAAG,IAAI,EAAE,IAAI,CAAC,CAAA,EAAE,CAAC;gBAC9E,OAAO,IAAI,CAAA;YACb,CAAC;YAED,iDAAiD;YACjD,KAAK,MAAM,YAAY,IAAI,uBAAuB,EAAE,CAAC;gBACnD,IAAI,aAAa,KAAK,YAAY,IAAI,aAAa,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxF,OAAO,IAAI,CAAA;gBACb,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAA;QACd,CAAC,CAAA;QAED,4EAA4E;QAC5E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,4GAA4G;YAC5G,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBACpD,MAAM,eAAe,GAAG,MAAA,OAAO,CAAC,gBAAgB,0CAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;gBACxC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAA,kCAAkB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;gBAEpG,yDAAyD;gBACzD,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC,CAAA;gBAErE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC;oBAC7C,IAAI;oBACJ,WAAW;oBACX,OAAO;oBACP,eAAe;oBACf,IAAI;oBACJ,UAAU;iBACX,CAAC,CAAA;gBAEF,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3C,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;oBACnC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;YAC1E,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,OAAO,cAAc,CAAC,MAAM,CAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACjE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACtB,CAAC;YACD,OAAO,OAAO,CAAA;QAChB,CAAC,EAAE,EAAE,CAAC,CAAA;IACR,CAAC;IAEO,uBAAuB,CAAC,WAAmB,EAAE,UAAuC,EAAE,cAAwB;QACpH,MAAM,OAAO,GAAa,EAAE,CAAA;QAC5B,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;QAEvD,sDAAsD;QACtD,OAAO,OAAO,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACxB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;QAED,oDAAoD;QACpD,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAkB;oBACzB,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,KAAK,EAAE,mCAAmC;iBACrD,CAAA;gBACD,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;gBAC/B,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,+BAA+B,CAAC,WAAmB,EAAE,UAAuC,EAAE,UAAqC;QACzI,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;QAEvD,OAAO,OAAO,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACrC,IAAI,KAAK,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;YACvB,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,OAOlC;QACC,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;QACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAEpD,qBAAqB;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC7C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QAC3D,CAAC;QAED,kDAAkD;QAClD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAA;YAC/C,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,eAAe,EAAE,GAAG,EAAE,CACpB,IAAI,iBAAQ,CAAC;oBACX,IAAI;wBACF,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;wBAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBACjB,CAAC;iBACF,CAAC;gBACJ,QAAQ;gBACR,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;aAChC,CAAA;QACH,CAAC;QAED,sFAAsF;QACtF,MAAM,IAAI,CAAC,2BAA2B,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAEzF,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,WAAW;YACjB,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAChD,QAAQ;YACR,IAAI;SACL,CAAA;QAED,uBAAuB;QACvB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,OAAO,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACxC,CAAC;QAED,qDAAqD;QACrD,IAAI,IAAI,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,CAAA;QAC/B,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;QAChD,CAAC;QAED,OAAO;YACL,GAAG,UAAU;YACb,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,IAAI;SACd,CAAA;IACH,CAAC;IAEO,YAAY,CAAC,OAAwB;QAC3C,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QAE7D,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;YACtC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAA;YACV,CAAC;YAED,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACpC,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACpC,IAAI,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAA;YACV,CAAC;YACD,IAAI,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,CAAA;YACX,CAAC;YAED,0BAA0B;YAC1B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACvB,CAAC,CAAC,CAAA;QAEF,IAAI,gBAA0D,CAAA;QAC9D,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7B,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAA;YAE5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;YAC1C,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC;gBACjE,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;YAClC,CAAC;YAED,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAA;gBAC5F,CAAC;gBACD,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YACvC,CAAC;QACH,CAAC;QAED,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;YAChD,gBAAgB;SACjB,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,UAAoB;QAClE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAA,8BAAe,EAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAA;QACd,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9D,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,KAAK,CAAC,2BAA2B,CAAC,IAAY,EAAE,aAAqB;QAC3E,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAA;QACxC,MAAM,SAAS,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;QAEtD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,CAAA;QAElD,+BAA+B;QAC/B,IAAI,SAAS,KAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,UAAU,CAAC,SAAS,CAAC,CAAA,EAAE,CAAC;YACjD,OAAM;QACR,CAAC;QAED,6BAA6B;QAC7B,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,EAAE,CAAC;YACxD,OAAM;QACR,CAAC;QAED,iBAAiB;QACjB,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,EAAE,CAAC;YACvD,kBAAG,CAAC,KAAK,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAA;YAC9D,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,wBAAwB,QAAQ,kDAAkD,CAAC,CAAA;QAC9H,CAAC;QAED,4DAA4D;QAC5D,kBAAG,CAAC,KAAK,CAAC,SAAS,EAAE,4DAA4D,CAAC,CAAA;IACpF,CAAC;CACF;AA/SD,oCA+SC","sourcesContent":["import type { AsarStreamType, AsarDirectory } from \"@electron/asar\"\nimport { isEmptyOrSpaces, log } from \"builder-util\"\nimport { dynamicImport } from \"../util/dynamicImport\"\nimport { exists, Filter, FilterStats } from \"builder-util/out/fs\"\nimport * as fs from \"fs-extra\"\nimport { readlink } from \"fs-extra\"\nimport * as path from \"path\"\nimport { AsarOptions } from \"../options/PlatformSpecificBuildOptions\"\nimport { PlatformPackager } from \"../platformPackager\"\nimport { ResolvedFileSet, getDestinationPath } from \"../util/appFileCopier\"\nimport { detectUnpackedDirs } from \"./unpackDetector\"\nimport { Readable } from \"stream\"\nimport * as os from \"os\"\n\nconst resolvePath = async (file: string | undefined): Promise<string | undefined> => (file && (await exists(file)) ? fs.realpath(file).catch(() => path.resolve(file)) : undefined)\nconst resolvePaths = async (filepaths: (string | undefined)[]) => {\n  return Promise.all(filepaths.map(resolvePath)).then(paths => paths.filter((it): it is string => it != null))\n}\n\nconst DENYLIST = resolvePaths([\n  \"/usr\",\n  \"/lib\",\n  \"/bin\",\n  \"/sbin\",\n  \"/etc\",\n\n  \"/tmp\",\n  \"/var\", // block whole /var by default. If $HOME is under /var, it's explicitly in ALLOWLIST - https://github.com/electron-userland/electron-builder/issues/9025#issuecomment-3575380041\n\n  // macOS system directories\n  \"/System\",\n  \"/Library\",\n  \"/private\",\n\n  // Windows system directories\n  process.env.SystemRoot,\n  process.env.WINDIR,\n])\n\nconst ALLOWLIST = resolvePaths([\n  os.tmpdir(), // always allow temp dir\n  os.homedir(), // always allow home dir\n])\n\n/** @internal */\nexport class AsarPackager {\n  private readonly outFile: string\n\n  constructor(\n    readonly packager: PlatformPackager<any>,\n    private readonly config: {\n      defaultDestination: string\n      resourcePath: string\n      options: AsarOptions\n      unpackPattern: Filter | undefined\n    }\n  ) {\n    this.outFile = path.join(config.resourcePath, `app.asar`)\n  }\n\n  async pack(fileSets: Array<ResolvedFileSet>) {\n    const orderedFileSets = [\n      // Write dependencies first to minimize offset changes to asar header\n      ...fileSets.slice(1),\n\n      // Finish with the app files that change most often\n      fileSets[0],\n    ].map(set => this.orderFileSet(set))\n\n    const streams = await this.processFileSets(orderedFileSets)\n    await this.executeElectronAsar(streams)\n  }\n\n  private async executeElectronAsar(streams: AsarStreamType[]) {\n    // override logger temporarily to clean up console (electron/asar does some internal logging that blogs up the default electron-builder logs)\n    const consoleLogger = console.log\n    console.log = (...args) => {\n      if (args[0] === \"Ordering file has 100% coverage.\") {\n        return // no need to log, this means our ordering logic is working correctly\n      }\n      log.info({ args }, \"logging @electron/asar\")\n    }\n    const { createPackageFromStreams } = await dynamicImport<typeof import(\"@electron/asar\")>(\"@electron/asar\")\n    await createPackageFromStreams(this.outFile, streams)\n    console.log = consoleLogger\n  }\n\n  private async processFileSets(fileSets: ResolvedFileSet[]): Promise<AsarStreamType[]> {\n    const unpackedPaths = new Set<string>()\n    if (this.config.options.smartUnpack !== false) {\n      for (const fileSet of fileSets) {\n        detectUnpackedDirs(fileSet, unpackedPaths)\n      }\n    }\n\n    const resultsMap = new Map<string, AsarStreamType>()\n    const streamOrdering: string[] = []\n    const normalizedUnpackedPaths = Array.from(unpackedPaths).map(p => path.normalize(p))\n\n    // Check whether a file or directory should be unpacked, using pre-normalized unpacked paths and early returns\n    const isUnpacked = (dir: string, file?: string, stat?: FilterStats): boolean => {\n      const normalizedDir = path.normalize(dir)\n\n      // Check file pattern first (most specific)\n      if (!isEmptyOrSpaces(file) && stat && this.config.unpackPattern?.(file, stat)) {\n        return true\n      }\n\n      // Check if path is within any unpacked directory\n      for (const unpackedPath of normalizedUnpackedPaths) {\n        if (normalizedDir === unpackedPath || normalizedDir.startsWith(unpackedPath + path.sep)) {\n          return true\n        }\n      }\n\n      return false\n    }\n\n    // First pass: process all files in order, ensuring parent directories exist\n    for (const fileSet of fileSets) {\n      // Don't use Promise.all, we need to retain order of execution/iteration through the already-ordered fileset\n      for (const [index, file] of fileSet.files.entries()) {\n        const transformedData = fileSet.transformedFiles?.get(index)\n        const stat = fileSet.metadata.get(file)!\n        const destination = path.relative(this.config.defaultDestination, getDestinationPath(file, fileSet))\n\n        // Ensure parent directories exist before processing file\n        this.ensureParentDirectories(destination, resultsMap, streamOrdering)\n\n        const result = await this.processFileOrSymlink({\n          file,\n          destination,\n          fileSet,\n          transformedData,\n          stat,\n          isUnpacked,\n        })\n\n        if (result && !resultsMap.has(result.path)) {\n          resultsMap.set(result.path, result)\n          streamOrdering.push(result.path)\n        }\n      }\n    }\n\n    // Second pass: propagate unpacked flag to parent directories\n    for (const entry of resultsMap.values()) {\n      if (entry.unpacked) {\n        this.markParentDirectoriesAsUnpacked(entry.path, resultsMap, isUnpacked)\n      }\n    }\n\n    // Build final results array maintaining processing order\n    return streamOrdering.reduce<AsarStreamType[]>((streams, path) => {\n      const stream = resultsMap.has(path) ? resultsMap.get(path) : null\n      if (stream != null) {\n        streams.push(stream)\n      }\n      return streams\n    }, [])\n  }\n\n  private ensureParentDirectories(destination: string, resultsMap: Map<string, AsarStreamType>, streamOrdering: string[]): void {\n    const parents: string[] = []\n    let current = path.dirname(path.normalize(destination))\n\n    // Collect all parent directories from deepest to root\n    while (current !== \".\") {\n      parents.unshift(current)\n      current = path.dirname(current)\n    }\n\n    // Add parent directories in order (root to deepest)\n    for (const parentPath of parents) {\n      if (!resultsMap.has(parentPath)) {\n        const dir: AsarDirectory = {\n          type: \"directory\",\n          path: parentPath,\n          unpacked: false, // Updated in second pass if needed\n        }\n        resultsMap.set(parentPath, dir)\n        streamOrdering.push(parentPath)\n      }\n    }\n  }\n\n  private markParentDirectoriesAsUnpacked(destination: string, resultsMap: Map<string, AsarStreamType>, isUnpacked: (path: string) => boolean): void {\n    let current = path.dirname(path.normalize(destination))\n\n    while (current !== \".\") {\n      const entry = resultsMap.get(current)\n      if (entry && isUnpacked(current)) {\n        entry.unpacked = true\n      }\n      current = path.dirname(current)\n    }\n  }\n\n  private async processFileOrSymlink(options: {\n    file: string\n    destination: string\n    stat: fs.Stats\n    fileSet: ResolvedFileSet\n    transformedData: string | Buffer | undefined\n    isUnpacked: (dir: string, file?: string, stat?: FilterStats) => boolean\n  }): Promise<AsarStreamType> {\n    const { isUnpacked, transformedData, file, destination, stat } = options\n    const unpacked = isUnpacked(destination, file, stat)\n\n    // Handle directories\n    if (!stat.isFile() && !stat.isSymbolicLink()) {\n      return { path: destination, unpacked, type: \"directory\" }\n    }\n\n    // Handle transformed data (pre-processed content)\n    if (transformedData != null) {\n      const size = Buffer.byteLength(transformedData)\n      return {\n        path: destination,\n        streamGenerator: () =>\n          new Readable({\n            read() {\n              this.push(transformedData)\n              this.push(null)\n            },\n          }),\n        unpacked,\n        type: \"file\",\n        stat: { mode: stat.mode, size },\n      }\n    }\n\n    // verify that the file is not a direct link or symlinked to access/copy a system file\n    await this.protectSystemAndUnsafePaths(file, await this.packager.info.getWorkspaceRoot())\n\n    const baseConfig = {\n      path: destination,\n      streamGenerator: () => fs.createReadStream(file),\n      unpacked,\n      stat,\n    }\n\n    // Handle regular files\n    if (!stat.isSymbolicLink()) {\n      return { ...baseConfig, type: \"file\" }\n    }\n\n    // Handle symlinks - make relative to source location\n    let link = await readlink(file)\n    if (path.isAbsolute(link)) {\n      link = path.relative(path.dirname(file), link)\n    }\n\n    return {\n      ...baseConfig,\n      type: \"link\",\n      symlink: link,\n    }\n  }\n\n  private orderFileSet(fileSet: ResolvedFileSet): ResolvedFileSet {\n    const sortedFileEntries = Array.from(fileSet.files.entries())\n\n    sortedFileEntries.sort(([, a], [, b]) => {\n      if (a === b) {\n        return 0\n      }\n\n      // Place addons last because their signature changes per build\n      const isAAddon = a.endsWith(\".node\")\n      const isBAddon = b.endsWith(\".node\")\n      if (isAAddon && !isBAddon) {\n        return 1\n      }\n      if (isBAddon && !isAAddon) {\n        return -1\n      }\n\n      // Otherwise order by name\n      return a < b ? -1 : 1\n    })\n\n    let transformedFiles: Map<number, string | Buffer> | undefined\n    if (fileSet.transformedFiles) {\n      transformedFiles = new Map()\n\n      const indexMap = new Map<number, number>()\n      for (const [newIndex, [oldIndex]] of sortedFileEntries.entries()) {\n        indexMap.set(oldIndex, newIndex)\n      }\n\n      for (const [oldIndex, value] of fileSet.transformedFiles) {\n        const newIndex = indexMap.get(oldIndex)\n        if (newIndex === undefined) {\n          throw new Error(`Internal error: ${fileSet.files[oldIndex]} was lost while ordering asar`)\n        }\n        transformedFiles.set(newIndex, value)\n      }\n    }\n\n    return {\n      src: fileSet.src,\n      destination: fileSet.destination,\n      metadata: fileSet.metadata,\n      files: sortedFileEntries.map(([, file]) => file),\n      transformedFiles,\n    }\n  }\n\n  private async checkAgainstRoots(target: string, allowRoots: string[]): Promise<boolean> {\n    const resolved = await resolvePath(target)\n    if (resolved == null || isEmptyOrSpaces(resolved)) {\n      return false\n    }\n\n    for (const root of allowRoots) {\n      if (resolved === root || resolved.startsWith(root + path.sep)) {\n        return true\n      }\n    }\n    return false\n  }\n\n  private async protectSystemAndUnsafePaths(file: string, workspaceRoot: string): Promise<void> {\n    const resolved = await resolvePath(file)\n    const logFields = { source: file, realPath: resolved }\n\n    const workspace = await resolvePath(workspaceRoot)\n\n    // If in workspace, always safe\n    if (workspace && resolved?.startsWith(workspace)) {\n      return\n    }\n\n    // Check allowlist (priority)\n    if (await this.checkAgainstRoots(file, await ALLOWLIST)) {\n      return\n    }\n\n    // Check denylist\n    if (await this.checkAgainstRoots(file, await DENYLIST)) {\n      log.error(logFields, `denied access to system or unsafe path`)\n      throw new Error(`Cannot copy file [${file}] symlinked to file [${resolved}] outside the package to a system or unsafe path`)\n    }\n\n    // Default: outside explicit paths but not explicitly denied\n    log.debug(logFields, `path is outside of explicit safe paths, defaulting to safe`)\n  }\n}\n"]}

package/out/asar/integrity.d.ts

@@ -1,15 +0,0 @@
-import { FileMatcher } from "../fileMatcher";
-export interface AsarIntegrityOptions {
-    readonly resourcesPath: string;
-    readonly resourcesRelativePath: string;
-    readonly resourcesDestinationPath: string;
-    readonly extraResourceMatchers: Array<FileMatcher> | null;
-}
-export interface HeaderHash {
-    algorithm: "SHA256";
-    hash: string;
-}
-export interface AsarIntegrity {
-    [key: string]: HeaderHash;
-}
-export declare function computeData({ resourcesPath, resourcesRelativePath, resourcesDestinationPath, extraResourceMatchers }: AsarIntegrityOptions): Promise<AsarIntegrity>;

package/out/asar/integrity.js

@@ -1,62 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.computeData = computeData;
-const builder_util_1 = require("builder-util");
-const crypto_1 = require("crypto");
-const promises_1 = require("fs/promises");
-const path = require("path");
-const asar_1 = require("./asar");
-async function computeData({ resourcesPath, resourcesRelativePath, resourcesDestinationPath, extraResourceMatchers }) {
-    const isAsar = (filepath) => filepath.endsWith(".asar");
-    const resources = await (0, promises_1.readdir)(resourcesPath);
-    const resourceAsars = resources.filter(isAsar).reduce((prev, filename) => ({
-        ...prev,
-        [path.join(resourcesRelativePath, filename)]: path.join(resourcesPath, filename),
-    }), {});
-    const extraResources = await Promise.all((extraResourceMatchers !== null && extraResourceMatchers !== void 0 ? extraResourceMatchers : []).map(async (matcher) => {
-        const { from, to } = matcher;
-        const stat = await (0, builder_util_1.statOrNull)(from);
-        if (stat == null) {
-            builder_util_1.log.warn({ from }, `file source doesn't exist`);
-            return [];
-        }
-        if (stat.isFile()) {
-            return [{ from, to }];
-        }
-        if (matcher.isEmpty() || matcher.containsOnlyIgnore()) {
-            matcher.prependPattern("**/*");
-        }
-        const matcherFilter = matcher.createFilter();
-        const extraResourceMatches = await (0, builder_util_1.walk)(matcher.from, (file, stats) => matcherFilter(file, stats) || stats.isDirectory());
-        return extraResourceMatches.map(from => ({ from, to: matcher.to }));
-    }));
-    const extraResourceAsars = extraResources
-        .flat(1)
-        .filter(match => isAsar(match.from))
-        .reduce((prev, { to, from }) => {
-        const prefix = path.relative(resourcesDestinationPath, to);
-        return {
-            ...prev,
-            [path.join(resourcesRelativePath, prefix, path.basename(from))]: from,
-        };
-    }, {});
-    // sort to produce constant result
-    const allAsars = [...Object.entries(resourceAsars), ...Object.entries(extraResourceAsars)].sort(([name1], [name2]) => name1.localeCompare(name2));
-    const hashes = await Promise.all(allAsars.map(async ([, from]) => hashHeader(from)));
-    const asarIntegrity = {};
-    for (let i = 0; i < allAsars.length; i++) {
-        const [asar] = allAsars[i];
-        asarIntegrity[asar] = hashes[i];
-    }
-    return asarIntegrity;
-}
-async function hashHeader(file) {
-    const hash = (0, crypto_1.createHash)("sha256");
-    const { header } = await (0, asar_1.readAsarHeader)(file);
-    hash.update(header);
-    return {
-        algorithm: "SHA256",
-        hash: hash.digest("hex"),
-    };
-}
-//# sourceMappingURL=integrity.js.map

package/out/asar/integrity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../src/asar/integrity.ts"],"names":[],"mappings":";;AAuBA,kCAwDC;AA/ED,+CAAiE;AACjE,mCAAmC;AACnC,0CAAqC;AACrC,6BAA4B;AAE5B,iCAAuC;AAkBhC,KAAK,UAAU,WAAW,CAAC,EAAE,aAAa,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,qBAAqB,EAAwB;IAK/I,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE/D,MAAM,SAAS,GAAG,MAAM,IAAA,kBAAO,EAAC,aAAa,CAAC,CAAA;IAC9C,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CACnD,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnB,GAAG,IAAI;QACP,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC;KACjF,CAAC,EACF,EAAE,CACH,CAAA;IAED,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,GAAG,CACtC,CAAC,qBAAqB,aAArB,qBAAqB,cAArB,qBAAqB,GAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,OAAoB,EAAoB,EAAE;QACjF,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAA;QAC5B,MAAM,IAAI,GAAG,MAAM,IAAA,yBAAU,EAAC,IAAI,CAAC,CAAA;QACnC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,2BAA2B,CAAC,CAAA;YAC/C,OAAO,EAAE,CAAA;QACX,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAClB,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACvB,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;YACtD,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAChC,CAAC;QACD,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY,EAAE,CAAA;QAC5C,MAAM,oBAAoB,GAAG,MAAM,IAAA,mBAAI,EAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAY,EAAE,KAAkB,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;QAC9I,OAAO,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACrE,CAAC,CAAC,CACH,CAAA;IACD,MAAM,kBAAkB,GAAG,cAAc;SACtC,IAAI,CAAC,CAAC,CAAC;SACP,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACnC,MAAM,CAAe,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAA;QAC1D,OAAO;YACL,GAAG,IAAI;YACP,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI;SACtE,CAAA;IACH,CAAC,EAAE,EAAE,CAAC,CAAA;IAER,kCAAkC;IAClC,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;IACjJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACpF,MAAM,aAAa,GAAkB,EAAE,CAAA;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;QAC1B,aAAa,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,aAAa,CAAA;AACtB,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAA;IACjC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAc,EAAC,IAAI,CAAC,CAAA;IAC7C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACnB,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;KACzB,CAAA;AACH,CAAC","sourcesContent":["import { FilterStats, log, statOrNull, walk } from \"builder-util\"\nimport { createHash } from \"crypto\"\nimport { readdir } from \"fs/promises\"\nimport * as path from \"path\"\nimport { FileMatcher } from \"../fileMatcher\"\nimport { readAsarHeader } from \"./asar\"\n\nexport interface AsarIntegrityOptions {\n  readonly resourcesPath: string\n  readonly resourcesRelativePath: string\n  readonly resourcesDestinationPath: string\n  readonly extraResourceMatchers: Array<FileMatcher> | null\n}\n\nexport interface HeaderHash {\n  algorithm: \"SHA256\"\n  hash: string\n}\n\nexport interface AsarIntegrity {\n  [key: string]: HeaderHash\n}\n\nexport async function computeData({ resourcesPath, resourcesRelativePath, resourcesDestinationPath, extraResourceMatchers }: AsarIntegrityOptions): Promise<AsarIntegrity> {\n  type Match = Pick<FileMatcher, \"to\" | \"from\">\n  type IntegrityMap = {\n    [filepath: string]: string\n  }\n  const isAsar = (filepath: string) => filepath.endsWith(\".asar\")\n\n  const resources = await readdir(resourcesPath)\n  const resourceAsars = resources.filter(isAsar).reduce<IntegrityMap>(\n    (prev, filename) => ({\n      ...prev,\n      [path.join(resourcesRelativePath, filename)]: path.join(resourcesPath, filename),\n    }),\n    {}\n  )\n\n  const extraResources = await Promise.all(\n    (extraResourceMatchers ?? []).map(async (matcher: FileMatcher): Promise<Match[]> => {\n      const { from, to } = matcher\n      const stat = await statOrNull(from)\n      if (stat == null) {\n        log.warn({ from }, `file source doesn't exist`)\n        return []\n      }\n      if (stat.isFile()) {\n        return [{ from, to }]\n      }\n\n      if (matcher.isEmpty() || matcher.containsOnlyIgnore()) {\n        matcher.prependPattern(\"**/*\")\n      }\n      const matcherFilter = matcher.createFilter()\n      const extraResourceMatches = await walk(matcher.from, (file: string, stats: FilterStats) => matcherFilter(file, stats) || stats.isDirectory())\n      return extraResourceMatches.map(from => ({ from, to: matcher.to }))\n    })\n  )\n  const extraResourceAsars = extraResources\n    .flat(1)\n    .filter(match => isAsar(match.from))\n    .reduce<IntegrityMap>((prev, { to, from }) => {\n      const prefix = path.relative(resourcesDestinationPath, to)\n      return {\n        ...prev,\n        [path.join(resourcesRelativePath, prefix, path.basename(from))]: from,\n      }\n    }, {})\n\n  // sort to produce constant result\n  const allAsars = [...Object.entries(resourceAsars), ...Object.entries(extraResourceAsars)].sort(([name1], [name2]) => name1.localeCompare(name2))\n  const hashes = await Promise.all(allAsars.map(async ([, from]) => hashHeader(from)))\n  const asarIntegrity: AsarIntegrity = {}\n  for (let i = 0; i < allAsars.length; i++) {\n    const [asar] = allAsars[i]\n    asarIntegrity[asar] = hashes[i]\n  }\n  return asarIntegrity\n}\n\nasync function hashHeader(file: string): Promise<HeaderHash> {\n  const hash = createHash(\"sha256\")\n  const { header } = await readAsarHeader(file)\n  hash.update(header)\n  return {\n    algorithm: \"SHA256\",\n    hash: hash.digest(\"hex\"),\n  }\n}\n"]}

package/out/asar/unpackDetector.d.ts

@@ -1 +0,0 @@
-export declare function isLibOrExe(file: string): boolean;

package/out/asar/unpackDetector.js

@@ -1,43 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isLibOrExe = isLibOrExe;
-exports.detectUnpackedDirs = detectUnpackedDirs;
-const builder_util_1 = require("builder-util");
-const isbinaryfile_1 = require("isbinaryfile");
-const path = require("path");
-function isLibOrExe(file) {
-    // https://github.com/electron-userland/electron-builder/issues/3038
-    return file.endsWith(".dll") || file.endsWith(".exe") || file.endsWith(".dylib") || file.endsWith(".so") || file.endsWith(".node");
-}
-/** @internal */
-function detectUnpackedDirs(fileSet, autoUnpackDirs) {
-    const metadata = fileSet.metadata;
-    for (let i = 0, n = fileSet.files.length; i < n; i++) {
-        const file = fileSet.files[i];
-        const stat = metadata.get(file);
-        if (!stat.moduleRootPath || autoUnpackDirs.has(stat.moduleRootPath)) {
-            continue;
-        }
-        if (!stat.isFile()) {
-            continue;
-        }
-        // https://github.com/electron-userland/electron-builder/issues/2679
-        let shouldUnpack = false;
-        // ffprobe-static and ffmpeg-static are known packages to always unpack
-        const moduleName = stat.moduleName;
-        const fileBaseName = path.basename(file);
-        const hasExtension = path.extname(fileBaseName);
-        if (moduleName === "ffprobe-static" || moduleName === "ffmpeg-static" || isLibOrExe(file)) {
-            shouldUnpack = true;
-        }
-        else if (!hasExtension) {
-            shouldUnpack = !!(0, isbinaryfile_1.isBinaryFileSync)(file);
-        }
-        if (!shouldUnpack) {
-            continue;
-        }
-        builder_util_1.log.debug({ file: stat.moduleFullFilePath, reason: "contains executable code" }, "not packed into asar archive");
-        autoUnpackDirs.add(stat.moduleRootPath);
-    }
-}
-//# sourceMappingURL=unpackDetector.js.map

package/out/asar/unpackDetector.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"unpackDetector.js","sourceRoot":"","sources":["../../src/asar/unpackDetector.ts"],"names":[],"mappings":";;AAKA,gCAGC;AAGD,gDAiCC;AA5CD,+CAA+C;AAC/C,+CAA+C;AAC/C,6BAA4B;AAG5B,SAAgB,UAAU,CAAC,IAAY;IACrC,oEAAoE;IACpE,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AACpI,CAAC;AAED,gBAAgB;AAChB,SAAgB,kBAAkB,CAAC,OAAwB,EAAE,cAA2B;IACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IAEjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC7B,MAAM,IAAI,GAAgB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;QAC7C,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACpE,SAAQ;QACV,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,SAAQ;QACV,CAAC;QAED,oEAAoE;QACpE,IAAI,YAAY,GAAG,KAAK,CAAA;QACxB,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACxC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAC/C,IAAI,UAAU,KAAK,gBAAgB,IAAI,UAAU,KAAK,eAAe,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1F,YAAY,GAAG,IAAI,CAAA;QACrB,CAAC;aAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACzB,YAAY,GAAG,CAAC,CAAC,IAAA,+BAAgB,EAAC,IAAI,CAAC,CAAA;QACzC,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,SAAQ;QACV,CAAC;QAED,kBAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,8BAA8B,CAAC,CAAA;QAChH,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACzC,CAAC;AACH,CAAC","sourcesContent":["import { FilterStats, log } from \"builder-util\"\nimport { isBinaryFileSync } from \"isbinaryfile\"\nimport * as path from \"path\"\nimport { ResolvedFileSet } from \"../util/appFileCopier\"\n\nexport function isLibOrExe(file: string): boolean {\n  // https://github.com/electron-userland/electron-builder/issues/3038\n  return file.endsWith(\".dll\") || file.endsWith(\".exe\") || file.endsWith(\".dylib\") || file.endsWith(\".so\") || file.endsWith(\".node\")\n}\n\n/** @internal */\nexport function detectUnpackedDirs(fileSet: ResolvedFileSet, autoUnpackDirs: Set<string>) {\n  const metadata = fileSet.metadata\n\n  for (let i = 0, n = fileSet.files.length; i < n; i++) {\n    const file = fileSet.files[i]\n    const stat: FilterStats = metadata.get(file)!\n    if (!stat.moduleRootPath || autoUnpackDirs.has(stat.moduleRootPath)) {\n      continue\n    }\n\n    if (!stat.isFile()) {\n      continue\n    }\n\n    // https://github.com/electron-userland/electron-builder/issues/2679\n    let shouldUnpack = false\n    // ffprobe-static and ffmpeg-static are known packages to always unpack\n    const moduleName = stat.moduleName\n    const fileBaseName = path.basename(file)\n    const hasExtension = path.extname(fileBaseName)\n    if (moduleName === \"ffprobe-static\" || moduleName === \"ffmpeg-static\" || isLibOrExe(file)) {\n      shouldUnpack = true\n    } else if (!hasExtension) {\n      shouldUnpack = !!isBinaryFileSync(file)\n    }\n\n    if (!shouldUnpack) {\n      continue\n    }\n\n    log.debug({ file: stat.moduleFullFilePath, reason: \"contains executable code\" }, \"not packed into asar archive\")\n    autoUnpackDirs.add(stat.moduleRootPath)\n  }\n}\n"]}

package/out/binDownload.d.ts

@@ -1,5 +0,0 @@
-import { Nullish } from "builder-util-runtime";
-export declare function download(url: string, output: string, checksum?: string | null): Promise<void>;
-export declare function getBinFromCustomLoc(name: string, version: string, binariesLocUrl: string, checksum: string): Promise<string>;
-export declare function getBinFromUrl(releaseName: string, filenameWithExt: string, checksum: string, githubOrgRepo?: string): Promise<string>;
-export declare function getBin(cacheKey: string, url?: string | Nullish, checksum?: string | Nullish): Promise<string>;

package/out/binDownload.js

@@ -1,104 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.download = download;
-exports.getBinFromCustomLoc = getBinFromCustomLoc;
-exports.getBinFromUrl = getBinFromUrl;
-exports.getBin = getBin;
-const fs = require("fs/promises");
-const builder_util_1 = require("builder-util");
-const dynamicImport_1 = require("./util/dynamicImport");
-const filename_1 = require("builder-util/out/filename");
-const path = require("path");
-const electronGet_1 = require("./util/electronGet");
-const versionToPromise = new Map();
-async function download(url, output, checksum) {
-    const filenameWithExt = path.basename(new URL(url).pathname);
-    if (checksum == null) {
-        // Without a checksum, a download intercepted via a rogue mirror, tampered CDN
-        // edge, or DNS spoofing can substitute a malicious payload undetected.
-        // Callers should supply a checksum whenever possible.
-        builder_util_1.log.warn({ url }, "downloading without an integrity checksum — the download is not verified against a known-good hash");
-    }
-    const { downloadArtifact, ElectronDownloadCacheMode } = await (0, dynamicImport_1.dynamicImport)("@electron/get");
-    const downloadedFile = await downloadArtifact({
-        version: "9.9.9",
-        artifactName: filenameWithExt,
-        cacheRoot: path.resolve((0, electronGet_1.getCacheDirectory)({ allowEnvVarOverride: true }), "downloads"),
-        cacheMode: ElectronDownloadCacheMode.ReadWrite,
-        ...(checksum != null ? { checksums: { [filenameWithExt]: checksum } } : { unsafelyDisableChecksums: true }),
-        mirrorOptions: { resolveAssetURL: async () => Promise.resolve(url) },
-        isGeneric: true,
-    });
-    await fs.copyFile(downloadedFile, output);
-}
-function getBinFromCustomLoc(name, version, binariesLocUrl, checksum) {
-    const dirName = `${name}-${version}`;
-    return getBin(dirName, binariesLocUrl, checksum);
-}
-/**
- * Validates a binary-download custom-directory value read from an environment
- * variable.  These values are interpolated directly into a download URL; a
- * malicious value (e.g. set via a postinstall hook in node_modules) could
- * redirect tool downloads to an attacker-controlled server.
- *
- * Allowed: relative path components such as "v1.0.0-custom" or "my-mirror/nsis".
- * Rejected: anything containing "://", ".." (traversal), or a leading "/" (which
- * could make the resulting URL protocol-relative or change the host).
- */
-function validateBinaryCustomDir(envVarName, value) {
-    if (value.includes("://") || value.includes("..") || value.startsWith("/")) {
-        throw new Error(`${envVarName} must be a safe relative path component (e.g. "v1.0.0-custom"). Values containing "://", "..", or a leading "/" are not allowed. Got: "${value}"`);
-    }
-    return value;
-}
-function getBinFromUrl(releaseName, filenameWithExt, checksum, githubOrgRepo = "electron-userland/electron-builder-binaries") {
-    if (/[/\\]|^\.\./.test(filenameWithExt) || filenameWithExt.includes("..")) {
-        throw new Error(`getBinFromUrl: unsafe filenameWithExt "${filenameWithExt}" — must be a plain filename with no path separators or traversal sequences`);
-    }
-    let url;
-    const overrideUrl = (0, builder_util_1.parseValidEnvVarUrl)("ELECTRON_BUILDER_BINARIES_DOWNLOAD_OVERRIDE_URL");
-    if (overrideUrl != null) {
-        url = overrideUrl + "/" + filenameWithExt;
-    }
-    else {
-        const baseUrl = (0, electronGet_1.getBinariesMirrorUrl)(githubOrgRepo);
-        // Any of these env vars can redirect downloads to a custom release directory.
-        // Validate each one before interpolating into the URL.
-        const CUSTOM_DIR_ENV_VARS = [
-            "NPM_CONFIG_ELECTRON_BUILDER_BINARIES_CUSTOM_DIR",
-            "npm_config_electron_builder_binaries_custom_dir",
-            "npm_package_config_electron_builder_binaries_custom_dir",
-            "ELECTRON_BUILDER_BINARIES_CUSTOM_DIR",
-        ];
-        const customDirEntry = CUSTOM_DIR_ENV_VARS.map(name => ({ name, value: process.env[name] })).find(e => e.value != null);
-        const middleUrl = customDirEntry != null ? validateBinaryCustomDir(customDirEntry.name, customDirEntry.value) : releaseName;
-        url = `${baseUrl}${middleUrl}/${filenameWithExt}`;
-    }
-    const cacheKey = `${releaseName}-${path.basename(filenameWithExt, path.extname(filenameWithExt))}`;
-    return getBin(cacheKey, url, checksum);
-}
-function getBin(cacheKey, url, checksum) {
-    var _a;
-    const cacheName = (0, filename_1.sanitizeFileName)(`${(_a = process.env.ELECTRON_BUILDER_CACHE) !== null && _a !== void 0 ? _a : ""}${cacheKey}`);
-    let promise = versionToPromise.get(cacheName);
-    if (promise != null) {
-        return promise;
-    }
-    if (url == null) {
-        throw new Error(`getBin("${cacheKey}"): a download URL is required. ` +
-            `The no-URL legacy path (e.g. winCodeSign "0.0.0") is no longer used — ` +
-            `it now downloads from winCodeSign-2.6.0 automatically.`);
-    }
-    const filenameWithExt = path.basename(url);
-    const overrideUrl = url.substring(0, url.lastIndexOf("/"));
-    const releaseName = path.basename(overrideUrl);
-    promise = (0, electronGet_1.downloadBuilderToolset)({
-        releaseName,
-        filenameWithExt,
-        checksums: checksum != null ? { [filenameWithExt]: checksum } : undefined,
-        overrideUrl,
-    });
-    versionToPromise.set(cacheName, promise);
-    return promise;
-}
-//# sourceMappingURL=binDownload.js.map

package/out/binDownload.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"binDownload.js","sourceRoot":"","sources":["../src/binDownload.ts"],"names":[],"mappings":";;AAUA,4BAmBC;AAED,kDAGC;AAmBD,sCAyBC;AAED,wBA2BC;AA3GD,kCAAiC;AACjC,+CAAuD;AACvD,wDAAoD;AAEpD,wDAA4D;AAC5D,6BAA4B;AAC5B,oDAAoG;AAEpG,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAA;AAEpD,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,QAAwB;IAClF,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC5D,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,8EAA8E;QAC9E,uEAAuE;QACvE,sDAAsD;QACtD,kBAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oGAAoG,CAAC,CAAA;IACzH,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,GAAG,MAAM,IAAA,6BAAa,EAAiC,eAAe,CAAC,CAAA;IAC5H,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC;QAC5C,OAAO,EAAE,OAAO;QAChB,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,IAAA,+BAAiB,EAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,CAAC;QACtF,SAAS,EAAE,yBAAyB,CAAC,SAAS;QAC9C,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;QAC3G,aAAa,EAAE,EAAE,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QACpE,SAAS,EAAE,IAAI;KAChB,CAAC,CAAA;IACF,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;AAC3C,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAAY,EAAE,OAAe,EAAE,cAAsB,EAAE,QAAgB;IACzG,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAA;IACpC,OAAO,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAAC,UAAkB,EAAE,KAAa;IAChE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,0IAA0I,KAAK,GAAG,CAAC,CAAA;IAClL,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAgB,aAAa,CAAC,WAAmB,EAAE,eAAuB,EAAE,QAAgB,EAAE,aAAa,GAAG,6CAA6C;IACzJ,IAAI,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,0CAA0C,eAAe,6EAA6E,CAAC,CAAA;IACzJ,CAAC;IACD,IAAI,GAAW,CAAA;IACf,MAAM,WAAW,GAAG,IAAA,kCAAmB,EAAC,iDAAiD,CAAC,CAAA;IAC1F,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,GAAG,GAAG,WAAW,GAAG,GAAG,GAAG,eAAe,CAAA;IAC3C,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,IAAA,kCAAoB,EAAC,aAAa,CAAC,CAAA;QACnD,8EAA8E;QAC9E,uDAAuD;QACvD,MAAM,mBAAmB,GAAG;YAC1B,iDAAiD;YACjD,iDAAiD;YACjD,yDAAyD;YACzD,sCAAsC;SAC9B,CAAA;QACV,MAAM,cAAc,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAA;QACvH,MAAM,SAAS,GAAG,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,KAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;QAC5H,GAAG,GAAG,GAAG,OAAO,GAAG,SAAS,IAAI,eAAe,EAAE,CAAA;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,EAAE,CAAA;IAClG,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;AACxC,CAAC;AAED,SAAgB,MAAM,CAAC,QAAgB,EAAE,GAAsB,EAAE,QAA2B;;IAC1F,MAAM,SAAS,GAAG,IAAA,2BAAgB,EAAC,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,sBAAsB,mCAAI,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAA;IAC5F,IAAI,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC7C,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,WAAW,QAAQ,kCAAkC;YACnD,wEAAwE;YACxE,wDAAwD,CAC3D,CAAA;IACH,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAE9C,OAAO,GAAG,IAAA,oCAAsB,EAAC;QAC/B,WAAW;QACX,eAAe;QACf,SAAS,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;QACzE,WAAW;KACZ,CAAC,CAAA;IACF,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACxC,OAAO,OAAO,CAAA;AAChB,CAAC","sourcesContent":["import * as fs from \"fs/promises\"\nimport { log, parseValidEnvVarUrl } from \"builder-util\"\nimport { dynamicImport } from \"./util/dynamicImport\"\nimport { Nullish } from \"builder-util-runtime\"\nimport { sanitizeFileName } from \"builder-util/out/filename\"\nimport * as path from \"path\"\nimport { downloadBuilderToolset, getBinariesMirrorUrl, getCacheDirectory } from \"./util/electronGet\"\n\nconst versionToPromise = new Map<string, Promise<string>>()\n\nexport async function download(url: string, output: string, checksum?: string | null): Promise<void> {\n  const filenameWithExt = path.basename(new URL(url).pathname)\n  if (checksum == null) {\n    // Without a checksum, a download intercepted via a rogue mirror, tampered CDN\n    // edge, or DNS spoofing can substitute a malicious payload undetected.\n    // Callers should supply a checksum whenever possible.\n    log.warn({ url }, \"downloading without an integrity checksum — the download is not verified against a known-good hash\")\n  }\n  const { downloadArtifact, ElectronDownloadCacheMode } = await dynamicImport<typeof import(\"@electron/get\")>(\"@electron/get\")\n  const downloadedFile = await downloadArtifact({\n    version: \"9.9.9\",\n    artifactName: filenameWithExt,\n    cacheRoot: path.resolve(getCacheDirectory({ allowEnvVarOverride: true }), \"downloads\"),\n    cacheMode: ElectronDownloadCacheMode.ReadWrite,\n    ...(checksum != null ? { checksums: { [filenameWithExt]: checksum } } : { unsafelyDisableChecksums: true }),\n    mirrorOptions: { resolveAssetURL: async () => Promise.resolve(url) },\n    isGeneric: true,\n  })\n  await fs.copyFile(downloadedFile, output)\n}\n\nexport function getBinFromCustomLoc(name: string, version: string, binariesLocUrl: string, checksum: string): Promise<string> {\n  const dirName = `${name}-${version}`\n  return getBin(dirName, binariesLocUrl, checksum)\n}\n\n/**\n * Validates a binary-download custom-directory value read from an environment\n * variable.  These values are interpolated directly into a download URL; a\n * malicious value (e.g. set via a postinstall hook in node_modules) could\n * redirect tool downloads to an attacker-controlled server.\n *\n * Allowed: relative path components such as \"v1.0.0-custom\" or \"my-mirror/nsis\".\n * Rejected: anything containing \"://\", \"..\" (traversal), or a leading \"/\" (which\n * could make the resulting URL protocol-relative or change the host).\n */\nfunction validateBinaryCustomDir(envVarName: string, value: string): string {\n  if (value.includes(\"://\") || value.includes(\"..\") || value.startsWith(\"/\")) {\n    throw new Error(`${envVarName} must be a safe relative path component (e.g. \"v1.0.0-custom\"). Values containing \"://\", \"..\", or a leading \"/\" are not allowed. Got: \"${value}\"`)\n  }\n  return value\n}\n\nexport function getBinFromUrl(releaseName: string, filenameWithExt: string, checksum: string, githubOrgRepo = \"electron-userland/electron-builder-binaries\"): Promise<string> {\n  if (/[/\\\\]|^\\.\\./.test(filenameWithExt) || filenameWithExt.includes(\"..\")) {\n    throw new Error(`getBinFromUrl: unsafe filenameWithExt \"${filenameWithExt}\" — must be a plain filename with no path separators or traversal sequences`)\n  }\n  let url: string\n  const overrideUrl = parseValidEnvVarUrl(\"ELECTRON_BUILDER_BINARIES_DOWNLOAD_OVERRIDE_URL\")\n  if (overrideUrl != null) {\n    url = overrideUrl + \"/\" + filenameWithExt\n  } else {\n    const baseUrl = getBinariesMirrorUrl(githubOrgRepo)\n    // Any of these env vars can redirect downloads to a custom release directory.\n    // Validate each one before interpolating into the URL.\n    const CUSTOM_DIR_ENV_VARS = [\n      \"NPM_CONFIG_ELECTRON_BUILDER_BINARIES_CUSTOM_DIR\",\n      \"npm_config_electron_builder_binaries_custom_dir\",\n      \"npm_package_config_electron_builder_binaries_custom_dir\",\n      \"ELECTRON_BUILDER_BINARIES_CUSTOM_DIR\",\n    ] as const\n    const customDirEntry = CUSTOM_DIR_ENV_VARS.map(name => ({ name, value: process.env[name] })).find(e => e.value != null)\n    const middleUrl = customDirEntry != null ? validateBinaryCustomDir(customDirEntry.name, customDirEntry.value!) : releaseName\n    url = `${baseUrl}${middleUrl}/${filenameWithExt}`\n  }\n\n  const cacheKey = `${releaseName}-${path.basename(filenameWithExt, path.extname(filenameWithExt))}`\n  return getBin(cacheKey, url, checksum)\n}\n\nexport function getBin(cacheKey: string, url?: string | Nullish, checksum?: string | Nullish): Promise<string> {\n  const cacheName = sanitizeFileName(`${process.env.ELECTRON_BUILDER_CACHE ?? \"\"}${cacheKey}`)\n  let promise = versionToPromise.get(cacheName)\n  if (promise != null) {\n    return promise\n  }\n\n  if (url == null) {\n    throw new Error(\n      `getBin(\"${cacheKey}\"): a download URL is required. ` +\n        `The no-URL legacy path (e.g. winCodeSign \"0.0.0\") is no longer used — ` +\n        `it now downloads from winCodeSign-2.6.0 automatically.`\n    )\n  }\n\n  const filenameWithExt = path.basename(url)\n  const overrideUrl = url.substring(0, url.lastIndexOf(\"/\"))\n  const releaseName = path.basename(overrideUrl)\n\n  promise = downloadBuilderToolset({\n    releaseName,\n    filenameWithExt,\n    checksums: checksum != null ? { [filenameWithExt]: checksum } : undefined,\n    overrideUrl,\n  })\n  versionToPromise.set(cacheName, promise)\n  return promise\n}\n"]}