app-builder-lib 26.15.3 → 27.0.0-alpha.1

package/dist/asar/asarUtil.js

@@ -0,0 +1,278 @@
+import { exists, isEmptyOrSpaces, log } from "builder-util";
+import { dynamicImport } from "../util/dynamicImport.js";
+import fs from "fs-extra";
+import * as path from "path";
+import { getDestinationPath } from "../util/appFileCopier.js";
+import { detectUnpackedDirs } from "./unpackDetector.js";
+import { Readable } from "stream";
+import * as os from "os";
+const { readlink } = fs;
+const resolvePath = async (file) => (file && (await exists(file)) ? fs.realpath(file).catch(() => path.resolve(file)) : undefined);
+const resolvePaths = async (filepaths) => {
+    return Promise.all(filepaths.map(resolvePath)).then(paths => paths.filter((it) => it != null));
+};
+const DENYLIST = resolvePaths([
+    "/usr",
+    "/lib",
+    "/bin",
+    "/sbin",
+    "/etc",
+    "/tmp",
+    "/var", // block whole /var by default. If $HOME is under /var, it's explicitly in ALLOWLIST - https://github.com/electron-userland/electron-builder/issues/9025#issuecomment-3575380041
+    // macOS system directories
+    "/System",
+    "/Library",
+    "/private",
+    // Windows system directories
+    process.env.SystemRoot,
+    process.env.WINDIR,
+]);
+const ALLOWLIST = resolvePaths([
+    os.tmpdir(), // always allow temp dir
+    os.homedir(), // always allow home dir
+]);
+/** @internal */
+export class AsarPackager {
+    constructor(packager, config) {
+        this.packager = packager;
+        this.config = config;
+        this.outFile = path.join(config.resourcePath, `app.asar`);
+    }
+    async pack(fileSets) {
+        const orderedFileSets = [
+            // Write dependencies first to minimize offset changes to asar header
+            ...fileSets.slice(1),
+            // Finish with the app files that change most often
+            fileSets[0],
+        ].map(set => this.orderFileSet(set));
+        const streams = await this.processFileSets(orderedFileSets);
+        await this.executeElectronAsar(streams);
+    }
+    async executeElectronAsar(streams) {
+        // override logger temporarily to clean up console (electron/asar does some internal logging that blogs up the default electron-builder logs)
+        const consoleLogger = console.log;
+        console.log = (...args) => {
+            if (args[0] === "Ordering file has 100% coverage.") {
+                return; // no need to log, this means our ordering logic is working correctly
+            }
+            log.info({ args }, "logging @electron/asar");
+        };
+        const { createPackageFromStreams } = await dynamicImport("@electron/asar");
+        await createPackageFromStreams(this.outFile, streams);
+        console.log = consoleLogger;
+    }
+    async processFileSets(fileSets) {
+        const unpackedPaths = new Set();
+        if (this.config.options.smartUnpack !== false) {
+            for (const fileSet of fileSets) {
+                detectUnpackedDirs(fileSet, unpackedPaths);
+            }
+        }
+        const resultsMap = new Map();
+        const streamOrdering = [];
+        const normalizedUnpackedPaths = Array.from(unpackedPaths).map(p => path.normalize(p));
+        // Check whether a file or directory should be unpacked, using pre-normalized unpacked paths and early returns
+        const isUnpacked = (dir, file, stat) => {
+            const normalizedDir = path.normalize(dir);
+            // Check file pattern first (most specific)
+            if (!isEmptyOrSpaces(file) && stat && this.config.unpackPattern?.(file, stat)) {
+                return true;
+            }
+            // Check if path is within any unpacked directory
+            for (const unpackedPath of normalizedUnpackedPaths) {
+                if (normalizedDir === unpackedPath || normalizedDir.startsWith(unpackedPath + path.sep)) {
+                    return true;
+                }
+            }
+            return false;
+        };
+        // First pass: process all files in order, ensuring parent directories exist
+        for (const fileSet of fileSets) {
+            // Don't use Promise.all, we need to retain order of execution/iteration through the already-ordered fileset
+            for (const [index, file] of fileSet.files.entries()) {
+                const transformedData = fileSet.transformedFiles?.get(index);
+                const stat = fileSet.metadata.get(file);
+                const destination = path.relative(this.config.defaultDestination, getDestinationPath(file, fileSet));
+                // Ensure parent directories exist before processing file
+                this.ensureParentDirectories(destination, resultsMap, streamOrdering);
+                const result = await this.processFileOrSymlink({
+                    file,
+                    destination,
+                    fileSet,
+                    transformedData,
+                    stat,
+                    isUnpacked,
+                });
+                if (result && !resultsMap.has(result.path)) {
+                    resultsMap.set(result.path, result);
+                    streamOrdering.push(result.path);
+                }
+            }
+        }
+        // Second pass: propagate unpacked flag to parent directories
+        for (const entry of resultsMap.values()) {
+            if (entry.unpacked) {
+                this.markParentDirectoriesAsUnpacked(entry.path, resultsMap, isUnpacked);
+            }
+        }
+        // Build final results array maintaining processing order
+        return streamOrdering.reduce((streams, path) => {
+            const stream = resultsMap.has(path) ? resultsMap.get(path) : null;
+            if (stream != null) {
+                streams.push(stream);
+            }
+            return streams;
+        }, []);
+    }
+    ensureParentDirectories(destination, resultsMap, streamOrdering) {
+        const parents = [];
+        let current = path.dirname(path.normalize(destination));
+        // Collect all parent directories from deepest to root
+        while (current !== ".") {
+            parents.unshift(current);
+            current = path.dirname(current);
+        }
+        // Add parent directories in order (root to deepest)
+        for (const parentPath of parents) {
+            if (!resultsMap.has(parentPath)) {
+                const dir = {
+                    type: "directory",
+                    path: parentPath,
+                    unpacked: false, // Updated in second pass if needed
+                };
+                resultsMap.set(parentPath, dir);
+                streamOrdering.push(parentPath);
+            }
+        }
+    }
+    markParentDirectoriesAsUnpacked(destination, resultsMap, isUnpacked) {
+        let current = path.dirname(path.normalize(destination));
+        while (current !== ".") {
+            const entry = resultsMap.get(current);
+            if (entry && isUnpacked(current)) {
+                entry.unpacked = true;
+            }
+            current = path.dirname(current);
+        }
+    }
+    async processFileOrSymlink(options) {
+        const { isUnpacked, transformedData, file, destination, stat } = options;
+        const unpacked = isUnpacked(destination, file, stat);
+        // Handle directories
+        if (!stat.isFile() && !stat.isSymbolicLink()) {
+            return { path: destination, unpacked, type: "directory" };
+        }
+        // Handle transformed data (pre-processed content)
+        if (transformedData != null) {
+            const size = Buffer.byteLength(transformedData);
+            return {
+                path: destination,
+                streamGenerator: () => new Readable({
+                    read() {
+                        this.push(transformedData);
+                        this.push(null);
+                    },
+                }),
+                unpacked,
+                type: "file",
+                stat: { mode: stat.mode, size },
+            };
+        }
+        // verify that the file is not a direct link or symlinked to access/copy a system file
+        await this.protectSystemAndUnsafePaths(file, await this.packager.getWorkspaceRoot());
+        const baseConfig = {
+            path: destination,
+            streamGenerator: () => fs.createReadStream(file),
+            unpacked,
+            stat,
+        };
+        // Handle regular files
+        if (!stat.isSymbolicLink()) {
+            return { ...baseConfig, type: "file" };
+        }
+        // Handle symlinks - make relative to source location
+        let link = await readlink(file);
+        if (path.isAbsolute(link)) {
+            link = path.relative(path.dirname(file), link);
+        }
+        return {
+            ...baseConfig,
+            type: "link",
+            symlink: link,
+        };
+    }
+    orderFileSet(fileSet) {
+        const sortedFileEntries = Array.from(fileSet.files.entries());
+        sortedFileEntries.sort(([, a], [, b]) => {
+            if (a === b) {
+                return 0;
+            }
+            // Place addons last because their signature changes per build
+            const isAAddon = a.endsWith(".node");
+            const isBAddon = b.endsWith(".node");
+            if (isAAddon && !isBAddon) {
+                return 1;
+            }
+            if (isBAddon && !isAAddon) {
+                return -1;
+            }
+            // Otherwise order by name
+            return a < b ? -1 : 1;
+        });
+        let transformedFiles;
+        if (fileSet.transformedFiles) {
+            transformedFiles = new Map();
+            const indexMap = new Map();
+            for (const [newIndex, [oldIndex]] of sortedFileEntries.entries()) {
+                indexMap.set(oldIndex, newIndex);
+            }
+            for (const [oldIndex, value] of fileSet.transformedFiles) {
+                const newIndex = indexMap.get(oldIndex);
+                if (newIndex === undefined) {
+                    throw new Error(`Internal error: ${fileSet.files[oldIndex]} was lost while ordering asar`);
+                }
+                transformedFiles.set(newIndex, value);
+            }
+        }
+        return {
+            src: fileSet.src,
+            destination: fileSet.destination,
+            metadata: fileSet.metadata,
+            files: sortedFileEntries.map(([, file]) => file),
+            transformedFiles,
+        };
+    }
+    async checkAgainstRoots(target, allowRoots) {
+        const resolved = await resolvePath(target);
+        if (resolved == null || isEmptyOrSpaces(resolved)) {
+            return false;
+        }
+        for (const root of allowRoots) {
+            if (resolved === root || resolved.startsWith(root + path.sep)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    async protectSystemAndUnsafePaths(file, workspaceRoot) {
+        const resolved = await resolvePath(file);
+        const logFields = { source: file, realPath: resolved };
+        const workspace = await resolvePath(workspaceRoot);
+        // If in workspace, always safe
+        if (workspace && resolved?.startsWith(workspace)) {
+            return;
+        }
+        // Check allowlist (priority)
+        if (await this.checkAgainstRoots(file, await ALLOWLIST)) {
+            return;
+        }
+        // Check denylist
+        if (await this.checkAgainstRoots(file, await DENYLIST)) {
+            log.error(logFields, `denied access to system or unsafe path`);
+            throw new Error(`Cannot copy file [${file}] symlinked to file [${resolved}] outside the package to a system or unsafe path`);
+        }
+        // Default: outside explicit paths but not explicitly denied
+        log.debug(logFields, `path is outside of explicit safe paths, defaulting to safe`);
+    }
+}
+//# sourceMappingURL=asarUtil.js.map

package/dist/asar/asarUtil.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asarUtil.js","sourceRoot":"","sources":["../../src/asar/asarUtil.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAuB,eAAe,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,MAAM,UAAU,CAAA;AAEzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAG5B,OAAO,EAAmB,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAA;AAEvB,MAAM,WAAW,GAAG,KAAK,EAAE,IAAwB,EAA+B,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AACnL,MAAM,YAAY,GAAG,KAAK,EAAE,SAAiC,EAAE,EAAE;IAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAA;AAC9G,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,YAAY,CAAC;IAC5B,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IAEN,MAAM;IACN,MAAM,EAAE,gLAAgL;IAExL,2BAA2B;IAC3B,SAAS;IACT,UAAU;IACV,UAAU;IAEV,6BAA6B;IAC7B,OAAO,CAAC,GAAG,CAAC,UAAU;IACtB,OAAO,CAAC,GAAG,CAAC,MAAM;CACnB,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,YAAY,CAAC;IAC7B,EAAE,CAAC,MAAM,EAAE,EAAE,wBAAwB;IACrC,EAAE,CAAC,OAAO,EAAE,EAAE,wBAAwB;CACvC,CAAC,CAAA;AAEF,gBAAgB;AAChB,MAAM,OAAO,YAAY;IAGvB,YACW,QAA+B,EACvB,MAKhB;QANQ,aAAQ,GAAR,QAAQ,CAAuB;QACvB,WAAM,GAAN,MAAM,CAKtB;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgC;QACzC,MAAM,eAAe,GAAG;YACtB,qEAAqE;YACrE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAEpB,mDAAmD;YACnD,QAAQ,CAAC,CAAC,CAAC;SACZ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;QAEpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAA;QAC3D,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAA;IACzC,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,OAAyB;QACzD,6IAA6I;QAC7I,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAA;QACjC,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,kCAAkC,EAAE,CAAC;gBACnD,OAAM,CAAC,qEAAqE;YAC9E,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAA;QAC9C,CAAC,CAAA;QACD,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,aAAa,CAAkC,gBAAgB,CAAC,CAAA;QAC3G,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACrD,OAAO,CAAC,GAAG,GAAG,aAAa,CAAA;IAC7B,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,QAA2B;QACvD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;QACvC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAA;QACpD,MAAM,cAAc,GAAa,EAAE,CAAA;QACnC,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;QAErF,8GAA8G;QAC9G,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAa,EAAE,IAAkB,EAAW,EAAE;YAC7E,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;YAEzC,2CAA2C;YAC3C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC9E,OAAO,IAAI,CAAA;YACb,CAAC;YAED,iDAAiD;YACjD,KAAK,MAAM,YAAY,IAAI,uBAAuB,EAAE,CAAC;gBACnD,IAAI,aAAa,KAAK,YAAY,IAAI,aAAa,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxF,OAAO,IAAI,CAAA;gBACb,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAA;QACd,CAAC,CAAA;QAED,4EAA4E;QAC5E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,4GAA4G;YAC5G,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBACpD,MAAM,eAAe,GAAG,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;gBACxC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;gBAEpG,yDAAyD;gBACzD,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC,CAAA;gBAErE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC;oBAC7C,IAAI;oBACJ,WAAW;oBACX,OAAO;oBACP,eAAe;oBACf,IAAI;oBACJ,UAAU;iBACX,CAAC,CAAA;gBAEF,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3C,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;oBACnC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;YAC1E,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,OAAO,cAAc,CAAC,MAAM,CAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACjE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACtB,CAAC;YACD,OAAO,OAAO,CAAA;QAChB,CAAC,EAAE,EAAE,CAAC,CAAA;IACR,CAAC;IAEO,uBAAuB,CAAC,WAAmB,EAAE,UAAuC,EAAE,cAAwB;QACpH,MAAM,OAAO,GAAa,EAAE,CAAA;QAC5B,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;QAEvD,sDAAsD;QACtD,OAAO,OAAO,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACxB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;QAED,oDAAoD;QACpD,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAkB;oBACzB,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,KAAK,EAAE,mCAAmC;iBACrD,CAAA;gBACD,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;gBAC/B,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,+BAA+B,CAAC,WAAmB,EAAE,UAAuC,EAAE,UAAqC;QACzI,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;QAEvD,OAAO,OAAO,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACrC,IAAI,KAAK,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;YACvB,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,OAOlC;QACC,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;QACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAEpD,qBAAqB;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC7C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QAC3D,CAAC;QAED,kDAAkD;QAClD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAA;YAC/C,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,eAAe,EAAE,GAAG,EAAE,CACpB,IAAI,QAAQ,CAAC;oBACX,IAAI;wBACF,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;wBAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBACjB,CAAC;iBACF,CAAC;gBACJ,QAAQ;gBACR,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;aAChC,CAAA;QACH,CAAC;QAED,sFAAsF;QACtF,MAAM,IAAI,CAAC,2BAA2B,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAEpF,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,WAAW;YACjB,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAChD,QAAQ;YACR,IAAI;SACL,CAAA;QAED,uBAAuB;QACvB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,OAAO,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACxC,CAAC;QAED,qDAAqD;QACrD,IAAI,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC/B,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;QAChD,CAAC;QAED,OAAO;YACL,GAAG,UAAU;YACb,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,IAAI;SACd,CAAA;IACH,CAAC;IAEO,YAAY,CAAC,OAAwB;QAC3C,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QAE7D,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;YACtC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAA;YACV,CAAC;YAED,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACpC,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACpC,IAAI,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAA;YACV,CAAC;YACD,IAAI,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,CAAA;YACX,CAAC;YAED,0BAA0B;YAC1B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACvB,CAAC,CAAC,CAAA;QAEF,IAAI,gBAA0D,CAAA;QAC9D,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7B,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAA;YAE5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;YAC1C,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC;gBACjE,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;YAClC,CAAC;YAED,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAA;gBAC5F,CAAC;gBACD,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YACvC,CAAC;QACH,CAAC;QAED,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;YAChD,gBAAgB;SACjB,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,UAAoB;QAClE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,QAAQ,IAAI,IAAI,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAA;QACd,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9D,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,KAAK,CAAC,2BAA2B,CAAC,IAAY,EAAE,aAAqB;QAC3E,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAA;QACxC,MAAM,SAAS,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;QAEtD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,CAAA;QAElD,+BAA+B;QAC/B,IAAI,SAAS,IAAI,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,OAAM;QACR,CAAC;QAED,6BAA6B;QAC7B,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,EAAE,CAAC;YACxD,OAAM;QACR,CAAC;QAED,iBAAiB;QACjB,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAA;YAC9D,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,wBAAwB,QAAQ,kDAAkD,CAAC,CAAA;QAC9H,CAAC;QAED,4DAA4D;QAC5D,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,4DAA4D,CAAC,CAAA;IACpF,CAAC;CACF","sourcesContent":["import type { AsarStreamType, AsarDirectory } from \"@electron/asar\"\nimport { exists, Filter, FilterStats, isEmptyOrSpaces, log } from \"builder-util\"\nimport { dynamicImport } from \"../util/dynamicImport.js\"\nimport fs from \"fs-extra\"\n\nimport * as path from \"path\"\nimport { AsarOptions } from \"../options/PlatformSpecificBuildOptions.js\"\nimport { PlatformPackager } from \"../platformPackager.js\"\nimport { ResolvedFileSet, getDestinationPath } from \"../util/appFileCopier.js\"\nimport { detectUnpackedDirs } from \"./unpackDetector.js\"\nimport { Readable } from \"stream\"\nimport * as os from \"os\"\nconst { readlink } = fs\n\nconst resolvePath = async (file: string | undefined): Promise<string | undefined> => (file && (await exists(file)) ? fs.realpath(file).catch(() => path.resolve(file)) : undefined)\nconst resolvePaths = async (filepaths: (string | undefined)[]) => {\n  return Promise.all(filepaths.map(resolvePath)).then(paths => paths.filter((it): it is string => it != null))\n}\n\nconst DENYLIST = resolvePaths([\n  \"/usr\",\n  \"/lib\",\n  \"/bin\",\n  \"/sbin\",\n  \"/etc\",\n\n  \"/tmp\",\n  \"/var\", // block whole /var by default. If $HOME is under /var, it's explicitly in ALLOWLIST - https://github.com/electron-userland/electron-builder/issues/9025#issuecomment-3575380041\n\n  // macOS system directories\n  \"/System\",\n  \"/Library\",\n  \"/private\",\n\n  // Windows system directories\n  process.env.SystemRoot,\n  process.env.WINDIR,\n])\n\nconst ALLOWLIST = resolvePaths([\n  os.tmpdir(), // always allow temp dir\n  os.homedir(), // always allow home dir\n])\n\n/** @internal */\nexport class AsarPackager {\n  private readonly outFile: string\n\n  constructor(\n    readonly packager: PlatformPackager<any>,\n    private readonly config: {\n      defaultDestination: string\n      resourcePath: string\n      options: AsarOptions\n      unpackPattern: Filter | undefined\n    }\n  ) {\n    this.outFile = path.join(config.resourcePath, `app.asar`)\n  }\n\n  async pack(fileSets: Array<ResolvedFileSet>) {\n    const orderedFileSets = [\n      // Write dependencies first to minimize offset changes to asar header\n      ...fileSets.slice(1),\n\n      // Finish with the app files that change most often\n      fileSets[0],\n    ].map(set => this.orderFileSet(set))\n\n    const streams = await this.processFileSets(orderedFileSets)\n    await this.executeElectronAsar(streams)\n  }\n\n  private async executeElectronAsar(streams: AsarStreamType[]) {\n    // override logger temporarily to clean up console (electron/asar does some internal logging that blogs up the default electron-builder logs)\n    const consoleLogger = console.log\n    console.log = (...args) => {\n      if (args[0] === \"Ordering file has 100% coverage.\") {\n        return // no need to log, this means our ordering logic is working correctly\n      }\n      log.info({ args }, \"logging @electron/asar\")\n    }\n    const { createPackageFromStreams } = await dynamicImport<typeof import(\"@electron/asar\")>(\"@electron/asar\")\n    await createPackageFromStreams(this.outFile, streams)\n    console.log = consoleLogger\n  }\n\n  private async processFileSets(fileSets: ResolvedFileSet[]): Promise<AsarStreamType[]> {\n    const unpackedPaths = new Set<string>()\n    if (this.config.options.smartUnpack !== false) {\n      for (const fileSet of fileSets) {\n        detectUnpackedDirs(fileSet, unpackedPaths)\n      }\n    }\n\n    const resultsMap = new Map<string, AsarStreamType>()\n    const streamOrdering: string[] = []\n    const normalizedUnpackedPaths = Array.from(unpackedPaths).map(p => path.normalize(p))\n\n    // Check whether a file or directory should be unpacked, using pre-normalized unpacked paths and early returns\n    const isUnpacked = (dir: string, file?: string, stat?: FilterStats): boolean => {\n      const normalizedDir = path.normalize(dir)\n\n      // Check file pattern first (most specific)\n      if (!isEmptyOrSpaces(file) && stat && this.config.unpackPattern?.(file, stat)) {\n        return true\n      }\n\n      // Check if path is within any unpacked directory\n      for (const unpackedPath of normalizedUnpackedPaths) {\n        if (normalizedDir === unpackedPath || normalizedDir.startsWith(unpackedPath + path.sep)) {\n          return true\n        }\n      }\n\n      return false\n    }\n\n    // First pass: process all files in order, ensuring parent directories exist\n    for (const fileSet of fileSets) {\n      // Don't use Promise.all, we need to retain order of execution/iteration through the already-ordered fileset\n      for (const [index, file] of fileSet.files.entries()) {\n        const transformedData = fileSet.transformedFiles?.get(index)\n        const stat = fileSet.metadata.get(file)!\n        const destination = path.relative(this.config.defaultDestination, getDestinationPath(file, fileSet))\n\n        // Ensure parent directories exist before processing file\n        this.ensureParentDirectories(destination, resultsMap, streamOrdering)\n\n        const result = await this.processFileOrSymlink({\n          file,\n          destination,\n          fileSet,\n          transformedData,\n          stat,\n          isUnpacked,\n        })\n\n        if (result && !resultsMap.has(result.path)) {\n          resultsMap.set(result.path, result)\n          streamOrdering.push(result.path)\n        }\n      }\n    }\n\n    // Second pass: propagate unpacked flag to parent directories\n    for (const entry of resultsMap.values()) {\n      if (entry.unpacked) {\n        this.markParentDirectoriesAsUnpacked(entry.path, resultsMap, isUnpacked)\n      }\n    }\n\n    // Build final results array maintaining processing order\n    return streamOrdering.reduce<AsarStreamType[]>((streams, path) => {\n      const stream = resultsMap.has(path) ? resultsMap.get(path) : null\n      if (stream != null) {\n        streams.push(stream)\n      }\n      return streams\n    }, [])\n  }\n\n  private ensureParentDirectories(destination: string, resultsMap: Map<string, AsarStreamType>, streamOrdering: string[]): void {\n    const parents: string[] = []\n    let current = path.dirname(path.normalize(destination))\n\n    // Collect all parent directories from deepest to root\n    while (current !== \".\") {\n      parents.unshift(current)\n      current = path.dirname(current)\n    }\n\n    // Add parent directories in order (root to deepest)\n    for (const parentPath of parents) {\n      if (!resultsMap.has(parentPath)) {\n        const dir: AsarDirectory = {\n          type: \"directory\",\n          path: parentPath,\n          unpacked: false, // Updated in second pass if needed\n        }\n        resultsMap.set(parentPath, dir)\n        streamOrdering.push(parentPath)\n      }\n    }\n  }\n\n  private markParentDirectoriesAsUnpacked(destination: string, resultsMap: Map<string, AsarStreamType>, isUnpacked: (path: string) => boolean): void {\n    let current = path.dirname(path.normalize(destination))\n\n    while (current !== \".\") {\n      const entry = resultsMap.get(current)\n      if (entry && isUnpacked(current)) {\n        entry.unpacked = true\n      }\n      current = path.dirname(current)\n    }\n  }\n\n  private async processFileOrSymlink(options: {\n    file: string\n    destination: string\n    stat: fs.Stats\n    fileSet: ResolvedFileSet\n    transformedData: string | Buffer | undefined\n    isUnpacked: (dir: string, file?: string, stat?: FilterStats) => boolean\n  }): Promise<AsarStreamType> {\n    const { isUnpacked, transformedData, file, destination, stat } = options\n    const unpacked = isUnpacked(destination, file, stat)\n\n    // Handle directories\n    if (!stat.isFile() && !stat.isSymbolicLink()) {\n      return { path: destination, unpacked, type: \"directory\" }\n    }\n\n    // Handle transformed data (pre-processed content)\n    if (transformedData != null) {\n      const size = Buffer.byteLength(transformedData)\n      return {\n        path: destination,\n        streamGenerator: () =>\n          new Readable({\n            read() {\n              this.push(transformedData)\n              this.push(null)\n            },\n          }),\n        unpacked,\n        type: \"file\",\n        stat: { mode: stat.mode, size },\n      }\n    }\n\n    // verify that the file is not a direct link or symlinked to access/copy a system file\n    await this.protectSystemAndUnsafePaths(file, await this.packager.getWorkspaceRoot())\n\n    const baseConfig = {\n      path: destination,\n      streamGenerator: () => fs.createReadStream(file),\n      unpacked,\n      stat,\n    }\n\n    // Handle regular files\n    if (!stat.isSymbolicLink()) {\n      return { ...baseConfig, type: \"file\" }\n    }\n\n    // Handle symlinks - make relative to source location\n    let link = await readlink(file)\n    if (path.isAbsolute(link)) {\n      link = path.relative(path.dirname(file), link)\n    }\n\n    return {\n      ...baseConfig,\n      type: \"link\",\n      symlink: link,\n    }\n  }\n\n  private orderFileSet(fileSet: ResolvedFileSet): ResolvedFileSet {\n    const sortedFileEntries = Array.from(fileSet.files.entries())\n\n    sortedFileEntries.sort(([, a], [, b]) => {\n      if (a === b) {\n        return 0\n      }\n\n      // Place addons last because their signature changes per build\n      const isAAddon = a.endsWith(\".node\")\n      const isBAddon = b.endsWith(\".node\")\n      if (isAAddon && !isBAddon) {\n        return 1\n      }\n      if (isBAddon && !isAAddon) {\n        return -1\n      }\n\n      // Otherwise order by name\n      return a < b ? -1 : 1\n    })\n\n    let transformedFiles: Map<number, string | Buffer> | undefined\n    if (fileSet.transformedFiles) {\n      transformedFiles = new Map()\n\n      const indexMap = new Map<number, number>()\n      for (const [newIndex, [oldIndex]] of sortedFileEntries.entries()) {\n        indexMap.set(oldIndex, newIndex)\n      }\n\n      for (const [oldIndex, value] of fileSet.transformedFiles) {\n        const newIndex = indexMap.get(oldIndex)\n        if (newIndex === undefined) {\n          throw new Error(`Internal error: ${fileSet.files[oldIndex]} was lost while ordering asar`)\n        }\n        transformedFiles.set(newIndex, value)\n      }\n    }\n\n    return {\n      src: fileSet.src,\n      destination: fileSet.destination,\n      metadata: fileSet.metadata,\n      files: sortedFileEntries.map(([, file]) => file),\n      transformedFiles,\n    }\n  }\n\n  private async checkAgainstRoots(target: string, allowRoots: string[]): Promise<boolean> {\n    const resolved = await resolvePath(target)\n    if (resolved == null || isEmptyOrSpaces(resolved)) {\n      return false\n    }\n\n    for (const root of allowRoots) {\n      if (resolved === root || resolved.startsWith(root + path.sep)) {\n        return true\n      }\n    }\n    return false\n  }\n\n  private async protectSystemAndUnsafePaths(file: string, workspaceRoot: string): Promise<void> {\n    const resolved = await resolvePath(file)\n    const logFields = { source: file, realPath: resolved }\n\n    const workspace = await resolvePath(workspaceRoot)\n\n    // If in workspace, always safe\n    if (workspace && resolved?.startsWith(workspace)) {\n      return\n    }\n\n    // Check allowlist (priority)\n    if (await this.checkAgainstRoots(file, await ALLOWLIST)) {\n      return\n    }\n\n    // Check denylist\n    if (await this.checkAgainstRoots(file, await DENYLIST)) {\n      log.error(logFields, `denied access to system or unsafe path`)\n      throw new Error(`Cannot copy file [${file}] symlinked to file [${resolved}] outside the package to a system or unsafe path`)\n    }\n\n    // Default: outside explicit paths but not explicitly denied\n    log.debug(logFields, `path is outside of explicit safe paths, defaulting to safe`)\n  }\n}\n"]}

package/dist/asar/integrity.d.ts

@@ -0,0 +1,16 @@
+import { FileMatcher } from "../fileMatcher.js";
+export interface AsarIntegrityOptions {
+    readonly resourcesPath: string;
+    readonly resourcesRelativePath: string;
+    readonly resourcesDestinationPath: string;
+    readonly extraResourceMatchers: Array<FileMatcher> | null;
+}
+export interface HeaderHash {
+    algorithm: "SHA256";
+    hash: string;
+}
+export interface AsarIntegrity {
+    [key: string]: HeaderHash;
+}
+export declare function computeData({ resourcesPath, resourcesRelativePath, resourcesDestinationPath, extraResourceMatchers }: AsarIntegrityOptions): Promise<AsarIntegrity>;
+//# sourceMappingURL=integrity.d.ts.map

package/dist/asar/integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.d.ts","sourceRoot":"","sources":["../../src/asar/integrity.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAG/C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAA;IACzC,QAAQ,CAAC,qBAAqB,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,IAAI,CAAA;CAC1D;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,QAAQ,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,aAAa;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAA;CAC1B;AAED,wBAAsB,WAAW,CAAC,EAAE,aAAa,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CAwDzK"}

package/dist/asar/integrity.js

@@ -0,0 +1,59 @@
+import { log, statOrNull, walk } from "builder-util";
+import { createHash } from "crypto";
+import { readdir } from "fs/promises";
+import * as path from "path";
+import { readAsarHeader } from "./asar.js";
+export async function computeData({ resourcesPath, resourcesRelativePath, resourcesDestinationPath, extraResourceMatchers }) {
+    const isAsar = (filepath) => filepath.endsWith(".asar");
+    const resources = await readdir(resourcesPath);
+    const resourceAsars = resources.filter(isAsar).reduce((prev, filename) => ({
+        ...prev,
+        [path.join(resourcesRelativePath, filename)]: path.join(resourcesPath, filename),
+    }), {});
+    const extraResources = await Promise.all((extraResourceMatchers ?? []).map(async (matcher) => {
+        const { from, to } = matcher;
+        const stat = await statOrNull(from);
+        if (stat == null) {
+            log.warn({ from }, `file source doesn't exist`);
+            return [];
+        }
+        if (stat.isFile()) {
+            return [{ from, to }];
+        }
+        if (matcher.isEmpty() || matcher.containsOnlyIgnore()) {
+            matcher.prependPattern("**/*");
+        }
+        const matcherFilter = matcher.createFilter();
+        const extraResourceMatches = await walk(matcher.from, (file, stats) => matcherFilter(file, stats) || stats.isDirectory());
+        return extraResourceMatches.map(from => ({ from, to: matcher.to }));
+    }));
+    const extraResourceAsars = extraResources
+        .flat(1)
+        .filter(match => isAsar(match.from))
+        .reduce((prev, { to, from }) => {
+        const prefix = path.relative(resourcesDestinationPath, to);
+        return {
+            ...prev,
+            [path.join(resourcesRelativePath, prefix, path.basename(from))]: from,
+        };
+    }, {});
+    // sort to produce constant result
+    const allAsars = [...Object.entries(resourceAsars), ...Object.entries(extraResourceAsars)].sort(([name1], [name2]) => name1.localeCompare(name2));
+    const hashes = await Promise.all(allAsars.map(async ([, from]) => hashHeader(from)));
+    const asarIntegrity = {};
+    for (let i = 0; i < allAsars.length; i++) {
+        const [asar] = allAsars[i];
+        asarIntegrity[asar] = hashes[i];
+    }
+    return asarIntegrity;
+}
+async function hashHeader(file) {
+    const hash = createHash("sha256");
+    const { header } = await readAsarHeader(file);
+    hash.update(header);
+    return {
+        algorithm: "SHA256",
+        hash: hash.digest("hex"),
+    };
+}
+//# sourceMappingURL=integrity.js.map

package/dist/asar/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../src/asar/integrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAkB1C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAE,aAAa,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,qBAAqB,EAAwB;IAK/I,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE/D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;IAC9C,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CACnD,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnB,GAAG,IAAI;QACP,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC;KACjF,CAAC,EACF,EAAE,CACH,CAAA;IAED,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,GAAG,CACtC,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,OAAoB,EAAoB,EAAE;QACjF,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAA;QAC5B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,2BAA2B,CAAC,CAAA;YAC/C,OAAO,EAAE,CAAA;QACX,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAClB,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACvB,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;YACtD,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAChC,CAAC;QACD,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY,EAAE,CAAA;QAC5C,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAY,EAAE,KAAkB,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;QAC9I,OAAO,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACrE,CAAC,CAAC,CACH,CAAA;IACD,MAAM,kBAAkB,GAAG,cAAc;SACtC,IAAI,CAAC,CAAC,CAAC;SACP,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACnC,MAAM,CAAe,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAA;QAC1D,OAAO;YACL,GAAG,IAAI;YACP,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI;SACtE,CAAA;IACH,CAAC,EAAE,EAAE,CAAC,CAAA;IAER,kCAAkC;IAClC,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;IACjJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACpF,MAAM,aAAa,GAAkB,EAAE,CAAA;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;QAC1B,aAAa,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,aAAa,CAAA;AACtB,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACjC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAA;IAC7C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACnB,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;KACzB,CAAA;AACH,CAAC","sourcesContent":["import { FilterStats, log, statOrNull, walk } from \"builder-util\"\nimport { createHash } from \"crypto\"\nimport { readdir } from \"fs/promises\"\nimport * as path from \"path\"\nimport { FileMatcher } from \"../fileMatcher.js\"\nimport { readAsarHeader } from \"./asar.js\"\n\nexport interface AsarIntegrityOptions {\n  readonly resourcesPath: string\n  readonly resourcesRelativePath: string\n  readonly resourcesDestinationPath: string\n  readonly extraResourceMatchers: Array<FileMatcher> | null\n}\n\nexport interface HeaderHash {\n  algorithm: \"SHA256\"\n  hash: string\n}\n\nexport interface AsarIntegrity {\n  [key: string]: HeaderHash\n}\n\nexport async function computeData({ resourcesPath, resourcesRelativePath, resourcesDestinationPath, extraResourceMatchers }: AsarIntegrityOptions): Promise<AsarIntegrity> {\n  type Match = Pick<FileMatcher, \"to\" | \"from\">\n  type IntegrityMap = {\n    [filepath: string]: string\n  }\n  const isAsar = (filepath: string) => filepath.endsWith(\".asar\")\n\n  const resources = await readdir(resourcesPath)\n  const resourceAsars = resources.filter(isAsar).reduce<IntegrityMap>(\n    (prev, filename) => ({\n      ...prev,\n      [path.join(resourcesRelativePath, filename)]: path.join(resourcesPath, filename),\n    }),\n    {}\n  )\n\n  const extraResources = await Promise.all(\n    (extraResourceMatchers ?? []).map(async (matcher: FileMatcher): Promise<Match[]> => {\n      const { from, to } = matcher\n      const stat = await statOrNull(from)\n      if (stat == null) {\n        log.warn({ from }, `file source doesn't exist`)\n        return []\n      }\n      if (stat.isFile()) {\n        return [{ from, to }]\n      }\n\n      if (matcher.isEmpty() || matcher.containsOnlyIgnore()) {\n        matcher.prependPattern(\"**/*\")\n      }\n      const matcherFilter = matcher.createFilter()\n      const extraResourceMatches = await walk(matcher.from, (file: string, stats: FilterStats) => matcherFilter(file, stats) || stats.isDirectory())\n      return extraResourceMatches.map(from => ({ from, to: matcher.to }))\n    })\n  )\n  const extraResourceAsars = extraResources\n    .flat(1)\n    .filter(match => isAsar(match.from))\n    .reduce<IntegrityMap>((prev, { to, from }) => {\n      const prefix = path.relative(resourcesDestinationPath, to)\n      return {\n        ...prev,\n        [path.join(resourcesRelativePath, prefix, path.basename(from))]: from,\n      }\n    }, {})\n\n  // sort to produce constant result\n  const allAsars = [...Object.entries(resourceAsars), ...Object.entries(extraResourceAsars)].sort(([name1], [name2]) => name1.localeCompare(name2))\n  const hashes = await Promise.all(allAsars.map(async ([, from]) => hashHeader(from)))\n  const asarIntegrity: AsarIntegrity = {}\n  for (let i = 0; i < allAsars.length; i++) {\n    const [asar] = allAsars[i]\n    asarIntegrity[asar] = hashes[i]\n  }\n  return asarIntegrity\n}\n\nasync function hashHeader(file: string): Promise<HeaderHash> {\n  const hash = createHash(\"sha256\")\n  const { header } = await readAsarHeader(file)\n  hash.update(header)\n  return {\n    algorithm: \"SHA256\",\n    hash: hash.digest(\"hex\"),\n  }\n}\n"]}

package/dist/asar/unpackDetector.d.ts

@@ -0,0 +1,2 @@
+export declare function isLibOrExe(file: string): boolean;
+//# sourceMappingURL=unpackDetector.d.ts.map

package/dist/asar/unpackDetector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unpackDetector.d.ts","sourceRoot":"","sources":["../../src/asar/unpackDetector.ts"],"names":[],"mappings":"AAKA,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGhD"}

package/dist/asar/unpackDetector.js

@@ -0,0 +1,39 @@
+import { log } from "builder-util";
+import { isBinaryFileSync } from "isbinaryfile";
+import * as path from "path";
+export function isLibOrExe(file) {
+    // https://github.com/electron-userland/electron-builder/issues/3038
+    return file.endsWith(".dll") || file.endsWith(".exe") || file.endsWith(".dylib") || file.endsWith(".so") || file.endsWith(".node");
+}
+/** @internal */
+export function detectUnpackedDirs(fileSet, autoUnpackDirs) {
+    const metadata = fileSet.metadata;
+    for (let i = 0, n = fileSet.files.length; i < n; i++) {
+        const file = fileSet.files[i];
+        const stat = metadata.get(file);
+        if (!stat.moduleRootPath || autoUnpackDirs.has(stat.moduleRootPath)) {
+            continue;
+        }
+        if (!stat.isFile()) {
+            continue;
+        }
+        // https://github.com/electron-userland/electron-builder/issues/2679
+        let shouldUnpack = false;
+        // ffprobe-static and ffmpeg-static are known packages to always unpack
+        const moduleName = stat.moduleName;
+        const fileBaseName = path.basename(file);
+        const hasExtension = path.extname(fileBaseName);
+        if (moduleName === "ffprobe-static" || moduleName === "ffmpeg-static" || isLibOrExe(file)) {
+            shouldUnpack = true;
+        }
+        else if (!hasExtension) {
+            shouldUnpack = !!isBinaryFileSync(file);
+        }
+        if (!shouldUnpack) {
+            continue;
+        }
+        log.debug({ file: stat.moduleFullFilePath, reason: "contains executable code" }, "not packed into asar archive");
+        autoUnpackDirs.add(stat.moduleRootPath);
+    }
+}
+//# sourceMappingURL=unpackDetector.js.map

package/dist/asar/unpackDetector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unpackDetector.js","sourceRoot":"","sources":["../../src/asar/unpackDetector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,GAAG,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAG5B,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,oEAAoE;IACpE,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AACpI,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,kBAAkB,CAAC,OAAwB,EAAE,cAA2B;IACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IAEjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC7B,MAAM,IAAI,GAAgB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;QAC7C,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACpE,SAAQ;QACV,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,SAAQ;QACV,CAAC;QAED,oEAAoE;QACpE,IAAI,YAAY,GAAG,KAAK,CAAA;QACxB,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACxC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAC/C,IAAI,UAAU,KAAK,gBAAgB,IAAI,UAAU,KAAK,eAAe,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1F,YAAY,GAAG,IAAI,CAAA;QACrB,CAAC;aAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACzB,YAAY,GAAG,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAA;QACzC,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,SAAQ;QACV,CAAC;QAED,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,8BAA8B,CAAC,CAAA;QAChH,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IACzC,CAAC;AACH,CAAC","sourcesContent":["import { FilterStats, log } from \"builder-util\"\nimport { isBinaryFileSync } from \"isbinaryfile\"\nimport * as path from \"path\"\nimport { ResolvedFileSet } from \"../util/appFileCopier.js\"\n\nexport function isLibOrExe(file: string): boolean {\n  // https://github.com/electron-userland/electron-builder/issues/3038\n  return file.endsWith(\".dll\") || file.endsWith(\".exe\") || file.endsWith(\".dylib\") || file.endsWith(\".so\") || file.endsWith(\".node\")\n}\n\n/** @internal */\nexport function detectUnpackedDirs(fileSet: ResolvedFileSet, autoUnpackDirs: Set<string>) {\n  const metadata = fileSet.metadata\n\n  for (let i = 0, n = fileSet.files.length; i < n; i++) {\n    const file = fileSet.files[i]\n    const stat: FilterStats = metadata.get(file)!\n    if (!stat.moduleRootPath || autoUnpackDirs.has(stat.moduleRootPath)) {\n      continue\n    }\n\n    if (!stat.isFile()) {\n      continue\n    }\n\n    // https://github.com/electron-userland/electron-builder/issues/2679\n    let shouldUnpack = false\n    // ffprobe-static and ffmpeg-static are known packages to always unpack\n    const moduleName = stat.moduleName\n    const fileBaseName = path.basename(file)\n    const hasExtension = path.extname(fileBaseName)\n    if (moduleName === \"ffprobe-static\" || moduleName === \"ffmpeg-static\" || isLibOrExe(file)) {\n      shouldUnpack = true\n    } else if (!hasExtension) {\n      shouldUnpack = !!isBinaryFileSync(file)\n    }\n\n    if (!shouldUnpack) {\n      continue\n    }\n\n    log.debug({ file: stat.moduleFullFilePath, reason: \"contains executable code\" }, \"not packed into asar archive\")\n    autoUnpackDirs.add(stat.moduleRootPath)\n  }\n}\n"]}

package/dist/codeSign/certInfo.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Decrypt `data` using RC2-CBC with PKCS#7 padding removal (RFC 2268).
+ *
+ * Used for pbeWithSHAAnd40BitRC2CBC  (OID 1.2.840.113549.1.12.1.6) and
+ *          pbeWithSHAAnd128BitRC2CBC (OID 1.2.840.113549.1.12.1.5).
+ *
+ * These OIDs are commonly used to encrypt certificate bags in PKCS#12
+ * files produced by OpenSSL and Windows with default settings. Node.js 22+
+ * (OpenSSL 3 default provider) does not support RC2 via `createDecipheriv`.
+ */
+declare function rc2CbcDecrypt(key: Buffer, iv: Buffer, data: Buffer, effectiveBits: number): Buffer;
+/**
+ * PKCS#12 key/IV derivation function from RFC 7292 Appendix B (SHA-1 variant).
+ * id = 1 to derive a key, id = 2 to derive an IV.
+ *
+ * Throws if `iterations` is outside [1, MAX_PKCS12_PBE_ITERATIONS] to prevent
+ * CPU exhaustion from a crafted PFX file.
+ */
+declare function pkcs12PbeDeriveKey(password: Buffer, salt: Buffer, iterations: number, id: number, length: number): Buffer;
+/**
+ * Encode a password as UTF-16 Big Endian with a null terminator, which is the
+ * format required by PKCS#12 PBE key derivation (RFC 7292).
+ * An empty string yields [0x00, 0x00] (just the null terminator).
+ */
+declare function pkcs12PasswordToUtf16(password: string): Buffer;
+/**
+ * Reads certificate info from a PKCS#12 (.pfx) file using pkijs (unobfuscated TypeScript).
+ * Mirrors the `certificate-info` subcommand of app-builder-bin.
+ * https://github.com/develar/app-builder/blob/master/pkg/codesign/p12.go
+ *
+ * Returns { commonName, bloodyMicrosoftSubjectDn } on success.
+ *
+ * Known divergences from the Go binary:
+ * - No OpenSSL fallback when the pure PKCS#12 decoder fails for a non-password reason.
+ * - Unknown OIDs are rendered using the raw numeric OID as the type name (e.g. `2.5.4.100=value`); Go uses `OID=#hexbytes` when ASN.1 marshal succeeds.
+ * - RDN ordering uses DER order; Go normalizes via pkix.Name.ToRDNSequence then reverses via
+ *   BloodyMsString. These coincide for pkijs-generated certs (CN-first DER) but may
+ *   differ for real CA-issued certs stored in traditional C-first DER order.
+ */
+export declare function readCertInfo(file: string, password: string): Promise<{
+    commonName: string;
+    bloodyMicrosoftSubjectDn: string;
+}>;
+/**
+ * Internal functions exported exclusively for unit testing.
+ * Not part of the public API — do not use outside of test files.
+ */
+export declare const _testingOnly: {
+    pkcs12PbeDeriveKey: typeof pkcs12PbeDeriveKey;
+    pkcs12PasswordToUtf16: typeof pkcs12PasswordToUtf16;
+    rc2CbcDecrypt: typeof rc2CbcDecrypt;
+    MAX_PKCS12_PBE_ITERATIONS: number;
+};
+export {};
+//# sourceMappingURL=certInfo.d.ts.map

package/dist/codeSign/certInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certInfo.d.ts","sourceRoot":"","sources":["../../src/codeSign/certInfo.ts"],"names":[],"mappings":"AAwHA;;;;;;;;;GASG;AACH,iBAAS,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CA0E3F;AAqBD;;;;;;GAMG;AACH,iBAAS,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAqElH;AAED;;;;GAIG;AACH,iBAAS,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CASvD;AAyCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,wBAAwB,EAAE,MAAM,CAAA;CAAE,CAAC,CAuIpI;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;;CAKxB,CAAA"}