electron-updater 7.0.0-alpha.8 → 7.0.0-alpha.9

package/dist/AppImageUpdater.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AppImageUpdater.d.ts","sourceRoot":"","sources":["../src/AppImageUpdater.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAY,MAAM,sBAAsB,CAAA;AAKlE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAI9D,OAAO,EAA6C,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAE9F,qBAAa,eAAgB,SAAQ,WAAW;gBAClC,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,GAAG;IAIlD,eAAe,IAAI,OAAO;IAajC,SAAS,KAAK,kCAAkC,IAAI,OAAO,CAE1D;IAED,gBAAgB;IAChB,SAAS,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;YAsB3F,oBAAoB;IAyBlC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO;CA+CtD"}
+{"version":3,"file":"AppImageUpdater.d.ts","sourceRoot":"","sources":["../src/AppImageUpdater.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAY,MAAM,sBAAsB,CAAA;AAKlE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAI9D,OAAO,EAA6C,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAE9F,qBAAa,eAAgB,SAAQ,WAAW;gBAClC,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,GAAG;IAIlD,eAAe,IAAI,OAAO;IAajC,SAAS,KAAK,kCAAkC,IAAI,OAAO,CAE1D;IAED,gBAAgB;IAChB,SAAS,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;YAuB3F,oBAAoB;IAyBlC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO;CA+CtD"}

package/dist/AppImageUpdater.js

@@ -43,8 +43,10 @@ export class AppImageUpdater extends BaseUpdater {
                 if (downloadUpdateOptions.disableDifferentialDownload || (await this.downloadDifferential(fileInfo, oldFile, updateFile, provider, downloadUpdateOptions))) {
                     await this.httpExecutor.download(fileInfo.url, updateFile, downloadOptions);
                 }
-                await fsExtra.chmod(updateFile, 0o755);
             },
+            // deferred until after verification: the temporary path is predictable, so marking the AppImage executable
+            // before it is verified would leave an unverified binary runnable for as long as verification takes
+            afterVerification: updateFile => fsExtra.chmod(updateFile, 0o755),
         });
     }
     async downloadDifferential(fileInfo, oldFile, updateFile, provider, downloadUpdateOptions) {
@@ -55,7 +57,7 @@ export class AppImageUpdater extends BaseUpdater {
                 logger: this._logger,
                 newFile: updateFile,
                 isUseMultipleRangeRequest: provider.isUseMultipleRangeRequest,
-                requestHeaders: downloadUpdateOptions.requestHeaders,
+                requestHeaders: this.downloadRequestHeaders(fileInfo.url, downloadUpdateOptions),
                 cancellationToken: downloadUpdateOptions.cancellationToken,
             };
             if (this.listenerCount(DOWNLOAD_PROGRESS) > 0) {

package/dist/AppImageUpdater.js.map

@@ -1 +1 @@
-{"version":3,"file":"AppImageUpdater.js","sourceRoot":"","sources":["../src/AppImageUpdater.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,OAAO,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,WAAW,EAAkB,MAAM,kBAAkB,CAAA;AAE9D,OAAO,EAAE,8CAA8C,EAAE,MAAM,4EAA4E,CAAA;AAC3I,OAAO,EAAE,QAAQ,EAAY,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAkD,MAAM,YAAY,CAAA;AAE9F,MAAM,OAAO,eAAgB,SAAQ,WAAW;IAC9C,YAAY,OAAkC,EAAE,GAAS;QACvD,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACrB,CAAC;IAEM,eAAe;QACpB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAClE,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBAChC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAA;YAC1F,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAA;YAC/D,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,KAAK,CAAC,eAAe,EAAE,CAAA;IAChC,CAAC;IAED,iGAAiG;IACjG,IAAc,kCAAkC;QAC9C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gBAAgB;IACN,gBAAgB,CAAC,qBAA4C;QACrE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,qBAAqB,CAAC,QAAQ,CAAA;QACrE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAE,CAAA;QACzI,OAAO,IAAI,CAAC,eAAe,CAAC;YAC1B,aAAa,EAAE,UAAU;YACzB,QAAQ;YACR,qBAAqB;YACrB,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE;gBAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAE,CAAA;gBACxC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;oBACpB,MAAM,QAAQ,CAAC,6BAA6B,EAAE,gCAAgC,CAAC,CAAA;gBACjF,CAAC;gBAED,IAAI,qBAAqB,CAAC,2BAA2B,IAAI,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC,EAAE,CAAC;oBAC3J,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAA;gBAC7E,CAAC;gBAED,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;YACxC,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,QAAgC,EAAE,OAAe,EAAE,UAAkB,EAAE,QAAuB,EAAE,qBAA4C;QAC7K,IAAI,CAAC;YACH,MAAM,eAAe,GAAkC;gBACrD,MAAM,EAAE,QAAQ,CAAC,GAAG;gBACpB,OAAO;gBACP,MAAM,EAAE,IAAI,CAAC,OAAO;gBACpB,OAAO,EAAE,UAAU;gBACnB,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB;gBAC7D,cAAc,EAAE,qBAAqB,CAAC,cAAc;gBACpD,iBAAiB,EAAE,qBAAqB,CAAC,iBAAiB;aAC3D,CAAA;YAED,IAAI,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9C,eAAe,CAAC,UAAU,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAA;YACrE,CAAC;YAED,MAAM,IAAI,8CAA8C,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAA;YACtH,OAAO,KAAK,CAAA;QACd,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,CAAA;YAChG,0DAA0D;YAC1D,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;QACrC,CAAC;IACH,CAAC;IAES,SAAS,CAAC,OAAuB;QACzC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAE,CAAA;QAC7C,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,QAAQ,CAAC,6BAA6B,EAAE,gCAAgC,CAAC,CAAA;QACjF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,MAAM,QAAQ,CAAC,+CAA+C,YAAY,GAAG,EAAE,gCAAgC,CAAC,CAAA;QAClH,CAAC;QAED,8CAA8C;QAC9C,UAAU,CAAC,YAAY,CAAC,CAAA;QAExB,IAAI,WAAmB,CAAA;QACvB,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QACpD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAA;QACxC,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAA;YACpF,OAAO,KAAK,CAAA;QACd,CAAC;QACD,oEAAoE;QACpE,gGAAgG;QAChG,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,gBAAgB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACjG,kDAAkD;YAClD,WAAW,GAAG,YAAY,CAAA;QAC5B,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAA;QACnF,CAAC;QAED,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACtD,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAA;QACrD,CAAC;QAED,MAAM,GAAG,GAAsB;YAC7B,GAAG,OAAO,CAAC,GAAG;YACd,uBAAuB,EAAE,MAAM;SAChC,CAAA;QAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,mEAAmE;YACnE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,2BAA2B,GAAG,MAAM,CAAA;YACxC,YAAY,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QACxC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;CACF","sourcesContent":["import { AllPublishOptions, newError } from \"builder-util-runtime\"\nimport { execFileSync } from \"child_process\"\nimport fsExtra from \"fs-extra\"\nimport { unlinkSync } from \"fs\"\nimport * as path from \"path\"\nimport { DownloadUpdateOptions } from \"./AppUpdater.js\"\nimport { BaseUpdater, InstallOptions } from \"./BaseUpdater.js\"\nimport { DifferentialDownloaderOptions } from \"./differentialDownloader/DifferentialDownloader.js\"\nimport { FileWithEmbeddedBlockMapDifferentialDownloader } from \"./differentialDownloader/FileWithEmbeddedBlockMapDifferentialDownloader.js\"\nimport { findFile, Provider } from \"./providers/Provider.js\"\nimport { DOWNLOAD_PROGRESS, ResolvedUpdateFileInfo, DownloadExecutorResult } from \"./types.js\"\n\nexport class AppImageUpdater extends BaseUpdater {\n  constructor(options?: AllPublishOptions | null, app?: any) {\n    super(options, app)\n  }\n\n  public isUpdaterActive(): boolean {\n    if (process.env[\"APPIMAGE\"] == null && !this.forceDevUpdateConfig) {\n      if (process.env[\"SNAP\"] == null) {\n        this._logger.warn(\"APPIMAGE env is not defined, current application is not an AppImage\")\n      } else {\n        this._logger.info(\"SNAP env is defined, updater is disabled\")\n      }\n      return false\n    }\n    return super.isUpdaterActive()\n  }\n\n  // replacing the AppImage file needs no elevation, so the automatic install at startup is allowed\n  protected get isAutoInstallOnNextLaunchSupported(): boolean {\n    return true\n  }\n\n  /*** @private */\n  protected doDownloadUpdate(downloadUpdateOptions: DownloadUpdateOptions): Promise<DownloadExecutorResult> {\n    const provider = downloadUpdateOptions.updateInfoAndProvider.provider\n    const fileInfo = findFile(provider.resolveFiles(downloadUpdateOptions.updateInfoAndProvider.info), \"AppImage\", [\"rpm\", \"deb\", \"pacman\"])!\n    return this.executeDownload({\n      fileExtension: \"AppImage\",\n      fileInfo,\n      downloadUpdateOptions,\n      task: async (updateFile, downloadOptions) => {\n        const oldFile = process.env[\"APPIMAGE\"]!\n        if (oldFile == null) {\n          throw newError(\"APPIMAGE env is not defined\", \"ERR_UPDATER_OLD_FILE_NOT_FOUND\")\n        }\n\n        if (downloadUpdateOptions.disableDifferentialDownload || (await this.downloadDifferential(fileInfo, oldFile, updateFile, provider, downloadUpdateOptions))) {\n          await this.httpExecutor.download(fileInfo.url, updateFile, downloadOptions)\n        }\n\n        await fsExtra.chmod(updateFile, 0o755)\n      },\n    })\n  }\n\n  private async downloadDifferential(fileInfo: ResolvedUpdateFileInfo, oldFile: string, updateFile: string, provider: Provider<any>, downloadUpdateOptions: DownloadUpdateOptions) {\n    try {\n      const downloadOptions: DifferentialDownloaderOptions = {\n        newUrl: fileInfo.url,\n        oldFile,\n        logger: this._logger,\n        newFile: updateFile,\n        isUseMultipleRangeRequest: provider.isUseMultipleRangeRequest,\n        requestHeaders: downloadUpdateOptions.requestHeaders,\n        cancellationToken: downloadUpdateOptions.cancellationToken,\n      }\n\n      if (this.listenerCount(DOWNLOAD_PROGRESS) > 0) {\n        downloadOptions.onProgress = it => this.emit(DOWNLOAD_PROGRESS, it)\n      }\n\n      await new FileWithEmbeddedBlockMapDifferentialDownloader(fileInfo.info, this.httpExecutor, downloadOptions).download()\n      return false\n    } catch (e: any) {\n      this._logger.error(`Cannot download differentially, fallback to full download: ${e.stack || e}`)\n      // during test (developer machine mac) we must throw error\n      return process.platform === \"linux\"\n    }\n  }\n\n  protected doInstall(options: InstallOptions): boolean {\n    const appImageFile = process.env[\"APPIMAGE\"]!\n    if (appImageFile == null) {\n      throw newError(\"APPIMAGE env is not defined\", \"ERR_UPDATER_OLD_FILE_NOT_FOUND\")\n    }\n    if (!path.isAbsolute(appImageFile) || appImageFile.includes(\"\\0\")) {\n      throw newError(`APPIMAGE env is not a valid absolute path: \"${appImageFile}\"`, \"ERR_UPDATER_OLD_FILE_NOT_FOUND\")\n    }\n\n    // https://stackoverflow.com/a/1712051/1910191\n    unlinkSync(appImageFile)\n\n    let destination: string\n    const existingBaseName = path.basename(appImageFile)\n    const installerPath = this.installerPath\n    if (installerPath == null) {\n      this.dispatchError(new Error(\"No update filepath provided, can't quit and install\"))\n      return false\n    }\n    // https://github.com/electron-userland/electron-builder/issues/2964\n    // if no version in existing file name, it means that user wants to preserve current custom name\n    if (path.basename(installerPath) === existingBaseName || !/\\d+\\.\\d+\\.\\d+/.test(existingBaseName)) {\n      // no version in the file name, overwrite existing\n      destination = appImageFile\n    } else {\n      destination = path.join(path.dirname(appImageFile), path.basename(installerPath))\n    }\n\n    execFileSync(\"mv\", [\"-f\", installerPath, destination])\n    if (destination !== appImageFile) {\n      this.emit(\"appimage-filename-updated\", destination)\n    }\n\n    const env: NodeJS.ProcessEnv = {\n      ...process.env,\n      APPIMAGE_SILENT_INSTALL: \"true\",\n    }\n\n    if (options.isForceRunAfter) {\n      // eslint-disable-next-line @typescript-eslint/no-floating-promises\n      this.spawnLog(destination, [], env)\n    } else {\n      env.APPIMAGE_EXIT_AFTER_INSTALL = \"true\"\n      execFileSync(destination, [], { env })\n    }\n    return true\n  }\n}\n"]}
+{"version":3,"file":"AppImageUpdater.js","sourceRoot":"","sources":["../src/AppImageUpdater.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,OAAO,MAAM,UAAU,CAAA;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,WAAW,EAAkB,MAAM,kBAAkB,CAAA;AAE9D,OAAO,EAAE,8CAA8C,EAAE,MAAM,4EAA4E,CAAA;AAC3I,OAAO,EAAE,QAAQ,EAAY,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAkD,MAAM,YAAY,CAAA;AAE9F,MAAM,OAAO,eAAgB,SAAQ,WAAW;IAC9C,YAAY,OAAkC,EAAE,GAAS;QACvD,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACrB,CAAC;IAEM,eAAe;QACpB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAClE,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBAChC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAA;YAC1F,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAA;YAC/D,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,KAAK,CAAC,eAAe,EAAE,CAAA;IAChC,CAAC;IAED,iGAAiG;IACjG,IAAc,kCAAkC;QAC9C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gBAAgB;IACN,gBAAgB,CAAC,qBAA4C;QACrE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,qBAAqB,CAAC,QAAQ,CAAA;QACrE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAE,CAAA;QACzI,OAAO,IAAI,CAAC,eAAe,CAAC;YAC1B,aAAa,EAAE,UAAU;YACzB,QAAQ;YACR,qBAAqB;YACrB,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE;gBAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAE,CAAA;gBACxC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;oBACpB,MAAM,QAAQ,CAAC,6BAA6B,EAAE,gCAAgC,CAAC,CAAA;gBACjF,CAAC;gBAED,IAAI,qBAAqB,CAAC,2BAA2B,IAAI,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC,EAAE,CAAC;oBAC3J,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAA;gBAC7E,CAAC;YACH,CAAC;YACD,2GAA2G;YAC3G,oGAAoG;YACpG,iBAAiB,EAAE,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC;SAClE,CAAC,CAAA;IACJ,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,QAAgC,EAAE,OAAe,EAAE,UAAkB,EAAE,QAAuB,EAAE,qBAA4C;QAC7K,IAAI,CAAC;YACH,MAAM,eAAe,GAAkC;gBACrD,MAAM,EAAE,QAAQ,CAAC,GAAG;gBACpB,OAAO;gBACP,MAAM,EAAE,IAAI,CAAC,OAAO;gBACpB,OAAO,EAAE,UAAU;gBACnB,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB;gBAC7D,cAAc,EAAE,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,GAAG,EAAE,qBAAqB,CAAC;gBAChF,iBAAiB,EAAE,qBAAqB,CAAC,iBAAiB;aAC3D,CAAA;YAED,IAAI,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9C,eAAe,CAAC,UAAU,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAA;YACrE,CAAC;YAED,MAAM,IAAI,8CAA8C,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAA;YACtH,OAAO,KAAK,CAAA;QACd,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,CAAA;YAChG,0DAA0D;YAC1D,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;QACrC,CAAC;IACH,CAAC;IAES,SAAS,CAAC,OAAuB;QACzC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAE,CAAA;QAC7C,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,QAAQ,CAAC,6BAA6B,EAAE,gCAAgC,CAAC,CAAA;QACjF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,MAAM,QAAQ,CAAC,+CAA+C,YAAY,GAAG,EAAE,gCAAgC,CAAC,CAAA;QAClH,CAAC;QAED,8CAA8C;QAC9C,UAAU,CAAC,YAAY,CAAC,CAAA;QAExB,IAAI,WAAmB,CAAA;QACvB,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QACpD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAA;QACxC,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAA;YACpF,OAAO,KAAK,CAAA;QACd,CAAC;QACD,oEAAoE;QACpE,gGAAgG;QAChG,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,gBAAgB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACjG,kDAAkD;YAClD,WAAW,GAAG,YAAY,CAAA;QAC5B,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAA;QACnF,CAAC;QAED,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;QACtD,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAA;QACrD,CAAC;QAED,MAAM,GAAG,GAAsB;YAC7B,GAAG,OAAO,CAAC,GAAG;YACd,uBAAuB,EAAE,MAAM;SAChC,CAAA;QAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,mEAAmE;YACnE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,2BAA2B,GAAG,MAAM,CAAA;YACxC,YAAY,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QACxC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;CACF","sourcesContent":["import { AllPublishOptions, newError } from \"builder-util-runtime\"\nimport { execFileSync } from \"child_process\"\nimport fsExtra from \"fs-extra\"\nimport { unlinkSync } from \"fs\"\nimport * as path from \"path\"\nimport { DownloadUpdateOptions } from \"./AppUpdater.js\"\nimport { BaseUpdater, InstallOptions } from \"./BaseUpdater.js\"\nimport { DifferentialDownloaderOptions } from \"./differentialDownloader/DifferentialDownloader.js\"\nimport { FileWithEmbeddedBlockMapDifferentialDownloader } from \"./differentialDownloader/FileWithEmbeddedBlockMapDifferentialDownloader.js\"\nimport { findFile, Provider } from \"./providers/Provider.js\"\nimport { DOWNLOAD_PROGRESS, ResolvedUpdateFileInfo, DownloadExecutorResult } from \"./types.js\"\n\nexport class AppImageUpdater extends BaseUpdater {\n  constructor(options?: AllPublishOptions | null, app?: any) {\n    super(options, app)\n  }\n\n  public isUpdaterActive(): boolean {\n    if (process.env[\"APPIMAGE\"] == null && !this.forceDevUpdateConfig) {\n      if (process.env[\"SNAP\"] == null) {\n        this._logger.warn(\"APPIMAGE env is not defined, current application is not an AppImage\")\n      } else {\n        this._logger.info(\"SNAP env is defined, updater is disabled\")\n      }\n      return false\n    }\n    return super.isUpdaterActive()\n  }\n\n  // replacing the AppImage file needs no elevation, so the automatic install at startup is allowed\n  protected get isAutoInstallOnNextLaunchSupported(): boolean {\n    return true\n  }\n\n  /*** @private */\n  protected doDownloadUpdate(downloadUpdateOptions: DownloadUpdateOptions): Promise<DownloadExecutorResult> {\n    const provider = downloadUpdateOptions.updateInfoAndProvider.provider\n    const fileInfo = findFile(provider.resolveFiles(downloadUpdateOptions.updateInfoAndProvider.info), \"AppImage\", [\"rpm\", \"deb\", \"pacman\"])!\n    return this.executeDownload({\n      fileExtension: \"AppImage\",\n      fileInfo,\n      downloadUpdateOptions,\n      task: async (updateFile, downloadOptions) => {\n        const oldFile = process.env[\"APPIMAGE\"]!\n        if (oldFile == null) {\n          throw newError(\"APPIMAGE env is not defined\", \"ERR_UPDATER_OLD_FILE_NOT_FOUND\")\n        }\n\n        if (downloadUpdateOptions.disableDifferentialDownload || (await this.downloadDifferential(fileInfo, oldFile, updateFile, provider, downloadUpdateOptions))) {\n          await this.httpExecutor.download(fileInfo.url, updateFile, downloadOptions)\n        }\n      },\n      // deferred until after verification: the temporary path is predictable, so marking the AppImage executable\n      // before it is verified would leave an unverified binary runnable for as long as verification takes\n      afterVerification: updateFile => fsExtra.chmod(updateFile, 0o755),\n    })\n  }\n\n  private async downloadDifferential(fileInfo: ResolvedUpdateFileInfo, oldFile: string, updateFile: string, provider: Provider<any>, downloadUpdateOptions: DownloadUpdateOptions) {\n    try {\n      const downloadOptions: DifferentialDownloaderOptions = {\n        newUrl: fileInfo.url,\n        oldFile,\n        logger: this._logger,\n        newFile: updateFile,\n        isUseMultipleRangeRequest: provider.isUseMultipleRangeRequest,\n        requestHeaders: this.downloadRequestHeaders(fileInfo.url, downloadUpdateOptions),\n        cancellationToken: downloadUpdateOptions.cancellationToken,\n      }\n\n      if (this.listenerCount(DOWNLOAD_PROGRESS) > 0) {\n        downloadOptions.onProgress = it => this.emit(DOWNLOAD_PROGRESS, it)\n      }\n\n      await new FileWithEmbeddedBlockMapDifferentialDownloader(fileInfo.info, this.httpExecutor, downloadOptions).download()\n      return false\n    } catch (e: any) {\n      this._logger.error(`Cannot download differentially, fallback to full download: ${e.stack || e}`)\n      // during test (developer machine mac) we must throw error\n      return process.platform === \"linux\"\n    }\n  }\n\n  protected doInstall(options: InstallOptions): boolean {\n    const appImageFile = process.env[\"APPIMAGE\"]!\n    if (appImageFile == null) {\n      throw newError(\"APPIMAGE env is not defined\", \"ERR_UPDATER_OLD_FILE_NOT_FOUND\")\n    }\n    if (!path.isAbsolute(appImageFile) || appImageFile.includes(\"\\0\")) {\n      throw newError(`APPIMAGE env is not a valid absolute path: \"${appImageFile}\"`, \"ERR_UPDATER_OLD_FILE_NOT_FOUND\")\n    }\n\n    // https://stackoverflow.com/a/1712051/1910191\n    unlinkSync(appImageFile)\n\n    let destination: string\n    const existingBaseName = path.basename(appImageFile)\n    const installerPath = this.installerPath\n    if (installerPath == null) {\n      this.dispatchError(new Error(\"No update filepath provided, can't quit and install\"))\n      return false\n    }\n    // https://github.com/electron-userland/electron-builder/issues/2964\n    // if no version in existing file name, it means that user wants to preserve current custom name\n    if (path.basename(installerPath) === existingBaseName || !/\\d+\\.\\d+\\.\\d+/.test(existingBaseName)) {\n      // no version in the file name, overwrite existing\n      destination = appImageFile\n    } else {\n      destination = path.join(path.dirname(appImageFile), path.basename(installerPath))\n    }\n\n    execFileSync(\"mv\", [\"-f\", installerPath, destination])\n    if (destination !== appImageFile) {\n      this.emit(\"appimage-filename-updated\", destination)\n    }\n\n    const env: NodeJS.ProcessEnv = {\n      ...process.env,\n      APPIMAGE_SILENT_INSTALL: \"true\",\n    }\n\n    if (options.isForceRunAfter) {\n      // eslint-disable-next-line @typescript-eslint/no-floating-promises\n      this.spawnLog(destination, [], env)\n    } else {\n      env.APPIMAGE_EXIT_AFTER_INSTALL = \"true\"\n      execFileSync(destination, [], { env })\n    }\n    return true\n  }\n}\n"]}

package/dist/AppUpdater.d.ts

@@ -9,8 +9,8 @@ import { Provider, ProviderPlatform } from "./providers/Provider.js";
 import type { TypedEmitter } from "tiny-typed-emitter";
 type Session = Electron.Session;
 import type { AuthInfo } from "electron";
-import { AutoInstallEvent, Logger, QuitAndInstallOptions, ResolvedUpdateFileInfo, UpdateCheckResult, DownloadExecutorResult, UpdateDownloadedEvent, UpdaterSignal } from "./types.js";
-import { VerifyUpdateSupport } from "./index.js";
+import { AutoInstallEvent, Logger, QuitAndInstallOptions, ResolvedUpdateFileInfo, UpdateCheckResult, DownloadExecutorResult, UpdateDownloadedEvent, UpdaterSignal, VerifyUpdateFile } from "./types.js";
+import type { VerifyUpdateSupport } from "./index.js";
 export type AppUpdaterEvents = {
     error: (error: Error, message?: string) => void;
     login: (info: AuthInfo, callback: LoginCallback) => void;
@@ -127,15 +127,22 @@ export declare abstract class AppUpdater extends AppUpdater_base {
      */
     allowUnverifiedLinuxPackages: boolean;
     private _disableWebInstaller;
+    protected disableWebInstallerDefault: boolean;
     /**
-     * Whether to block NSIS web-installer packages. Web installer files might not have signature verification, so they are disabled by default as of v27.
+     * Whether to block NSIS web-installer packages. Web installer files might not have signature verification, so they are disabled by default as of v27:
+     * a web-installer update is rejected with `ERR_UPDATER_WEB_INSTALLER_DISABLED` at download time, before an install on next launch, and at install time unless this is `false`.
      *
-     * v27 grace period: apps that do not explicitly set this property will warn (but still download) if a web-installer update is received. In v28 the warning becomes an error and the download is blocked (`ERR_UPDATER_WEB_INSTALLER_DISABLED`). Apps that explicitly set this to `true` throw immediately. Set it to `false` only if you intentionally publish and rely on NSIS web-installer packages.
+     * `NsisUpdater` defaults it to `false` for installs made by an `nsis-web` installer built with electron-builder v27+ (`resources/package-type` marker).
+     * Set it to `false` explicitly only if you intentionally publish and rely on NSIS web-installer packages and your installs lack that marker.
+     *
+     * Set it before the app is `ready` (e.g. right after creating the updater): with `autoInstallEvent: "onNextLaunch"` a pending
+     * web-installer update is checked against it when the app is ready, and rejected (its pending-install marker cleared) while it is `true`.
      *
      * @default true
      */
     get disableWebInstaller(): boolean;
     set disableWebInstaller(value: boolean);
+    protected get isWebInstallerEnabledByApp(): boolean;
     /**
      * *NSIS only* Disable differential downloads and always perform full download of installer.
      *
@@ -189,6 +196,8 @@ export declare abstract class AppUpdater extends AppUpdater_base {
      */
     updateManifestPublicKey: string | Array<string> | null;
     private manifestVerificationWarned;
+    private crossOriginHeadersWarned;
+    private crossOriginFeedQueryWarned;
     /**
      *  The request headers.
      */
@@ -215,6 +224,26 @@ export declare abstract class AppUpdater extends AppUpdater_base {
      * @private
      */
     set updateConfigPath(value: string | null);
+    protected _verifyUpdateFile: VerifyUpdateFile;
+    /**
+     * Allows developer to set custom logic for verifying an update file before it is allowed to become installable.
+     * When the verification fails, the file is deleted and electron-updater emits an `ERR_UPDATER_INVALID_UPDATE_FILE` error.
+     * The default behavior is a stub – immediately succeeds.
+     *
+     * It runs on every path that can lead to an install:
+     * - right after a fresh download, while the file still sits under a temporary name and before it is renamed into the
+     *   updater cache under its real filename, so an unverified file can never be executed under its real name;
+     * - when an update downloaded by an earlier session is reused from the updater cache;
+     * - before an install-on-next-launch spawns the cached installer (see {@link BaseUpdater}).
+     *
+     * The custom logic gets `updateFilePath` (the file to verify), `originalUpdateFileName` (its real filename), the
+     * optional `packageFilePath` of an NSIS web installer package, and the active `cancellationToken` when the
+     * verification belongs to a download.
+     *
+     * Assigning `null` restores the default stub.
+     */
+    get verifyUpdateFile(): VerifyUpdateFile;
+    set verifyUpdateFile(value: VerifyUpdateFile | null | undefined);
     protected _isUpdateSupported: VerifyUpdateSupport;
     /**
      * Allows developer to override default logic for determining if an update is supported.
@@ -295,6 +324,13 @@ export declare abstract class AppUpdater extends AppUpdater_base {
     abstract quitAndInstall(options?: QuitAndInstallOptions): void;
     private loadUpdateConfig;
     private computeRequestHeaders;
+    /**
+     * Headers for a download from `url`: when the provider has a `feedBaseUrl`, the credential-bearing ones are dropped if `url` is on
+     * another origin than `originUrl` (the feed by default). `null` keeps them for every URL.
+     */
+    protected downloadRequestHeaders(url: URL, downloadUpdateOptions: DownloadUpdateOptions, originUrl?: URL): OutgoingHttpHeaders;
+    private announceCrossOriginDownload;
+    private static checkFeedBaseUrlDeclared;
     private getOrCreateStagingUserId;
     protected getOrCreateDownloadHelper(): Promise<DownloadedUpdateHelper>;
     protected executeDownload(taskOptions: DownloadExecutorTask): Promise<DownloadExecutorResult>;
@@ -322,6 +358,11 @@ export interface DownloadExecutorTask {
     readonly fileInfo: ResolvedUpdateFileInfo;
     readonly downloadUpdateOptions: DownloadUpdateOptions;
     readonly task: (destinationFile: string, downloadOptions: DownloadOptions, packageFile: string | null, removeTempDirIfAny: () => Promise<any>) => Promise<any>;
+    /**
+     * Runs after the downloaded file passed verification and before it is renamed into the cache under its real name.
+     * For anything that must not be done to a file that is still unverified — making it executable, in particular.
+     */
+    readonly afterVerification?: (destinationFile: string) => Promise<void>;
     readonly done?: (event: UpdateDownloadedEvent) => Promise<any>;
 }
 export interface DownloadNotification {

package/dist/AppUpdater.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AppUpdater.d.ts","sourceRoot":"","sources":["../src/AppUpdater.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EAEjB,iBAAiB,EAEjB,oBAAoB,EACpB,UAAU,EAEV,eAAe,EAEf,YAAY,EAMb,MAAM,sBAAsB,CAAA;AAK7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAA;AAE1C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAiJ,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC9K,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAwB,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAE1F,OAAO,EAAuC,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAG9F,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,KAAK,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;AAC/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAIxC,OAAO,EACL,gBAAgB,EAEhB,MAAM,EACN,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,aAAa,EACd,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAIhD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/C,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAA;IACxD,qBAAqB,EAAE,MAAM,IAAI,CAAA;IACjC,sBAAsB,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,CAAA;IAClD,kBAAkB,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,CAAA;IAC9C,mBAAmB,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAA;IAC3D,mBAAmB,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,CAAA;IACjD,kBAAkB,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,CAAA;IAC9C,2BAA2B,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACpD,CAAA;+BAEyD,UAAU,YAAY,CAAC,gBAAgB,CAAC;AAAlG,8BAAsB,UAAW,SAAQ,eAA0D;IACjG;;;OAGG;IACH,YAAY,UAAO;IAEnB;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,EAAE,gBAAgB,CAAW;IAE7C;;;;;;;;OAQG;IACH,IAAI,oBAAoB,IAAI,OAAO,CAElC;IAED,IAAI,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAStC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,+BAA+B,IAAI,OAAO,CAAC,OAAO,CAAC;IAKnD;;;OAGG;IACH,sBAAsB,UAAO;IAE7B;;;;OAIG;IACH,eAAe,UAAQ;IAEvB;;;OAGG;IACH,aAAa,UAAQ;IAErB;;;;;;OAMG;IACH,cAAc,UAAQ;IAEtB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,4BAA4B,UAAO;IAEnC,OAAO,CAAC,oBAAoB,CAAiC;IAE7D;;;;;;OAMG;IACH,IAAI,mBAAmB,IAAI,OAAO,CAEjC;IAED,IAAI,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAErC;IAED;;;;OAIG;IACH,2BAA2B,UAAQ;IAEnC;;;;;;OAMG;IACH,oBAAoB,UAAQ;IAE5B;;;;;;;;;OASG;IACI,+BAA+B,EAAE,MAAM,GAAG,IAAI,CAAO;IAE5D;;OAEG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAE/B,OAAO,CAAC,QAAQ,CAAsB;IAEtC,SAAS,CAAC,sBAAsB,EAAE,sBAAsB,GAAG,IAAI,CAAO;IAEtE;;OAEG;IACH,IAAI,OAAO,IAAI,MAAM,GAAG,IAAI,CAE3B;IAED;;;;OAIG;IACH,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAY/B;IAED;;;;;;;;;OASG;IACH,uBAAuB,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAO;IAE7D,OAAO,CAAC,0BAA0B,CAAQ;IAE1C;;OAEG;IACH,cAAc,EAAE,mBAAmB,GAAG,IAAI,CAAO;IAEjD;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM;IAM3B,SAAS,CAAC,OAAO,EAAE,MAAM,CAAU;IAGnC,IAAI,UAAU,IAAI,OAAO,CAExB;IAED;;;OAGG;IACH,IAAI,MAAM,IAAI,MAAM,GAAG,IAAI,CAE1B;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAE9B;IAGD;;OAEG;IACH,QAAQ,CAAC,OAAO,gBAA0B;IAE1C,OAAO,CAAC,oBAAoB,CAAsB;IAGlD;;;OAGG;IACH,IAAI,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAIxC;IAED,SAAS,CAAC,kBAAkB,EAAE,mBAAmB,CAAwD;IAEzG;;;OAGG;IACH,IAAI,iBAAiB,IAAI,mBAAmB,CAE3C;IAED,IAAI,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,EAI/C;IAED,SAAS,CAAC,oBAAoB,EAAE,mBAAmB,CAAgD;IAEnG;;;;OAIG;IACH,IAAI,mBAAmB,IAAI,mBAAmB,CAE7C;IAED,IAAI,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,EAIjD;IAED,OAAO,CAAC,aAAa,CAAsC;IAE3D,SAAS,CAAC,QAAQ,CAAC,oBAAoB,eAA0D;IAMjG,OAAO,CAAC,sBAAsB,CAA0C;IACxE,OAAO,CAAC,eAAe,CAA+C;IAEtE,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;IAElC,SAAS,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,IAAI,CAAO;IAKpE,SAAS,aAAa,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,UAAU;IAiCrF,UAAU,IAAI,MAAM,GAAG,IAAI,GAAG,SAAS;IAIvC;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,GAAG,MAAM;IAerE;;;OAGG;IACH,eAAe,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA6B7C,eAAe,IAAI,OAAO;IAUjC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAkBxG,OAAO,CAAC,MAAM,CAAC,0BAA0B;YAc3B,cAAc;IAuB5B,OAAO,CAAC,mBAAmB;YAOb,iBAAiB;IAkC/B,OAAO,CAAC,sBAAsB;cAgBd,wBAAwB,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAkB1E;;;;;;;;;;;;OAYG;YACW,uBAAuB;IA0CrC,OAAO,CAAC,4BAA4B;YAQtB,iBAAiB;IAiC/B,SAAS,CAAC,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI;IASzD;;;;OAIG;IACH,cAAc,CAAC,iBAAiB,GAAE,iBAA2C,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAgD/G,SAAS,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI;IAIvC,SAAS,CAAC,wBAAwB,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI;IAItE,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAElH;;;;;;;;;OASG;IACH,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,IAAI;YA0BhD,gBAAgB;IAO9B,OAAO,CAAC,qBAAqB;YAcf,wBAAwB;cAgDtB,yBAAyB,IAAI,OAAO,CAAC,sBAAsB,CAAC;cAmB5D,eAAe,CAAC,WAAW,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC;cAoHnF,6BAA6B,CAC3C,QAAQ,EAAE,sBAAsB,EAChC,qBAAqB,EAAE,qBAAqB,EAC5C,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,EACvB,oBAAoB,EAAE,MAAM,GAC3B,OAAO,CAAC,OAAO,CAAC;CA4FpB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,CAAA;IACrD,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAA;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAA;IAC7C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAA;CAC/C;AAOD,eAAe;AACf,qBAAa,UAAW,YAAW,MAAM;IAEvC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG;IAKlB,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG;IAKlB,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG;CAGpB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAA;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAA;IACzC,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,CAAA;IACrD,QAAQ,CAAC,IAAI,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,kBAAkB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;IAE9J,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;CAC/D;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd;AAED,eAAe;AACf,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,gBAAgB,CAAA;IAE1B,yBAAyB,CAAC,EAAE,OAAO,CAAA;CACpC"}
+{"version":3,"file":"AppUpdater.d.ts","sourceRoot":"","sources":["../src/AppUpdater.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EAEjB,iBAAiB,EAEjB,oBAAoB,EACpB,UAAU,EAEV,eAAe,EAGf,YAAY,EAMb,MAAM,sBAAsB,CAAA;AAK7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAA;AAE1C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAiJ,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC9K,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAwB,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAE1F,OAAO,EAAuC,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAG9F,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,KAAK,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;AAC/B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAIxC,OAAO,EACL,gBAAgB,EAEhB,MAAM,EACN,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAEjB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAOrD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/C,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAA;IACxD,qBAAqB,EAAE,MAAM,IAAI,CAAA;IACjC,sBAAsB,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,CAAA;IAClD,kBAAkB,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,CAAA;IAC9C,mBAAmB,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAA;IAC3D,mBAAmB,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,CAAA;IACjD,kBAAkB,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,CAAA;IAC9C,2BAA2B,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CACpD,CAAA;+BAEyD,UAAU,YAAY,CAAC,gBAAgB,CAAC;AAAlG,8BAAsB,UAAW,SAAQ,eAA0D;IACjG;;;OAGG;IACH,YAAY,UAAO;IAEnB;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,EAAE,gBAAgB,CAAW;IAE7C;;;;;;;;OAQG;IACH,IAAI,oBAAoB,IAAI,OAAO,CAElC;IAED,IAAI,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAStC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,+BAA+B,IAAI,OAAO,CAAC,OAAO,CAAC;IAKnD;;;OAGG;IACH,sBAAsB,UAAO;IAE7B;;;;OAIG;IACH,eAAe,UAAQ;IAEvB;;;OAGG;IACH,aAAa,UAAQ;IAErB;;;;;;OAMG;IACH,cAAc,UAAQ;IAEtB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,4BAA4B,UAAO;IAGnC,OAAO,CAAC,oBAAoB,CAAiC;IAG7D,SAAS,CAAC,0BAA0B,UAAO;IAE3C;;;;;;;;;;;OAWG;IACH,IAAI,mBAAmB,IAAI,OAAO,CAEjC;IAED,IAAI,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAErC;IAGD,SAAS,KAAK,0BAA0B,IAAI,OAAO,CAElD;IAED;;;;OAIG;IACH,2BAA2B,UAAQ;IAEnC;;;;;;OAMG;IACH,oBAAoB,UAAQ;IAE5B;;;;;;;;;OASG;IACI,+BAA+B,EAAE,MAAM,GAAG,IAAI,CAAO;IAE5D;;OAEG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAE/B,OAAO,CAAC,QAAQ,CAAsB;IAEtC,SAAS,CAAC,sBAAsB,EAAE,sBAAsB,GAAG,IAAI,CAAO;IAEtE;;OAEG;IACH,IAAI,OAAO,IAAI,MAAM,GAAG,IAAI,CAE3B;IAED;;;;OAIG;IACH,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAY/B;IAED;;;;;;;;;OASG;IACH,uBAAuB,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAO;IAE7D,OAAO,CAAC,0BAA0B,CAAQ;IAE1C,OAAO,CAAC,wBAAwB,CAAQ;IACxC,OAAO,CAAC,0BAA0B,CAAQ;IAE1C;;OAEG;IACH,cAAc,EAAE,mBAAmB,GAAG,IAAI,CAAO;IAEjD;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM;IAM3B,SAAS,CAAC,OAAO,EAAE,MAAM,CAAU;IAGnC,IAAI,UAAU,IAAI,OAAO,CAExB;IAED;;;OAGG;IACH,IAAI,MAAM,IAAI,MAAM,GAAG,IAAI,CAE1B;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAE9B;IAGD;;OAEG;IACH,QAAQ,CAAC,OAAO,gBAA0B;IAE1C,OAAO,CAAC,oBAAoB,CAAsB;IAGlD;;;OAGG;IACH,IAAI,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAIxC;IAED,SAAS,CAAC,iBAAiB,EAAE,gBAAgB,CAA6B;IAE1E;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,gBAAgB,IAAI,gBAAgB,CAEvC;IAED,IAAI,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAE9D;IAED,SAAS,CAAC,kBAAkB,EAAE,mBAAmB,CAAwD;IAEzG;;;OAGG;IACH,IAAI,iBAAiB,IAAI,mBAAmB,CAE3C;IAED,IAAI,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,EAI/C;IAED,SAAS,CAAC,oBAAoB,EAAE,mBAAmB,CAAgD;IAEnG;;;;OAIG;IACH,IAAI,mBAAmB,IAAI,mBAAmB,CAE7C;IAED,IAAI,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,EAIjD;IAED,OAAO,CAAC,aAAa,CAAsC;IAE3D,SAAS,CAAC,QAAQ,CAAC,oBAAoB,eAA0D;IAMjG,OAAO,CAAC,sBAAsB,CAA0C;IACxE,OAAO,CAAC,eAAe,CAA+C;IAEtE,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;IAElC,SAAS,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,IAAI,CAAO;IAKpE,SAAS,aAAa,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,UAAU;IAiCrF,UAAU,IAAI,MAAM,GAAG,IAAI,GAAG,SAAS;IAIvC;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,GAAG,MAAM;IAerE;;;OAGG;IACH,eAAe,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA6B7C,eAAe,IAAI,OAAO;IAUjC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAwBxG,OAAO,CAAC,MAAM,CAAC,0BAA0B;YAc3B,cAAc;IAuB5B,OAAO,CAAC,mBAAmB;YAOb,iBAAiB;IAkC/B,OAAO,CAAC,sBAAsB;cAgBd,wBAAwB,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAkB1E;;;;;;;;;;;;OAYG;YACW,uBAAuB;IA+CrC,OAAO,CAAC,4BAA4B;YAQtB,iBAAiB;IAiC/B,SAAS,CAAC,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI;IASzD;;;;OAIG;IACH,cAAc,CAAC,iBAAiB,GAAE,iBAA2C,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAwD/G,SAAS,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI;IAIvC,SAAS,CAAC,wBAAwB,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI;IAItE,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAElH;;;;;;;;;OASG;IACH,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,IAAI;YA0BhD,gBAAgB;IAO9B,OAAO,CAAC,qBAAqB;IAc7B;;;OAGG;IACH,SAAS,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,SAAS,CAAC,EAAE,GAAG,GAAG,mBAAmB;IAgB9H,OAAO,CAAC,2BAA2B;IAuBnC,OAAO,CAAC,MAAM,CAAC,wBAAwB;YAgBzB,wBAAwB;cAgDtB,yBAAyB,IAAI,OAAO,CAAC,sBAAsB,CAAC;cAmB5D,eAAe,CAAC,WAAW,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC;cAgJnF,6BAA6B,CAC3C,QAAQ,EAAE,sBAAsB,EAChC,qBAAqB,EAAE,qBAAqB,EAC5C,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,EACvB,oBAAoB,EAAE,MAAM,GAC3B,OAAO,CAAC,OAAO,CAAC;CA2GpB;AAeD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,CAAA;IACrD,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAA;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAA;IAC7C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAA;CAC/C;AAOD,eAAe;AACf,qBAAa,UAAW,YAAW,MAAM;IAEvC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG;IAKlB,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG;IAKlB,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG;CAGpB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAA;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAA;IACzC,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,CAAA;IACrD,QAAQ,CAAC,IAAI,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,kBAAkB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;IAE9J;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;CAC/D;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd;AAED,eAAe;AACf,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,gBAAgB,CAAA;IAE1B,yBAAyB,CAAC,EAAE,OAAO,CAAA;CACpC"}

package/dist/AppUpdater.js

@@ -1,5 +1,5 @@
 import { createRequire } from "node:module";
-import { asArray, CancellationToken, newError, UUID, CancellationError, retry, collectManifestSignatures, normalizePublicKeyList, verifyManifestSignatures, } from "builder-util-runtime";
+import { asArray, CancellationToken, newError, UUID, CancellationError, HttpExecutor, retry, collectManifestSignatures, normalizePublicKeyList, verifyManifestSignatures, } from "builder-util-runtime";
 import { randomBytes } from "crypto";
 import { release } from "os";
 import { EventEmitter } from "events";
@@ -15,8 +15,10 @@ import { GenericProvider } from "./providers/GenericProvider.js";
 import { createClient, isUrlProbablySupportMultiRangeRequests } from "./providerFactory.js";
 import { gunzipSync, gzipSync } from "zlib";
 import { GenericDifferentialDownloader } from "./differentialDownloader/GenericDifferentialDownloader.js";
-import { DOWNLOAD_PROGRESS, UPDATE_DOWNLOADED, UpdaterSignal, } from "./types.js";
+import { DOWNLOAD_PROGRESS, UPDATE_DOWNLOADED, UpdaterSignal, verificationFailureMessage, } from "./types.js";
 const require = createRequire(import.meta.url);
+// shared rather than per-instance so that `updater.verifyUpdateFile === DEFAULT_VERIFY_UPDATE_FILE` identifies "no custom verifier"
+const DEFAULT_VERIFY_UPDATE_FILE = _params => Promise.resolve({ response: "success" });
 export class AppUpdater extends EventEmitter {
     /**
      * @deprecated Removed in v27 — use {@link autoInstallEvent}. This accessor is a compatibility shim
@@ -61,18 +63,27 @@ export class AppUpdater extends EventEmitter {
         return Promise.resolve(false);
     }
     /**
-     * Whether to block NSIS web-installer packages. Web installer files might not have signature verification, so they are disabled by default as of v27.
+     * Whether to block NSIS web-installer packages. Web installer files might not have signature verification, so they are disabled by default as of v27:
+     * a web-installer update is rejected with `ERR_UPDATER_WEB_INSTALLER_DISABLED` at download time, before an install on next launch, and at install time unless this is `false`.
      *
-     * v27 grace period: apps that do not explicitly set this property will warn (but still download) if a web-installer update is received. In v28 the warning becomes an error and the download is blocked (`ERR_UPDATER_WEB_INSTALLER_DISABLED`). Apps that explicitly set this to `true` throw immediately. Set it to `false` only if you intentionally publish and rely on NSIS web-installer packages.
+     * `NsisUpdater` defaults it to `false` for installs made by an `nsis-web` installer built with electron-builder v27+ (`resources/package-type` marker).
+     * Set it to `false` explicitly only if you intentionally publish and rely on NSIS web-installer packages and your installs lack that marker.
+     *
+     * Set it before the app is `ready` (e.g. right after creating the updater): with `autoInstallEvent: "onNextLaunch"` a pending
+     * web-installer update is checked against it when the app is ready, and rejected (its pending-install marker cleared) while it is `true`.
      *
      * @default true
      */
     get disableWebInstaller() {
-        return this._disableWebInstaller ?? true;
+        return this._disableWebInstaller ?? this.disableWebInstallerDefault;
     }
     set disableWebInstaller(value) {
         this._disableWebInstaller = value;
     }
+    // the app itself set disableWebInstaller to false (not the nsis-web default)
+    get isWebInstallerEnabledByApp() {
+        return this._disableWebInstaller === false;
+    }
     /**
      * Get the update channel. Doesn't return `channel` from the update configuration, only if was previously set.
      */
@@ -129,6 +140,29 @@ export class AppUpdater extends EventEmitter {
         this._appUpdateConfigPath = value;
         this.configOnDisk = new Lazy(() => this.loadUpdateConfig());
     }
+    /**
+     * Allows developer to set custom logic for verifying an update file before it is allowed to become installable.
+     * When the verification fails, the file is deleted and electron-updater emits an `ERR_UPDATER_INVALID_UPDATE_FILE` error.
+     * The default behavior is a stub – immediately succeeds.
+     *
+     * It runs on every path that can lead to an install:
+     * - right after a fresh download, while the file still sits under a temporary name and before it is renamed into the
+     *   updater cache under its real filename, so an unverified file can never be executed under its real name;
+     * - when an update downloaded by an earlier session is reused from the updater cache;
+     * - before an install-on-next-launch spawns the cached installer (see {@link BaseUpdater}).
+     *
+     * The custom logic gets `updateFilePath` (the file to verify), `originalUpdateFileName` (its real filename), the
+     * optional `packageFilePath` of an NSIS web installer package, and the active `cancellationToken` when the
+     * verification belongs to a download.
+     *
+     * Assigning `null` restores the default stub.
+     */
+    get verifyUpdateFile() {
+        return this._verifyUpdateFile;
+    }
+    set verifyUpdateFile(value) {
+        this._verifyUpdateFile = value ?? DEFAULT_VERIFY_UPDATE_FILE;
+    }
     /**
      * Allows developer to override default logic for determining if an update is supported.
      * The default logic compares the `UpdateInfo` minimum system version against the `os.release()` with `semver` package
@@ -228,7 +262,10 @@ export class AppUpdater extends EventEmitter {
          * @default true
          */
         this.allowUnverifiedLinuxPackages = true;
+        // undefined until the app sets disableWebInstaller, so NsisUpdater can tell a `false` set by the app from the nsis-web default
         this._disableWebInstaller = undefined;
+        // the value of disableWebInstaller while the app has not set it; NsisUpdater sets it to false for an install made by an nsis-web installer
+        this.disableWebInstallerDefault = true;
         /**
          * *NSIS only* Disable differential downloads and always perform full download of installer.
          *
@@ -268,6 +305,9 @@ export class AppUpdater extends EventEmitter {
          */
         this.updateManifestPublicKey = null;
         this.manifestVerificationWarned = false;
+        // v27 behaviour changes a plain-JavaScript app would otherwise not notice: each is announced once per updater
+        this.crossOriginHeadersWarned = false;
+        this.crossOriginFeedQueryWarned = false;
         /**
          *  The request headers.
          */
@@ -279,6 +319,7 @@ export class AppUpdater extends EventEmitter {
          */
         this.signals = new UpdaterSignal(this);
         this._appUpdateConfigPath = null;
+        this._verifyUpdateFile = DEFAULT_VERIFY_UPDATE_FILE;
         this._isUpdateSupported = updateInfo => this.checkIfUpdateSupported(updateInfo);
         this._isUserWithinRollout = updateInfo => this.isStagingMatch(updateInfo);
         this.clientPromise = null;
@@ -389,7 +430,10 @@ export class AppUpdater extends EventEmitter {
             }
             void it.downloadPromise.then(() => {
                 const notificationContent = AppUpdater.formatDownloadNotification(it.updateInfo.version, this.app.name, downloadNotification);
-                new (require("electron").Notification)(notificationContent).show();
+                const ElectronNotification = require("electron").Notification;
+                new ElectronNotification(notificationContent).show();
+            }, () => {
+                // downloadUpdate already dispatches the error event
             });
             return it;
         });
@@ -530,7 +574,12 @@ export class AppUpdater extends EventEmitter {
             // `reason` is set when the manifest fails the structural checks a signed manifest must pass (e.g. an empty
             // `files` list or control characters in a signed field) — those are rejected before any key is tried.
             const cause = result.reason == null ? `none of the ${trustedKeys.length} trusted key(s) validates any of its signatures` : `the signed manifest is malformed (${result.reason})`;
-            throw newError(`Update manifest signature verification failed for version ${info.version}: ${cause}. The update metadata may have been tampered with. Refusing to update.`, "ERR_UPDATER_MANIFEST_SIGNATURE_INVALID");
+            // download URLs written into latest*.yml after signing (e.g. pre-signed URLs) are the likely cause, rather than tampering
+            const blockMapUrlHint = (info.files ?? []).some(it => it?.blockMapUrl != null)
+                ? " files[].blockMapUrl is covered by the signature, like files[].url, so it has to be in latest*.yml before the manifest is signed: " +
+                    "https://www.electron.build/docs/features/signed-update-manifests#what-is-signed"
+                : "";
+            throw newError(`Update manifest signature verification failed for version ${info.version}: ${cause}. The update metadata may have been tampered with. Refusing to update.${blockMapUrlHint}`, "ERR_UPDATER_MANIFEST_SIGNATURE_INVALID");
         }
         this._logger.debug?.(`Update manifest for version ${info.version} verified with trusted key ${result.keyId}`);
         this._logger.info(`Update manifest signature verified for version ${info.version}`);
@@ -604,11 +653,19 @@ export class AppUpdater extends EventEmitter {
             }
             return e;
         };
+        const requestHeaders = this.computeRequestHeaders(updateInfoAndProvider.provider);
+        try {
+            // fail before any download rather than in the middle of one
+            AppUpdater.checkFeedBaseUrlDeclared(updateInfoAndProvider.provider, requestHeaders);
+        }
+        catch (e) {
+            return Promise.reject(errorHandler(e));
+        }
         this.downloadPromise = this.doDownloadUpdate({
             updateInfoAndProvider,
-            requestHeaders: this.computeRequestHeaders(updateInfoAndProvider.provider),
+            requestHeaders,
             cancellationToken,
-            disableWebInstaller: this._disableWebInstaller,
+            disableWebInstaller: this.disableWebInstaller,
             disableDifferentialDownload: this.disableDifferentialDownload,
         })
             .catch((e) => {
@@ -665,6 +722,55 @@ export class AppUpdater extends EventEmitter {
         }
         return this.computeFinalHeaders({ accept: "*/*" });
     }
+    /**
+     * Headers for a download from `url`: when the provider has a `feedBaseUrl`, the credential-bearing ones are dropped if `url` is on
+     * another origin than `originUrl` (the feed by default). `null` keeps them for every URL.
+     */
+    downloadRequestHeaders(url, downloadUpdateOptions, originUrl) {
+        const provider = downloadUpdateOptions.updateInfoAndProvider.provider;
+        const headers = downloadUpdateOptions.requestHeaders;
+        AppUpdater.checkFeedBaseUrlDeclared(provider, headers);
+        const feedBaseUrl = provider.feedBaseUrl;
+        if (feedBaseUrl == null) {
+            return headers;
+        }
+        const credentialOrigin = originUrl ?? feedBaseUrl;
+        if (HttpExecutor.isCrossOrigin(credentialOrigin, url)) {
+            this.announceCrossOriginDownload(url, credentialOrigin, headers, originUrl == null ? feedBaseUrl : null);
+        }
+        return HttpExecutor.removeCrossOriginSensitiveHeaders(headers, credentialOrigin, url);
+    }
+    // Only names are logged (header names, query parameter names, origins), never values.
+    announceCrossOriginDownload(url, credentialOrigin, headers, feedBaseUrl) {
+        const docs = "https://www.electron.build/docs/migration/v27-breaking-changes#update-credentials-stay-on-the-feeds-origin";
+        const names = HttpExecutor.sensitiveHeaderNames(headers);
+        if (names.length !== 0 && !this.crossOriginHeadersWarned) {
+            this.crossOriginHeadersWarned = true;
+            this._logger.warn(`electron-updater 7 (electron-builder v27) sends the credential headers from requestHeaders / addAuthHeader only to the update feed's origin (${credentialOrigin.origin}): ` +
+                `${names.join(", ")} not sent to ${url.origin}, which is another origin. ` +
+                `If that server needs them, serve the update files from the feed origin or use pre-signed URLs. ${docs}`);
+        }
+        const feedQueryNames = feedBaseUrl == null ? [] : [...new Set(feedBaseUrl.searchParams.keys())];
+        if (feedQueryNames.length !== 0 && !this.crossOriginFeedQueryWarned) {
+            this.crossOriginFeedQueryWarned = true;
+            this._logger.warn(`electron-updater 7 (electron-builder v27) adds the feed URL's query string (${feedQueryNames.join(", ")}) only to URLs on the update feed's origin (${feedBaseUrl.origin}): ` +
+                `not added to the download from ${url.origin}, which keeps its own query string. ` +
+                `If that server needs it, serve the update files from the feed origin or use pre-signed URLs. ${docs}`);
+        }
+    }
+    // Credential headers are only sent where the provider says (Provider.feedBaseUrl); a provider that does not say is a configuration error.
+    static checkFeedBaseUrlDeclared(provider, headers) {
+        if (provider.feedBaseUrl !== undefined) {
+            return;
+        }
+        const names = HttpExecutor.sensitiveHeaderNames(headers);
+        if (names.length !== 0) {
+            throw newError(`The custom update provider ${provider.constructor.name} does not declare feedBaseUrl, but its downloads would send the credential headers ${names.join(", ")} ` +
+                `(from requestHeaders, addAuthHeader or fileExtraDownloadHeaders). Override Provider.feedBaseUrl to return the feed URL ` +
+                `(the headers are then only sent to its origin), or null to send the request headers to every origin. ` +
+                `https://www.electron.build/docs/migration/v27-breaking-changes#update-credentials-stay-on-the-feeds-origin`, "ERR_UPDATER_FEED_BASE_URL_NOT_DECLARED");
+        }
+    }
     async getOrCreateStagingUserId() {
         const file = path.join(this.app.userDataPath, ".updaterId");
         try {
@@ -729,7 +835,7 @@ export class AppUpdater extends EventEmitter {
             this._logger.warn("Update artifact is validated with a SHA-256 (sha2) checksum only. SHA-256 update checksums are deprecated; electron-builder v28 will require SHA-512 and reject SHA-256-only update metadata (fail-closed). Regenerate latest*.yml with a current electron-builder and avoid pinning electronUpdaterCompatibility to a legacy (<2.15 / 1.x) range.");
         }
         const downloadOptions = {
-            headers: taskOptions.downloadUpdateOptions.requestHeaders,
+            headers: this.downloadRequestHeaders(fileInfo.url, taskOptions.downloadUpdateOptions),
             cancellationToken: taskOptions.downloadUpdateOptions.cancellationToken,
             sha2: fileInfo.info.sha2,
             sha512: fileInfo.info.sha512,
@@ -740,22 +846,10 @@ export class AppUpdater extends EventEmitter {
         const updateInfo = taskOptions.downloadUpdateOptions.updateInfoAndProvider.info;
         const version = updateInfo.version;
         const packageInfo = fileInfo.packageInfo;
-        function getCacheUpdateFileName() {
-            // NodeJS URL doesn't decode automatically
-            const urlPath = decodeURIComponent(taskOptions.fileInfo.url.pathname);
-            if (urlPath.toLowerCase().endsWith(`.${taskOptions.fileExtension.toLowerCase()}`)) {
-                return path.basename(urlPath);
-            }
-            else {
-                // url like /latest — use basename so a server-supplied path like "../../etc/evil"
-                // cannot escape the cache directory via path.join
-                return path.basename(taskOptions.fileInfo.info.url);
-            }
-        }
         const downloadedUpdateHelper = await this.getOrCreateDownloadHelper();
         const cacheDir = downloadedUpdateHelper.cacheDirForPendingUpdate;
         await fsExtra.mkdir(cacheDir, { recursive: true });
-        const updateFileName = getCacheUpdateFileName();
+        const updateFileName = getCacheUpdateFileName(taskOptions.fileInfo, taskOptions.fileExtension);
         let updateFile = path.join(cacheDir, updateFileName);
         const packageFile = packageInfo == null ? null : path.join(cacheDir, `package-${version}${path.extname(packageInfo.path) || ".7z"}`);
         const pendingBlockMapFile = path.join(cacheDir, "current.blockmap");
@@ -780,11 +874,7 @@ export class AppUpdater extends EventEmitter {
             return withLegacyArrayCompat(packageFile == null ? { updateFile } : { updateFile, packageFile }, this._logger);
         };
         const log = this._logger;
-        const cachedUpdateFile = await downloadedUpdateHelper.validateDownloadedPath(updateFile, updateInfo, fileInfo, log);
-        if (cachedUpdateFile != null) {
-            updateFile = cachedUpdateFile;
-            return await done(false);
-        }
+        const cancellationToken = taskOptions.downloadUpdateOptions.cancellationToken;
         const removeFileIfAny = async () => {
             await downloadedUpdateHelper.clear().catch(() => {
                 // ignore
@@ -793,6 +883,35 @@ export class AppUpdater extends EventEmitter {
                 // ignore
             });
         };
+        const verifyUpdateFile = async (fileToVerify) => {
+            const failure = verificationFailureMessage(await this.verifyUpdateFile({
+                updateFilePath: fileToVerify,
+                originalUpdateFileName: updateFileName,
+                // only offered when the companion package was actually written: `packageFile` is derived from the update
+                // metadata, so it is non-null for any channel file carrying a `packages` block even on targets that never
+                // download one
+                packageFilePath: packageFile != null && (await fsExtra.pathExists(packageFile)) ? packageFile : undefined,
+                cancellationToken,
+            }));
+            if (failure != null) {
+                throw newError(`Downloaded update file ${updateFileName} failed verification: ${failure}`, "ERR_UPDATER_INVALID_UPDATE_FILE");
+            }
+        };
+        const cachedUpdateFile = await downloadedUpdateHelper.validateDownloadedPath(updateFile, updateInfo, fileInfo, log);
+        if (cachedUpdateFile != null) {
+            updateFile = cachedUpdateFile;
+            // an update downloaded by an earlier session is about to be announced as ready to install without being
+            // downloaded again, so the custom verifier has to gate it here too — its only other gate is the sha512 taken
+            // from the very update metadata a custom verifier exists to distrust
+            try {
+                await verifyUpdateFile(updateFile);
+            }
+            catch (e) {
+                await removeFileIfAny();
+                throw e;
+            }
+            return await done(false);
+        }
         // a fresh download starts — drop any blockmap left over from a previous update round, so that when this round
         // does not produce a new one (e.g. the differential download is skipped), the leftover cannot be promoted to the
         // cache next to a file it does not describe
@@ -800,6 +919,18 @@ export class AppUpdater extends EventEmitter {
         const tempUpdateFile = await createTempUpdateFile(`temp-${updateFileName}`, cacheDir, log);
         try {
             await taskOptions.task(tempUpdateFile, downloadOptions, packageFile, removeFileIfAny);
+            // checked before verifying as well as after: verification can be arbitrarily expensive (hashing a large
+            // installer, a remote attestation call), and there is no point paying for it on a download already cancelled
+            if (cancellationToken.cancelled) {
+                throw new CancellationError();
+            }
+            await verifyUpdateFile(tempUpdateFile);
+            if (cancellationToken.cancelled) {
+                throw new CancellationError();
+            }
+            // only now may the file be made executable — doing it inside `task` would leave an unverified binary
+            // executable under a predictable path for as long as verification takes
+            await taskOptions.afterVerification?.(tempUpdateFile);
             await retry(() => fsExtra.rename(tempUpdateFile, updateFile), {
                 retries: 60,
                 interval: 500,
@@ -835,11 +966,24 @@ export class AppUpdater extends EventEmitter {
                 return true;
             }
             const provider = downloadUpdateOptions.updateInfoAndProvider.provider;
-            const blockmapFileUrls = await provider.getBlockMapFiles(fileInfo.url, this.app.version, downloadUpdateOptions.updateInfoAndProvider.info.version, this.previousBlockmapBaseUrlOverride);
-            this._logger.info(`Download block maps (old: "${blockmapFileUrls[0]}", new: ${blockmapFileUrls[1]})`);
-            const downloadBlockMap = async (url) => {
+            const override = this.previousBlockmapBaseUrlOverride;
+            const getBlockMapFiles = () => provider.getBlockMapFiles(fileInfo.url, this.app.version, downloadUpdateOptions.updateInfoAndProvider.info.version, override);
+            let oldBlockMapUrl;
+            let newBlockMapUrl;
+            if (fileInfo.blockMapUrl == null) {
+                ;
+                [oldBlockMapUrl, newBlockMapUrl] = await getBlockMapFiles();
+            }
+            else {
+                // The update manifest names the new blockmap (e.g. separately pre-signed), so a URL derived from the new file's URL is not
+                // valid for the old one: the old blockmap comes from the cache, else from previousBlockmapBaseUrlOverride.
+                newBlockMapUrl = fileInfo.blockMapUrl;
+                oldBlockMapUrl = override ? (await getBlockMapFiles())[0] : null;
+            }
+            this._logger.info(`Download block maps (old: "${oldBlockMapUrl ?? "cache only"}", new: ${newBlockMapUrl})`);
+            const downloadBlockMap = async (url, originUrl) => {
                 const data = await this.httpExecutor.downloadToBuffer(url, {
-                    headers: downloadUpdateOptions.requestHeaders,
+                    headers: this.downloadRequestHeaders(url, downloadUpdateOptions, originUrl),
                     cancellationToken: downloadUpdateOptions.cancellationToken,
                 });
                 if (data == null || data.length === 0) {
@@ -858,7 +1002,7 @@ export class AppUpdater extends EventEmitter {
                 logger: this._logger,
                 newFile: installerPath,
                 isUseMultipleRangeRequest: provider.isUseMultipleRangeRequest,
-                requestHeaders: downloadUpdateOptions.requestHeaders,
+                requestHeaders: this.downloadRequestHeaders(fileInfo.url, downloadUpdateOptions),
                 cancellationToken: downloadUpdateOptions.cancellationToken,
             };
             if (this.listenerCount(DOWNLOAD_PROGRESS) > 0) {
@@ -880,14 +1024,21 @@ export class AppUpdater extends EventEmitter {
                 }
                 return null;
             };
-            const newBlockMapData = await downloadBlockMap(blockmapFileUrls[1]);
+            const newBlockMapData = await downloadBlockMap(newBlockMapUrl);
             await saveBlockMapToCacheDir(newBlockMapData, this.downloadedUpdateHelper.cacheDirForPendingUpdate);
             // get old blockmap from cache dir first, if not found, download it
             let oldBlockMapData = await getBlockMapFromCacheDir(this.downloadedUpdateHelper.cacheDir);
             isOldBlockMapFromCache = oldBlockMapData != null;
             if (oldBlockMapData == null) {
-                this._logger.info(`No cached blockmap for the old installer, downloading it from "${blockmapFileUrls[0]}"`);
-                oldBlockMapData = await downloadBlockMap(blockmapFileUrls[0]);
+                if (oldBlockMapUrl == null) {
+                    // the full download caches the new blockmap downloaded above, so the next update can be differential
+                    this._logger.info("No cached blockmap for the old installer, and the update manifest sets blockMapUrl, so the old blockmap URL cannot be derived " +
+                        "(set previousBlockmapBaseUrlOverride to download it): downloading the full update");
+                    return true;
+                }
+                this._logger.info(`No cached blockmap for the old installer, downloading it from "${oldBlockMapUrl}"`);
+                // the old blockmap comes from previousBlockmapBaseUrlOverride when the app sets it, so that origin gets the credentials
+                oldBlockMapData = await downloadBlockMap(oldBlockMapUrl, override ? new URL(override) : undefined);
             }
             await new GenericDifferentialDownloader(fileInfo.info, this.httpExecutor, downloadOptions).download(oldBlockMapData, newBlockMapData);
             return false;
@@ -905,6 +1056,18 @@ export class AppUpdater extends EventEmitter {
         }
     }
 }
+/** @internal */
+export function getCacheUpdateFileName(fileInfo, fileExtension) {
+    // NodeJS URL doesn't decode automatically
+    const urlPath = decodeURIComponent(fileInfo.url.pathname);
+    const fileName = path.basename(urlPath.toLowerCase().endsWith(`.${fileExtension.toLowerCase()}`) ? urlPath : fileInfo.info.url);
+    // basename(".") and basename("..") remain traversal segments. Reject them explicitly,
+    // along with values that cannot be represented as a single portable filename.
+    if (fileName.length === 0 || fileName === "." || fileName === ".." || fileName.includes("\0") || fileName.includes("/") || fileName.includes("\\")) {
+        throw newError(`Invalid update file name: ${JSON.stringify(fileName)}`, "ERR_UPDATER_INVALID_FILE_NAME");
+    }
+    return fileName;
+}
 function hasPrereleaseComponents(version) {
     const versionPrereleaseComponent = getVersionPreleaseComponents(version);
     return versionPrereleaseComponent != null && versionPrereleaseComponent.length > 0;