ASAR Integrity | Electron Перейти к основному содержанию Electron Документация API Блог Инструменты * Electron Forge * Electron Fiddle Сообщество * Управление * Примеры * Ресурсы Релизы Русский * English * Deutsch * Español * Français * 日本語 * Português * Русский * 中文 Поиск * Начать * Процессы в Electron * Рекомендации * Примеры * Разработка * Доступность * Advanced Installation Instructions * ASAR Archives * ASAR Integrity * Макеты и CLI * ES Modules (ESM) in Electron * Electron Fuses * Windows on ARM * Native Node Modules * Распространение * Тестирование и отладка * Ссылки * Вклад * * Разработка * ASAR Integrity На этой странице ASAR Integrity ASAR integrity is a security feature that validates the contents of your app's ASAR archives at runtime. Version support ​ Currently, ASAR integrity checking is supported on: * macOS as of electron>=16.0.0 * Windows as of electron>=30.0.0 [!NOTE] ASAR integrity is fully supported in Mac App Store (MAS) builds and is recommended as a best practice. While MAS-installed applications have their Resources/ folder protected by the system (owned by root), ASAR integrity still provides an additional layer of security. It is especially important if you use Electron's MAS build but distribute your app through channels other than the Mac App Store (such as direct download), since those installations won't have the system-level read-only protections. In order to enable ASAR integrity checking, you also need to ensure that your app.asar file was generated by a version of the @electron/asar npm package that supports ASAR integrity. Support was introduced in [email protected] . Note that this package has since migrated over to @electron/asar . All versions of @electron/asar support ASAR integrity. How it works ​ Each ASAR archive contains a JSON string header. The header format includes an integrity object that contains a hex encoded hash of the entire archive as well as an array of hex encoded hashes for each block of blockSize bytes. { "algorithm" : "SHA256" , "hash" : "..." , "blockSize" : 1024 , "blocks" : [ "..." , "..." ] } Separately, you need to define a hex encoded hash of the entire ASAR header when packaging your Electron app. When ASAR integrity is enabled, your Electron app will verify the header hash of the ASAR archive on runtime. If no hash is present or if there is a mismatch in the hashes, the app will forcefully terminate. Enabling ASAR integrity in the binary ​ ASAR integrity checking is currently disabled by default in Electron and can be enabled on build time by toggling the EnableEmbeddedAsarIntegrityValidation Electron fuse . When enabling this fuse, you typically also want to enable the onlyLoadAppFromAsar fuse. Otherwise, the validity checking can be bypassed via the Electron app code search path. const { flipFuses , FuseVersion , FuseV1Options } = require ( '@electron/fuses' ) flipFuses ( // E.g. /a/b/Foo.app pathToPackagedApp , { version : FuseVersion . V1 , [ FuseV1Options . EnableEmbeddedAsarIntegrityValidation ] : true , [ FuseV1Options . OnlyLoadAppFromAsar ] : true } ) [!TIP] With Electron Forge, you can configure your app's fuses with @electron-forge/plugin-fuses in your Forge configuration file. Providing the header hash ​ ASAR integrity validates the contents of the ASAR archive against the header hash that you provide on package time. The process of providing this packaged hash is different for macOS and Windows. Using Electron tooling ​ Electron Forge and Electron Packager do this setup automatically for you with no additional configuration whenever asar is enabled. The minimum required versions for ASAR integrity are: * @electron/[email protected] * @electron/[email protected] Using other build systems ​ macOS ​ When packaging for macOS, you must populate a valid ElectronAsarIntegrity dictionary block in your packaged app's Info.plist . An example is included below. Info.plist < key > ElectronAsarIntegrity </ key > < dict > < key > Resources/app.asar </ key > < dict > < key > algorithm </ key > < string > SHA256 </ string > < key > hash </ key > < string > 9d1f61ea03c4bb62b4416387a521101b81151da0cfbe18c9f8c8b818c5cebfac </ string > </ dict > </ dict > Valid algorithm values are currently SHA256 only. The hash is a hash of the ASAR header using the given algorithm. The @electron/asar package exposes a getRawHeader method whose result can then be hashed to generate this value (e.g. using the node:crypto module). Windows ​ When packaging for Windows, you must populate a valid resource entry of type Integrity and name ElectronAsar . The value of this resource should be a JSON encoded dictionary in the form included below: [ { "file" : "resources\\app.asar" , "alg" : "sha256" , "value" : "9d1f61ea03c4bb62b4416387a521101b81151da0cfbe18c9f8c8b818c5cebfac" } ] [!NOTE] For an implementation example, see src/resedit.ts in the Electron Packager code. Редактировать эту страницу Назад ASAR Archives Далее Макеты и CLI * Version support * How it works * Enabling ASAR integrity in the binary * Providing the header hash * Using Electron tooling * Using other build systems * macOS * Windows Документация * Начало работы * Справка по API Контрольные списки * Характеристика * Безопасность Инструменты * Electron Forge * Electron Fiddle Сообщество * Управление * Ресурсы * Discord * Bluesky * X * Mastodon * Stack Overflow Подробнее * GitHub * Open Collective * Панель управления инфраструктурой Авторское право OpenJS Foundation и участники проекта Electron. Все права защищены. OpenJS Foundation обладает зарегистрированными товарными знаками и использует их. Список товарных знаков OpenJS Foundation приведён в нашей Политике в отношении товарных знаков и в Списке товарных знаков . Товарные знаки™ и логотипы®, не указанные в списке товарных знаков OpenJS Foundation , являются товарными знаками™ или зарегистрированными® товарными знаками их владельцев. Их использование не подразумевает какой-либо принадлежности к ним или поддержки с их стороны. The OpenJS Foundation | Условия использования | Политика конфиденциальности | Устав | Кодекс поведения | Политика в отношении товарных знаков | Список товарных знаков | Политика использования файлов cookie Hosting and infrastructure graciously provided by