AppImage / AppImage/AppImageSpec

[Feature] Integrity verification

Ouverte
#35 12 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
wontfix
Langage dominant
Aucune donnée de langage
Étoiles
93
Forks
27
Métriques de merge des PR
Aucune PR mergée en 30 j

Description

AppImages are files which can get really big in size, and download errors can occur with such sizes
I propose to add some way to (at least try to) verify it's integrity at launch

Why ?
As of now, a partially downloaded AppImage will fail to launch with
```
Something went wrong trying to read the squashfs image.

Cannot mount AppImage, please check your FUSE setup.
You might still be able to extract the contents of this AppImage
if you run it with the --appimage-extract option.
See https://github.com/AppImage/AppImageKit/wiki/FUSE
for more information
open dir error: No such file or directory
```

It is maybe harmless in this case, but I think it could potentially cause problems if the partially downloaded AppImage seems like a legit squashfs image. (This is only a theory, I do not have any proof this can happen)

Implementation propositions :
- Use https://github.com/AppImage/AppImageSpec/issues/29 and verify the md5sum of the AppImage on launch.
Cons : as pointed there, that would be costly. Plus, I'm not sure if this section is actually going to be in the specification
- Store the file size in bytes in an ELF section, maybe `.appimage_size`, and verify the size of the executed file is the same
Cons : some programs might zerofill the file and fill bytes as their download them
- Store a CRC checksum in an ELF section, maybe `.crc_checksum`, and verify it. I think that's the best option, because CRC is an algorithm made for file integrity (as opposed to a simple file size verification), and is more lightweight than MD5

I think this feature should be looked at before https://github.com/AppImage/AppImageSpec/issues/34 (because well, it would modify the spec)

Guide de contribution

Aucun guide de contribution indexé pour ce dépôt

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.