AppImage / AppImage/AppImageSpec

[Feature] Integrity verification

オープン
#35 コメント 12 件 リアクション 0 件 担当者 0 名 GitHub で見る
wontfix
主要言語
言語のデータがありません
スター
93
フォーク
27
PR マージ指標
30日以内にマージされた PR はありません

説明

AppImages are files which can get really big in size, and download errors can occur with such sizes
I propose to add some way to (at least try to) verify it's integrity at launch

Why ?
As of now, a partially downloaded AppImage will fail to launch with
```
Something went wrong trying to read the squashfs image.

Cannot mount AppImage, please check your FUSE setup.
You might still be able to extract the contents of this AppImage
if you run it with the --appimage-extract option.
See https://github.com/AppImage/AppImageKit/wiki/FUSE
for more information
open dir error: No such file or directory
```

It is maybe harmless in this case, but I think it could potentially cause problems if the partially downloaded AppImage seems like a legit squashfs image. (This is only a theory, I do not have any proof this can happen)

Implementation propositions :
- Use https://github.com/AppImage/AppImageSpec/issues/29 and verify the md5sum of the AppImage on launch.
Cons : as pointed there, that would be costly. Plus, I'm not sure if this section is actually going to be in the specification
- Store the file size in bytes in an ELF section, maybe `.appimage_size`, and verify the size of the executed file is the same
Cons : some programs might zerofill the file and fill bytes as their download them
- Store a CRC checksum in an ELF section, maybe `.crc_checksum`, and verify it. I think that's the best option, because CRC is an algorithm made for file integrity (as opposed to a simple file size verification), and is more lightweight than MD5

I think this feature should be looked at before https://github.com/AppImage/AppImageSpec/issues/34 (because well, it would modify the spec)

コントリビューションガイド

このリポジトリのコントリビューションガイドは索引されていません

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。