AppImage / AppImage/AppImageSpec

[Feature] Integrity verification

未关闭
#35 12 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
wontfix
主要语言
没有语言数据
星标
93
派生
27
PR 合并指标
30 天内没有已合并 PR

描述

AppImages are files which can get really big in size, and download errors can occur with such sizes
I propose to add some way to (at least try to) verify it's integrity at launch

Why ?
As of now, a partially downloaded AppImage will fail to launch with
```
Something went wrong trying to read the squashfs image.

Cannot mount AppImage, please check your FUSE setup.
You might still be able to extract the contents of this AppImage
if you run it with the --appimage-extract option.
See https://github.com/AppImage/AppImageKit/wiki/FUSE
for more information
open dir error: No such file or directory
```

It is maybe harmless in this case, but I think it could potentially cause problems if the partially downloaded AppImage seems like a legit squashfs image. (This is only a theory, I do not have any proof this can happen)

Implementation propositions :
- Use https://github.com/AppImage/AppImageSpec/issues/29 and verify the md5sum of the AppImage on launch.
Cons : as pointed there, that would be costly. Plus, I'm not sure if this section is actually going to be in the specification
- Store the file size in bytes in an ELF section, maybe `.appimage_size`, and verify the size of the executed file is the same
Cons : some programs might zerofill the file and fill bytes as their download them
- Store a CRC checksum in an ELF section, maybe `.crc_checksum`, and verify it. I think that's the best option, because CRC is an algorithm made for file integrity (as opposed to a simple file size verification), and is more lightweight than MD5

I think this feature should be looked at before https://github.com/AppImage/AppImageSpec/issues/34 (because well, it would modify the spec)

贡献指南

这个仓库没有索引到贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。