feat: add integrity digest management commands and functionality by nmggithub · Pull Request #380 · electron/asar

nmggithub · 2025-10-26T02:59:49Z

This is to add support for the additional integrity digest API I am adding in this pull request: electron/electron#48587. I believe this package is the best place to put this functionality. Once merged, this functionality can be pulled into tools like Electron Forge as needed.

nmggithub · 2025-11-14T16:51:07Z

@VerteDinde I saw the Prettier message in the CI run. Sorry about that! Should be good to go now.

nmggithub · 2026-01-23T16:08:45Z

Just curious, when do we want to merge this in? From what I understand, the changes this interacts with are in Electron 41, which just recently had its Alpha release. Do we want to wait until the Beta, or even the Stable release? Or can we merge it in now?

erickzhao · 2026-01-23T18:00:08Z

Ah, thanks for the reminder ping @nmggithub. cc @electron/wg-ecosystem this needs a review and we should get a new release out before the next stable version drops.

src/integrity-digest.ts

socket-security · 2026-02-25T18:12:10Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

erickzhao · 2026-02-25T18:12:11Z

I pushed up a few commits to apply yarn.lock changes myself in accordance to our policies and then merged in main and fixed the merge conflicts.

erickzhao · 2026-02-25T19:55:20Z

bin/asar.mjs

    extractAll(archive, dest)
  })

+program.command('integrity-digest <app> <command>')


note(non-blocking): I don't think this necessarily needs to land in this PR, but since this adds a new command, we should update the usage section of the README as well (

asar/README.md

Lines 26 to 53 in 13bb932

### Usage

```bash

$ asar --help

Usage: asar [options] [command]

Commands:

pack|p <dir> <output>

create asar archive

list|l <archive>

list files of asar archive

extract-file|ef <archive> <filename>

extract one file from archive

extract|e <archive> <dest>

extract archive

Options:

-h, --help output usage information

-V, --version output the version number

```

)

I think it'd make sense to both update the list of commands and add a new section with more prose on usage.

erickzhao · 2026-02-25T20:16:37Z

src/integrity-digest.ts

+
+type AsarIntegrity = Record<string, Pick<FileRecord['integrity'], 'algorithm' | 'hash'>>;
+
+function calculateIntegrityDigestV1(asarIntegrity: AsarIntegrity): IntegrityDigestV1 {


nit: why is this put into a separate function?

For separation in case we ever have a V2. I'd rather not inline it in the later switch statement. EDIT: Just realized I'm not switching on this one specifically. Will consider this more. EDIT 2: if you were questioning why its a separate function than the one below, I believe I did that to codify the explicit conversion between Info.plist and the resulting integrity hash.

Adjusted in e7ae2d0.

erickzhao · 2026-02-25T20:20:52Z

src/integrity-digest.ts

+  );
+}
+
+// High-level integrity digest management functions


issue(blocking): If we want these to be usable via the JavaScript API (for integration in other tools), we would need to re-export them via src/asar.ts as well.

It would also be helpful to add TSDoc comments at least to the functions that get exported so that they can appear in the API docs as well.

Ah yeah, I think I may have also accidentally un-exported some important ones. Will take a look.

Ended up using the functions above as API in 0677da2.

src/integrity-digest.ts

bin/asar.mjs

…to be API

…ersion

erickzhao

If it's possible, can we add tests to this PR as well?

src/integrity-digest.ts

… async

dsanders11

Few small comments but overall LGTM.

test/integrity-digest-integration-spec.ts

src/integrity-digest.ts

bin/asar.mjs

Co-authored-by: David Sanders <dsanders11@ucsbalum.com>

… error

socket-security · 2026-03-04T21:10:50Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@types/plist@3.0.5
	@types/semver@7.7.1
	@electron/fuses@2.1.0
	plist@3.1.0
	@electron/get@4.0.2
	semver@7.7.4

View full report

erickzhao

LGTM

erickzhao · 2026-03-04T21:27:54Z

test/integrity-digest-integration-spec.ts

+
+    const electronVersion = await getTargetElectronVersion();
+    const parsedElectronVersion = semver.parse(electronVersion);
+    if (!parsedElectronVersion || 41 > parsedElectronVersion.major) {


Suggested change

if (!parsedElectronVersion || 41 > parsedElectronVersion.major) {

if (!parsedElectronVersion || parsedElectronVersion.major < 41) {

nit: style (reads a bit better)

I chose the number-first pattern on purpose for style, but I can see your point here. The only issue is that your new logic does not handle a case where parsedElectronVersion is undefined. I will make some changes to this, though.

Fixed as of 47b17c3.

oops sorry, had a slight typo in the original suggestion diff as well

…ation test

Co-authored-by: David Sanders <dsanders11@ucsbalum.com>

VerteDinde · 2026-03-05T00:59:03Z

Sorry @nmggithub, if you wouldn't mind reconciling the small changes with main, I can get this merged for you

erickzhao · 2026-03-05T01:00:35Z

@VerteDinde I can handle those since they're related to dependencies on a PR I just merged in

electron-npm-package-publisher · 2026-03-05T01:51:07Z

🎉 This PR is included in version 4.1.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

feat: add integrity digest management commands and functionality

ce16569

nmggithub requested a review from a team as a code owner October 26, 2025 02:59

nmggithub mentioned this pull request Oct 26, 2025

feat: validate integrity of ASAR Integrity dictionary on macOS electron/electron#48587

Merged

1 task

nmggithub added 2 commits October 30, 2025 12:54

fix: don't export functions that don't need to be exported

3f027aa

fix: run prettier

611dd4d

nmggithub commented Jan 23, 2026

View reviewed changes

src/integrity-digest.ts Outdated Show resolved Hide resolved

erickzhao added 3 commits February 25, 2026 10:08

chore: reset yarn.lock to main

559938d

chore: use full version for caret range

0ceedaa

Merge branch 'main' into nmggithub/main

be7ae7a

erickzhao requested changes Feb 25, 2026

View reviewed changes

nmggithub added 9 commits February 25, 2026 15:46

style: add comment for sentinel value

6dece0c

refactor: extract digest calculations into generic function

e7ae2d0

docs: clarify platform requirements for new command

1e4a8d3

refactor: flip argument order for integrity-digest command

455eb24

docs: add documentation for integrity digest feature

7cc7653

style: add cleaner type checking for integrity calculator

3e4cab9

refactor: make calculation, getting, and storing of integrity digest …

0677da2

…to be API

style: fix linting issues

30b4ae9

docs: clarify message when encountering unexpected integrity digest v…

e3d7e7d

…ersion

nmggithub requested a review from erickzhao February 25, 2026 22:02

Merge branch 'main' into nmggithub/main

8cb1ae9

VerteDinde approved these changes Mar 3, 2026

View reviewed changes

yarn up minimatch and tar

35aaaec

erickzhao reviewed Mar 3, 2026

View reviewed changes

src/integrity-digest.ts Outdated Show resolved Hide resolved

src/integrity-digest.ts Outdated Show resolved Hide resolved

nmggithub added 5 commits March 3, 2026 19:58

refactor: validate integrity information before calculating hash

01c203d

refactor: use custom errors for itegrity digest and export them as API

d85cc9e

refactor: make get and set integrity digest functions sync instead of…

3173d04

… async

fix: fix inverted logic test in ASAR integrity validation

e17dbdf

test: add integration test for integrity digest

9e0fdc6

nmggithub requested a review from erickzhao March 4, 2026 01:00

test: add environment variables for itegration test

844efe0

dsanders11 reviewed Mar 4, 2026

View reviewed changes

test/integrity-digest-integration-spec.ts Outdated Show resolved Hide resolved

src/integrity-digest.ts Outdated Show resolved Hide resolved

src/integrity-digest.ts Outdated Show resolved Hide resolved

bin/asar.mjs Outdated Show resolved Hide resolved

nmggithub and others added 3 commits March 4, 2026 02:23

style: clarify integrity digest cli switch statement

3f57b68

Co-authored-by: David Sanders <dsanders11@ucsbalum.com>

refactor: use node:timers/promises for sleep instead of promisify

8f27aaa

refactor: change style of defining custom errors and export remaining…

0b01158

… error

nmggithub requested a review from dsanders11 March 4, 2026 07:33

nmggithub and others added 4 commits March 4, 2026 06:09

style: make linter happy again

ab485b9

fix: add additional skip path to integrity digest integration test

1cb8606

revert yarn.lock

41adfd3

reapply lockfile changes

9fedc9a

erickzhao approved these changes Mar 4, 2026

View reviewed changes

refactor: adjusted electron version checks in integrity digest integr…

47b17c3

…ation test

erickzhao approved these changes Mar 4, 2026

View reviewed changes

nmggithub and others added 2 commits March 4, 2026 16:49

style: make linter happier yet again

429259b

style: remove unneeded whitespace in comment

f242f4e

Co-authored-by: David Sanders <dsanders11@ucsbalum.com>

Merge branch 'main' into nmggithub/main

a01082e

VerteDinde merged commit ccaf57f into electron:main Mar 5, 2026
6 checks passed

electron-npm-package-publisher bot added the released label Mar 5, 2026

	### Usage

	```bash
	$ asar --help

	Usage: asar [options] [command]

	Commands:

	pack\|p <dir> <output>
	create asar archive

	list\|l <archive>
	list files of asar archive

	extract-file\|ef <archive> <filename>
	extract one file from archive

	extract\|e <archive> <dest>
	extract archive


	Options:

	-h, --help output usage information
	-V, --version output the version number

	```


		type AsarIntegrity = Record<string, Pick<FileRecord['integrity'], 'algorithm' \| 'hash'>>;

		function calculateIntegrityDigestV1(asarIntegrity: AsarIntegrity): IntegrityDigestV1 {

	if (!parsedElectronVersion \|\| 41 > parsedElectronVersion.major) {
	if (!parsedElectronVersion \|\| parsedElectronVersion.major < 41) {

Conversation

nmggithub commented Oct 26, 2025

Uh oh!

nmggithub commented Nov 14, 2025

Uh oh!

nmggithub commented Jan 23, 2026

Uh oh!

erickzhao commented Jan 23, 2026

Uh oh!

Uh oh!

socket-security bot commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

erickzhao commented Feb 25, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nmggithub Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nmggithub Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

erickzhao left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

dsanders11 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

socket-security bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

erickzhao left a comment

Choose a reason for hiding this comment

Uh oh!

erickzhao Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

VerteDinde commented Mar 5, 2026

Uh oh!

erickzhao commented Mar 5, 2026

Uh oh!

Uh oh!

electron-npm-package-publisher bot commented Mar 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

socket-security bot commented Feb 25, 2026 •

edited

Loading

nmggithub Feb 25, 2026 •

edited

Loading

nmggithub Feb 25, 2026 •

edited

Loading

socket-security bot commented Mar 4, 2026 •

edited

Loading

erickzhao Mar 4, 2026 •

edited

Loading