Skip to content

Conversation

jeanfbrito
Copy link
Collaborator

@jeanfbrito jeanfbrito commented Jun 28, 2025

🔐 Security Enhancement: Electron-Builder v26.0.3 + ASAR Integrity Protection

Upgrades electron-builder to v26.0.3 and implements ASAR integrity validation to prevent malicious app.asar replacement attacks (e.g., Loki C2, MITRE ATT&CK T1218.015).

Security Improvements

  • EnableEmbeddedAsarIntegrityValidation: true (blocks malicious ASAR files)
  • OnlyLoadAppFromAsar: true (prevents external code injection)

🎯 Smart Implementation

  • Regular builds: Full ASAR integrity protection applied
  • Mac App Store builds: Fuses skipped for compatibility (App Store provides own validation)
  • Cross-platform: Proper executable paths for Windows (Rocket.Chat.exe), Linux (rocketchat-desktop), macOS (Rocket.Chat.app)

🛠️ Technical Changes

  • Updated electron-builder: 25.1.826.0.3
  • Added conditional afterPack hook for platform-specific fuse application
  • Removed deprecated parameters: publisherName, signDlls, StartupWMClass, MimeType
  • Updated GitHub Actions release workflow for MAS compatibility

Closes: CORE-1069 - Protects against documented Electron security vulnerabilities while maintaining all distribution channels.

https://rocketchat.atlassian.net/browse/CORE-1069

@jeanfbrito jeanfbrito merged commit fedb593 into master Jun 28, 2025
6 of 8 checks passed
@jeanfbrito jeanfbrito deleted the core-1069 branch June 28, 2025 03:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant