Currently ASAR integrity checking is only supported on macOS.
Electron Forge / Electron Packager
If you are using
>= email@example.com or
>= @firstname.lastname@example.org then all these requirements are met for you automatically and you can skip to Toggling the Fuse.
Other build systems
In order to enable ASAR integrity checking you need to ensure that your
app.asar file was generated by a version of the
asar npm package that supports asar integrity. Support was introduced in version
Your must then populate a valid
ElectronAsarIntegrity dictionary block in your packaged apps
Info.plist. An example is included below.
algorithm values are currently
SHA256 only. The
hash is a hash of the ASAR header using the given algorithm. The
asar package exposes a
getRawHeader method whose result can then be hashed to generate this value.
Toggling the Fuse
ASAR integrity checking is currently disabled by default and can be enabled by toggling a fuse. See Electron Fuses for more information on what Electron Fuses are and how they work. When enabling this fuse you typically also want to enable the
onlyLoadAppFromAsar fuse otherwise the validity checking can be bypassed via the Electron app code search path.
// E.g. /a/b/Foo.app