Integrity check fails on community ffmpeg binary

[zkrige]

4.9.0

Error: SHA256 checksums do not match. at verify (file:///Users/distiller/desktop_viewer/mac/node_modules/nw-builder/src/get/verify.js:42:15) at get (file:///Users/distiller/desktop_viewer/mac/node_modules/nw-builder/src/get/index.js:137:5) at Module.nwbuild (file:///Users/distiller/desktop_viewer/mac/node_modules/nw-builder/src/index.js:86:5)

Fatal error: SHA256 checksums do not match.

[ayushmanchhabra]

Does this happen every time or once in a while?

[zkrige]

It happens on every build. If I roll back to 4.8.1 it works fine

[ayushmanchhabra]

Will try to debug this over the weekend. I know that the shasum is generated properly, maybe its comparing the wrong file's shasums?

[ayushmanchhabra]

It happens on every build. If I roll back to 4.8.1 it works fine

What options are you using for nwbuild?

[zkrige]

 "nwbuild": {
    "version": "0.91.0",
    "cache": true,
    "logLevel": "debug",
    "cacheDir": "./build/output/nwjs-cache",
    "srcDir": "./build/output/result",
    "ffmpeg": true,
    "glob": false
  }

[ayushmanchhabra]

Could you try v4.10.0? I've improved the error message.

[ayushmanchhabra]

Also v4.10.0 has the update helper apps functionality - let me know if any other osx bundles should be updated

[zkrige]

4.11.0 gives me

Error: SHA256 checksums do not match. The file nwjs-sdk-v0.92.0-osx-arm64/nwjs.app/Contents/Frameworks/nwjs Framework.framework/Versions/129.0.6668.59/libffmpeg.dylib expected shasum is 0bfbf06441dfa23495068c94a0e3ab358e2b803937e9f72390d0a7e8bf800c22 but the actual shasum is f697041a8ca371914f30113c62049d59ab4116d66d55960cd73a1fa30d93945b.
    at verify (file:///node_modules/nw-builder/src/get/verify.js:41:15)
    at get (file:///node_modules/nw-builder/src/get/index.js:129:5)
    at Module.nwbuild (file:///node_modules/nw-builder/src/index.js:84:5)

[ayushmanchhabra]

Figured out the issue - it is comparing the checksum of the official ffmpeg with the generated checksum of the community ffmpeg.

[zkrige]

Excellent. I'll test the new version asap

[zkrige]

This still fails if you're using cache.

If I have previously downloaded ffmpeg, then the verify fails because ffmpeg hash is wrong

{"version":"0.92.0","cache":true,"logLevel":"debug","cacheDir":"./build/output/nwjs-cache","srcDir":"./build/output/result","ffmpeg":true,"glob":false,"mode":"get","flavor":"sdk","platform":"osx","arch":"arm64"}
Error: SHA256 checksums do not match. The file nwjs-v0.92.0-osx-arm64/nwjs.app/Contents/Frameworks/nwjs Framework.framework/Versions/129.0.6668.59/libffmpeg.dylib expected shasum is bd45e411a355c0345b8655bd0b8d1f28d2cfd15f9dd425715c8702a04e69ca8e but the actual shasum is f697041a8ca371914f30113c62049d59ab4116d66d55960cd73a1fa30d93945b.
    at verify (file:///node_modules/nw-builder/src/get/verify.js:41:15)
    at get (file:///nw-builder/src/get/index.js:96:3)
    at Module.nwbuild (file:///nw-builder/src/index.js:84:5)

[zkrige]

From 8537c6c43c0e0b7b734fe726b927d57ac796e0f3 Mon Sep 17 00:00:00 2001
From: Zayin Krige <zkrige@gmail.com>
Date: Wed, 2 Oct 2024 08:16:55 +0200
Subject: [PATCH] skip hash verify for ffmpeg files

---
 src/get/index.js  |  1 +
 src/get/verify.js | 11 ++++++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/get/index.js b/src/get/index.js
index 541fc69..f1bb246 100644
--- a/src/get/index.js
+++ b/src/get/index.js
@@ -97,6 +97,7 @@ async function get(options) {
     `${options.downloadUrl}/v${options.version}/SHASUMS256.txt`,
     `${options.cacheDir}/shasum/${options.version}.txt`,
     options.cacheDir,
+    options.ffmpeg,
   );

   if (options.ffmpeg === true) {
diff --git a/src/get/verify.js b/src/get/verify.js
index 516b689..4df3ce0 100644
--- a/src/get/verify.js
+++ b/src/get/verify.js
@@ -11,10 +11,11 @@ import util from '../util.js';
  * @param {string} shaUrl - URL to get the shasum text file from.
  * @param {string} shaOut - File path to shasum text file.
  * @param {string} cacheDir - File path to cache directory.
+ * @param {boolean} ffmpeg - Is ffmpeg enabled.
  * @throws {Error}
  * @returns {Promise<boolean>} - Returns true if the checksums match.
  */
-export default async function verify(shaUrl, shaOut, cacheDir) {
+export default async function verify(shaUrl, shaOut, cacheDir, ffmpeg) {
   const shaOutExists = await util.fileExists(shaOut);

   if (shaOutExists === false) {
@@ -29,10 +30,14 @@ export default async function verify(shaUrl, shaOut, cacheDir) {
   const shasum = await fs.promises.readFile(shaOut, { encoding: 'utf-8' });
   const shasums = shasum.trim().split('\n');
   for await (const line of shasums) {
+    /* don't verify ffmpeg hash if we're downloading custom ffmpeg */
+    if (ffmpeg === true && line.toLowerCase().includes('ffmpeg')) {
+      continue;
+    }
     const [storedSha, filePath] = line.split('  ');
     const relativeFilePath = path.resolve(cacheDir, filePath);
-    const relativefilePathExists = await util.fileExists(relativeFilePath);
-    if (relativefilePathExists) {
+    const relativeFilePathExists = await util.fileExists(relativeFilePath);
+    if (relativeFilePathExists) {
       const fileBuffer = await fs.promises.readFile(relativeFilePath);
       const hash = crypto.createHash('sha256');
       hash.update(fileBuffer);
-- 
2.41.0

this should fix the issue

[zkrige]

Thanks! it looks like its working now

[ayushmanchhabra]

Does it output the warning message?

[zkrige]

yes it does