AIR Captive Runtime Application updater security

1
votes

I create app with captive runtime for Windows and MacOS. To install updates I chose this schema:

  1. Main application check for update and download files which are updated:
    • swfs
    • resources
    • air runtime
  2. After downloading, main app runs Updater, which:
    • replace application files with downloaded ones (cause app directory is read-only for Main application and I can't update AIR lib in Windows without closing application)
    • restart main application

Updater is NOT-AIR application (for disc space economy).

I see security issue here, cause downloaded files or update link could be replaced by someone.
I check this topic and it clarify some position about updating resources: http://mabulous.com/air-applications-that-can-be-updated-without-requiring-admin-rights In few worlds, for my situation - I should check xml in META-INF with Main application before running Updater. But how to validate air runtime directory?

1
actionscript-3air
I'm sorry but i'm not sure if I fully understand your problem. Can you be more precisly on what you are trying to achieve or what your problem belongs to? - Paul Facklam

1 Answers

0
votes

OK, I've make decision for this time:

1) It's not a problem for macos gatekeeper if you update any files in your .app signed with developer id after first launch

2) Nobody could guarantee that any meta willn't be replaced by somebody

So, there is no reasons to care about it :)