Skip to content

Commit 1079aa8

Browse files
Copilotprobonopd
Copilot
and
probonopd
committed
Add sanitizer support and security documentation
Co-authored-by: probonopd <2480569+probonopd@users.noreply.github.com>
1 parent 048cb60 commit 1079aa8

File tree

3 files changed

+129
-0
lines changed

3 files changed

+129
-0
lines changed

‎CMakeLists.txt‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,22 @@ execute_process(
3737
# by default, static builds are off allow for working on this tool on any distribution
3838
option(BUILD_STATIC OFF)
3939

40+
# Optional sanitizer support for testing and debugging
41+
# Enable with -DENABLE_SANITIZERS=ON
42+
# Note: Cannot be used with static builds
43+
option(ENABLE_SANITIZERS "Enable AddressSanitizer and UndefinedBehaviorSanitizer" OFF)
44+
45+
if(ENABLE_SANITIZERS)
46+
if(BUILD_STATIC)
47+
message(FATAL_ERROR "Sanitizers cannot be used with static builds")
48+
endif()
49+
50+
message(STATUS "Enabling AddressSanitizer and UndefinedBehaviorSanitizer")
51+
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fsanitize=address,undefined -fno-omit-frame-pointer")
52+
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fsanitize=address,undefined -fno-omit-frame-pointer")
53+
set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fsanitize=address,undefined")
54+
endif()
55+
4056
if(BUILD_STATIC)
4157
# since this project does not expose any libraries, we can safely set the linker flag globally
4258
set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -static -static-libgcc -no-pie")

‎README.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,29 @@ If you are on an Intel machine and would like to cross-compile for ARM:
5656
* For 64 bit ARM, run `ARCH=aarch64 bash ./ci/build-in-docker.sh`
5757
* For 32 bit ARM, run `ARCH=armhf bash ./ci/build-in-docker.sh`
5858

59+
### Development Builds
60+
61+
For local development with sanitizers enabled:
62+
63+
```bash
64+
mkdir build && cd build
65+
cmake .. -DENABLE_SANITIZERS=ON
66+
make
67+
```
68+
69+
Note: Sanitizer builds cannot be combined with static builds and are for development/testing only.
70+
71+
## Security
72+
73+
This project includes several security and supply chain improvements:
74+
75+
- **Compiler Warnings**: Built with `-Wall -Wextra -Wconversion -Werror` to catch potential bugs
76+
- **Hash Verification**: All downloaded dependencies are verified with SHA256 hashes
77+
- **Build Attestation**: GitHub releases include cryptographically signed build provenance
78+
- **Sanitizer Support**: Optional ASAN/UBSAN support for development testing
79+
80+
For more details, see [SECURITY.md](SECURITY.md).
81+
5982
## Changelog
6083

6184
* Unlike previous versions of this tool provided in the [AppImageKit](https://github.com/AppImage/AppImageKit/) repository, this version downloads the latest AppImage runtime (which will become part of the AppImage) from https://github.com/AppImage/type2-runtime/releases. If you do not like this (or if your build system does not have Internet access), you can supply a locally downloaded AppImage runtime using the `--runtime-file` parameter instead.

‎SECURITY.md‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# Security and Supply Chain
2+
3+
This document describes the security measures and supply chain considerations for appimagetool.
4+
5+
## Compiler Security Flags
6+
7+
The project is built with comprehensive compiler warnings enabled to catch potential bugs and undefined behavior:
8+
9+
- `-Wall`: Enable all common warnings
10+
- `-Wextra`: Enable extra warnings
11+
- `-Wconversion`: Warn about implicit type conversions that may alter values
12+
- `-Werror`: Treat warnings as errors to ensure they are addressed
13+
14+
These flags help ensure code quality and catch potential security issues at compile time.
15+
16+
## Download Verification
17+
18+
All external dependencies downloaded during the build process are verified using SHA256 hashes:
19+
20+
### Runtime Binaries
21+
22+
The AppImage runtime binaries are downloaded from https://github.com/AppImage/type2-runtime/releases and verified with SHA256 hashes for each architecture:
23+
24+
- `x86_64`: e70ffa9b69b211574d0917adc482dd66f25a0083427b5945783965d55b0b0a8b
25+
- `i686`: 3138b9f0c7a1872cfaf0e32db87229904524bb08922032887b298b22aed16ea8
26+
- `aarch64`: c1b2278cf0f42f5c603ab9a0fe43314ac2cbedf80b79a63eb77d3a79b42600c5
27+
- `armhf`: 6704e63466fa53394eb9326076f6b923177e9eb48840b85acf1c65a07e1fcf2b
28+
29+
The build process prints the hash and size of the downloaded runtime for transparency.
30+
31+
### Build Tools
32+
33+
External build tools are also verified:
34+
35+
- **mksquashfs 4.6.1**: SHA256 hash `9c4974e07c61547dae14af4ed1f358b7d04618ae194e54d6be72ee126f0d2f53`
36+
- **zsyncmake 0.6.2**: SHA256 hash `0b9d53433387aa4f04634a6c63a5efa8203070f2298af72a705f9be3dda65af2` (already verified)
37+
- **desktop-file-validate 0.28**: SHA256 hash `30355df75de31a5c5a2e87fab197fcd77c0a8d1317e86e0dfe515eb0f94f29f8`
38+
39+
## Build Provenance Attestation
40+
41+
The GitHub Actions workflow generates cryptographically signed build provenance attestations using GitHub's attestation service. These attestations:
42+
43+
- Prove that the artifacts were built by the official GitHub Actions workflow
44+
- Include the full build context (commit SHA, workflow, runner environment)
45+
- Can be verified by downstream users using the GitHub CLI or API
46+
47+
To verify an AppImage artifact:
48+
49+
```bash
50+
gh attestation verify appimagetool-x86_64.AppImage --owner AppImage
51+
```
52+
53+
## Sanitizer Support
54+
55+
For development and testing, the build system supports AddressSanitizer (ASAN) and UndefinedBehaviorSanitizer (UBSAN):
56+
57+
```bash
58+
cmake -DENABLE_SANITIZERS=ON /path/to/source
59+
make
60+
```
61+
62+
These sanitizers help detect:
63+
- Memory errors (use-after-free, buffer overflows, memory leaks)
64+
- Undefined behavior (integer overflow, null pointer dereferences, etc.)
65+
66+
Note: Sanitizers cannot be used with static builds and are intended for development/testing only.
67+
68+
## Updating Hashes
69+
70+
When updating dependencies, the hashes must be updated accordingly:
71+
72+
1. Download the new version of the dependency
73+
2. Calculate its SHA256 hash: `sha256sum <file>`
74+
3. Update the hash in the corresponding script in `ci/`
75+
4. Document the change in the commit message
76+
77+
## Supply Chain Considerations
78+
79+
This project takes the following measures to ensure supply chain security:
80+
81+
1. **Pinned Dependencies**: All external dependencies are pinned to specific versions
82+
2. **Hash Verification**: All downloads are verified against known-good SHA256 hashes
83+
3. **Minimal Trust Surface**: Only downloads from official sources (GitHub releases, official package repositories)
84+
4. **Transparency**: All hashes and versions are printed during the build process
85+
5. **Reproducibility**: Static builds ensure consistent behavior across different systems
86+
6. **Build Provenance**: GitHub attestations provide cryptographic proof of build authenticity
87+
88+
## Reporting Security Issues
89+
90+
If you discover a security vulnerability in appimagetool, please report it by opening an issue on GitHub. Please provide as much detail as possible to help us understand and address the issue.

0 commit comments

Comments
 (0)