electron-updater: Proposal for a universal verifyUpdateCodeSignature interface

I'd be willing to implement this, after decision (and/or changes) by maintainers.

Motivation

When the electron-updater binary gets downloaded to the cache, it is prudent to verify its authenticity before installing it, so as not to rely only on https security. Only Windows NsisUpdater has built-in Get-Authenticode verification (though it does not precisely check publisher identity https://github.com/electron-userland/electron-builder/issues/10009 ). The consuming apps may therefore use their own custom signature verification on top of electron-updater, but currently that is rather difficult to integrate – reliably block the update until an async verification code completes. If I understand correctly, autoUpdater.autoInstallOnAppQuit is the way to do it, like this example:

autoUpdater.on('update-downloaded', async ({ downloadedFile }) => {
    autoUpdater.autoInstallOnAppQuit = false;
    const isValid = await verifySignature(downloadedFile);
    if(!isValid) {
    	fs.unlinkSync(downloadedFile);
    	electronBrowserWindow.getInstance()?.webContents.send('update-aborted');
    	return;
    }
    autoUpdater.autoInstallOnAppQuit = true;
	electronBrowserWindow.getInstance()?.webContents.send('update-ready-to-install');
});

This is AFAIK secure, but it does not seem very robust – relies on assumptions of autoUpdater's internal workings. For example, if the app shuts down during verification, the unverified file stays in place – what happens then? Will it get automatically installed next time?Currently, it doesn't, but it is not clear from the interface. I believe it'd be more robust to do some of this on electron-updater side.

Description

Proposal:

• Create a get/set verifyUpdateCodeSignature interface on all AppUpdater descendants:
  • Such an interface already exists only on NsisUpdater.
  • On all other updaters, the default will be a function immediately resolving with success
• To make it robust, flag the downloaded update binary
  • For example my-app.exe shall download as my-app.exe.UNVERIFIED, to really prevent installing it
  • verifyUpdateCodeSignature shall be called after download:
    • On success, the .UNVERIFIED extension would be removed and update process will continue
    • On failure, the file will be deleted and update aborted with specific error message
• Small side point: I think the NsisUpdater.verifyUpdateCodeSignature return type is a bit unintuitive: null means success, string means an error message. I'd propose refactoring to { success: true } | { success: false, error: string } for clarity, WDYT?
  • This is breaking change though, so it would have to go to 7.0.0

I will be happy to hear your thoughts on this