Librum

Original batch evidence · batch-AF1.md, line 18

Repo (Clone Url)

https://github.com/Librum-Reader/Librum.git

Revision

5fdac34 / 2024-07-01

Updater present

Y

Automatic behavior

check:Y (auto on launch) / install:N (user clicks "Update")

Downloads and executes

Y

Transport

https, TLS validation effectively disabled (QSslSocket::QueryPeer instead of default VerifyPeer on a client socket — handshake proceeds even if the cert fails validation)

Manifest authentication

N

Payload verification

none — response bytes written straight to a .zip, no hash/signature check anywhere

Trust root

N/A — no verification performed

Evidence (File:Line)

src/infrastructure/persistance/app_info_access.cpp:70-77 createRequest(): sslConfiguration.setPeerVerifyMode(QSslSocket::QueryPeer) (same weakened config reused across dictionary_access.cpp, authentication_access.cpp, library_storage_access.cpp, etc.); :38-44 downloadBinaries() GETs {domain}/binary/{packageName}.zip; src/application/services/app_info_service.cpp:118-131 processDownloadedBinaryData→saveBinaryDataToFile; :66-84 unpackAndInstallBinaries() shells out to unzip_and_move.bat, which "queries Administrator rights" and overwrites the installed binaries — no integrity check anywhere; trigger: src/presentation/settings/updatesPage/MUpdatesAvailable.qml:103 AppInfoController.updateApplication()