发布签名文件？
我为我的程序构建了自动更新功能。它会轮询某些 http url 中的 xml，如果有新版本，则会通知用户并下载新文件。
我想允许在没有互联网连接的封闭网络中重新分发这些更新。管理员可以下载所有更新文件并托管在网络中的某个HTTP服务器上。
问题是 xml URL 不一样，所以我想允许在程序的配置文件中更改此 URL。这为恶意软件发布者打开了大门：他们可以使用配置文件中的其他 URL 重新分发我的程序，然后通过我的程序的自动更新系统分发某种形式的恶意软件，然后人们会说我的程序是病毒。
我想阻止更改原始自动更新 xml 的机会，以阻止此类恶意软件分发。我该怎么做？
I built an auto-update feature to my program. It polling an xml in some http url, and in case there is new version is notifies the user and downloading the new files.
I want to allow redistributing of those updates in closed networks without internet connections. The administrators can download all update files and host in some HTTP server in the network.
The problem is that the xml URL will not be the same, so I want to allow change this URL in the program's config file. This is openning the door to malware publishers: they can redistribute my program with other URL in the config file, and then distribute some form of malware through the auto-update system of my program, then the people will say my program is a virus.
I want to block the chance to change the original auto-update xml to block this kind of malware distribution. How do I do that?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我想我理解你的问题。但这个问题不是你能解决的。用户应该只从可信来源下载您的应用程序。您无法阻止用户下载恶意软件，如果他们这样做，那就是他们的问题。此外，用户将向配置文件添加/更改 URL，并且您无法阻止他们向配置文件添加恶意 URL。即使您在应用程序中硬编码了原始更新 URL，恶意用户也很容易更改它并重新编译您的应用程序并分发它。或者您可以使用加密技术来确保原始 URL 不变。
I think I understood your problem. But this problem is not yours to handle. The users should only download your application from a trusted source. You cannot stop a user from downloading malware, its their problem if they do so. Also, it is the users that will add/change a URL to the config file and you cannot stop them from adding a malicious URL to the config file. And even if you have the original update URL hard coded in your application, it wouldn't be hard for a user with malicious intent to change it and recompile your application and distribute it. Or else you can use cryptography to ensure that the original URL is unchanged.