recognise renamed linux packages for file verify drag and drop
What the developer wrote
Authored by Craig Raw
recognise renamed linux packages for file verify drag and drop
What changed, and why it matters
This commit updates Sparrow Wallet's download verification tool so it recognises additional Linux package filenames when users drag-and-drop files to verify. Previously only names starting with 'sparrow-' or 'sparrow_' were accepted; now 'sparrowwallet-', 'sparrowwallet_', 'sparrowserver-', and 'sparrowserver_' are also accepted. There is no security vulnerability here—it is a straightforward compatibility/usability improvement.
No security action required. Treat as a normal feature/usability fix. Reviewers may optionally confirm the new prefixes correspond to official published package names.
Security signals we found
No cryptographic checks modified
No input parsing of untrusted data beyond existing filename/version regex
No privilege changes or network changes
No dependency or build-system changes
Evidence from the diff
DownloadVerifierDialog.java changes a single alternative release prefix constant into an array of alternative prefixes and updates two checks to stream-match against that array. The logic still requires the file to start with the standard ‘sparrow-’ prefix or one of the new alternative prefixes, contain a version-like number, and meet a minimum file size. The change broadens recognised filenames for the same verification workflow; it does not relax cryptographic verification, signature checking, or manifest validation.
Changed components
src/main/java/com/sparrowwallet/sparrow/control/DownloadVerifierDialog.javaInspect captured patch +4 / −3
diff --git a/src/main/java/com/sparrowwallet/sparrow/control/DownloadVerifierDialog.java b/src/main/java/com/sparrowwallet/sparrow/control/DownloadVerifierDialog.java
index 968375e..c8ae6d4 100644
--- a/src/main/java/com/sparrowwallet/sparrow/control/DownloadVerifierDialog.java
+++ b/src/main/java/com/sparrowwallet/sparrow/control/DownloadVerifierDialog.java
@@ -62,7 +62,7 @@ public class DownloadVerifierDialog extends Dialog<ButtonBar.ButtonData> {
private static final List<String> ARCHIVE_EXTENSIONS = List.of("zip", "tar.gz", "tar.bz2", "tar.xz", "rar", "7z");
private static final String SPARROW_RELEASE_PREFIX = "sparrow-";
- private static final String SPARROW_RELEASE_ALT_PREFIX = "sparrow_";
+ private static final String[] SPARROW_RELEASE_ALT_PREFIXES = { "sparrowwallet-", "sparrowwallet_", "sparrowserver-", "sparrowserver_" };
private static final String SPARROW_MANIFEST_SUFFIX = "-manifest.txt";
private static final String SPARROW_SIGNATURE_SUFFIX = SPARROW_MANIFEST_SUFFIX + ".asc";
private static final Pattern SPARROW_RELEASE_VERSION = Pattern.compile("[0-9]+(\\.[0-9]+)*");
@@ -465,7 +465,7 @@ public class DownloadVerifierDialog extends Dialog<ButtonBar.ButtonData> {
}
String providedName = providedFile.getName().toLowerCase(Locale.ROOT);
- if(providedName.startsWith(SPARROW_RELEASE_PREFIX) || providedName.startsWith(SPARROW_RELEASE_ALT_PREFIX)) {
+ if(providedName.startsWith(SPARROW_RELEASE_PREFIX) || Arrays.stream(SPARROW_RELEASE_ALT_PREFIXES).anyMatch(providedName::startsWith)) {
Matcher matcher = SPARROW_RELEASE_VERSION.matcher(providedFile.getName());
if(matcher.find()) {
String version = matcher.group();
@@ -591,7 +591,8 @@ public class DownloadVerifierDialog extends Dialog<ButtonBar.ButtonData> {
}
}
- if((name.startsWith(SPARROW_RELEASE_PREFIX) || name.startsWith(SPARROW_RELEASE_ALT_PREFIX)) && file.length() >= MIN_VALID_SPARROW_RELEASE_SIZE) {
+ if((name.startsWith(SPARROW_RELEASE_PREFIX) || Arrays.stream(SPARROW_RELEASE_ALT_PREFIXES).anyMatch(name::startsWith))
+ && file.length() >= MIN_VALID_SPARROW_RELEASE_SIZE) {
Matcher matcher = SPARROW_RELEASE_VERSION.matcher(name);
return matcher.find();
}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.