From b736472b5593d77d70251a13e6aa6b23bb8fcb67 Mon Sep 17 00:00:00 2001
From: Comely <thisisbaby@outlook.com>
Date: Sun, 12 Jul 2026 18:44:11 -0700
Subject: [PATCH] fix(integrity): exclude installer-managed metadata

---
 Common/RuntimeProtectionPolicy.h | 20 +++++++++++++++++---
 Updater/UpdaterLogic.cpp         | 14 +++-----------
 2 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/Common/RuntimeProtectionPolicy.h b/Common/RuntimeProtectionPolicy.h
index cfec0a3..59bc3c5 100644
--- a/Common/RuntimeProtectionPolicy.h
+++ b/Common/RuntimeProtectionPolicy.h
@@ -11,7 +11,21 @@ inline bool isRuntimeProtectedPath(const QString& path,
 {
     const QString normalizedPath =
         QDir::cleanPath(QDir::fromNativeSeparators(path)).toCaseFolded();
-    static const QSet<QString> protectedPaths{
+    static const QSet<QString> installerManagedRootFiles{
+        QStringLiteral("components.xml"),
+        QStringLiteral("installationlog.txt"),
+        QStringLiteral("installer.dat"),
+        QStringLiteral("maintenancetool.dat"),
+        QStringLiteral("maintenancetool.exe"),
+        QStringLiteral("maintenancetool.ini"),
+        QStringLiteral("network.xml")
+    };
+    if (installerManagedRootFiles.contains(normalizedPath)
+        || normalizedPath.startsWith(QStringLiteral("installerresources/"))
+        || normalizedPath.startsWith(QStringLiteral("licenses/")))
+        return true;
+
+    static const QSet<QString> runtimeProtectedPaths{
         QStringLiteral("bootstrap.exe"),
         QStringLiteral("client.ini"),
         QStringLiteral("config/app_config.json"),
@@ -19,7 +33,7 @@ inline bool isRuntimeProtectedPath(const QString& path,
         QStringLiteral("config/client_identity.dat"),
         QStringLiteral("config/version_policy.dat")
     };
-    if (protectedPaths.contains(normalizedPath))
+    if (runtimeProtectedPaths.contains(normalizedPath))
         return true;
 
     QString runtimePrefix = QDir::cleanPath(
@@ -29,7 +43,7 @@ inline bool isRuntimeProtectedPath(const QString& path,
     while (runtimePrefix.startsWith(QStringLiteral("./")))
         runtimePrefix.remove(0, 2);
 
-    for (const QString& protectedPath : protectedPaths) {
+    for (const QString& protectedPath : runtimeProtectedPaths) {
         if (normalizedPath == runtimePrefix + QLatin1Char('/') + protectedPath)
             return true;
     }
diff --git a/Updater/UpdaterLogic.cpp b/Updater/UpdaterLogic.cpp
index 13cbf46..8c1646d 100644
--- a/Updater/UpdaterLogic.cpp
+++ b/Updater/UpdaterLogic.cpp
@@ -430,22 +430,13 @@ QStringList UpdaterLogic::obsoleteFilesComparedTo(const QJsonObject& oldManifest
     }
 
     QSet<QString> protectedPaths{
-        QStringLiteral("bootstrap.exe"),
         QStringLiteral("launcher.exe"),
-        QStringLiteral("updater.exe"),
-        QStringLiteral("client.ini"),
-        QStringLiteral("config/app_config.json"),
-        QStringLiteral("config/local_state.json"),
-        QStringLiteral("config/client_identity.dat"),
-        QStringLiteral("config/version_policy.dat")
+        QStringLiteral("updater.exe")
     };
     const QString runtimePrefix = ConfigHelper::instance().runtimeRelativePath().toCaseFolded();
     if (!runtimePrefix.isEmpty()) {
         const QStringList runtimeProtected{
-            QStringLiteral("bootstrap.exe"), QStringLiteral("launcher.exe"), QStringLiteral("updater.exe"),
-            QStringLiteral("client.ini"), QStringLiteral("config/app_config.json"),
-            QStringLiteral("config/local_state.json"), QStringLiteral("config/client_identity.dat"),
-            QStringLiteral("config/version_policy.dat")
+            QStringLiteral("launcher.exe"), QStringLiteral("updater.exe")
         };
         for (const QString& path : runtimeProtected)
             protectedPaths.insert(runtimePrefix + "/" + path);
@@ -456,6 +447,7 @@ QStringList UpdaterLogic::obsoleteFilesComparedTo(const QJsonObject& oldManifest
         const QString path = QDir::fromNativeSeparators(value.toObject().value("path").toString());
         const QString folded = path.toCaseFolded();
         if (!isSafeRelativePath(path) || protectedPaths.contains(folded)
+            || isRuntimeProtectedPath(path)
             || newPaths.contains(folded) || seen.contains(folded))
             continue;
         seen.insert(folded);