Summary

LocalExtensionInstaller.installFromArchive() verifies SHA256 only when expectedSha256 is passed. UI sideload of .zip / .qext can install an unverified archive.

This is expected for power users importing local files, but there is no prominent warning and no optional “paste expected SHA256” flow for cautious installs.

Affected code

• lib/core/extensions/local_extension_installer.dart (lines 47–56)
• Extension Manager sideload UI (if applicable)

Proposed fix

Choose approach:

1. UI: show security notice on sideload; optional SHA256 field before install.
2. Strict mode: settings toggle “require checksum for sideload”.
3. Documentation: document risk in user guide / extension docs.

Marketplace path should remain stricter (#396); sideload may stay optional with better UX.

Acceptance criteria

• User understands sideload is unverified unless checksum provided.
• Optional SHA256 field or documented workflow.
• Tests: checksum mismatch aborts; missing checksum behavior documented.

Severity

Low — user explicitly chooses local file; social engineering / mistaken file risk.

Related

• enhancement(settings): allow manual install of extensions from local .zip/.qext files #316 (local sideload feature)
• security(marketplace): require SHA256 checksum before HttpMarketplace install #396 (marketplace mandatory checksum)
• Security review 0.4.11