AIR Captive Runtime Application updater security

Question

I create app with captive runtime for Windows and MacOS. To install updates I chose this schema:

1. Main application check for update and download files which are updated:
   • swfs
   • resources
   • air runtime
2. After downloading, main app runs Updater, which:
   • replace application files with downloaded ones (cause app directory is read-only for Main application and I can't update AIR lib in Windows without closing application)
   • restart main application

Updater is NOT-AIR application (for disc space economy).

I see security issue here, cause downloaded files or update link could be replaced by someone.
I check this topic and it clarify some position about updating resources: http://mabulous.com/air-applications-that-can-be-updated-without-requiring-admin-rights In few worlds, for my situation - I should check xml in META-INF with Main application before running Updater. But how to validate air runtime directory?

Answer 1

OK, I've make decision for this time:

1) It's not a problem for macos gatekeeper if you update any files in your .app signed with developer id after first launch

2) Nobody could guarantee that any meta willn't be replaced by somebody

So, there is no reasons to care about it :)