You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
For the portable installer type, the winget-pkgs repository has a policy of not allowing scripts as installers. This includes .bat, .ps1, and .cmd files.
In addition to the policy at winget-pkgs, the client itself is not designed to handle portable files that are not .exe types. Issues have been filed asking for WinGet to support these in the future, but it currently does not -
This PR adds a validation option which validates the RelativeFilePath within a zip file is always a .exe, but can be extended to include additional formats as the requests above are addressed. This was added as a validation option (similar to the Schema Header Validation) as private repositories may want to not have the file type restrictions that winget-pkgs does - as described in these issues -
This should allow for the validation pipeline at winget-pkgs to automatically reject manifests that contain NestedInstallerFiles that are not supported, while allowing maintainers of private repositories to suppress the restriction by turning the validation option to false.
Basically same comment as the other pr, I think fullValidation should just work instead of a new ValidateOption. (Just to be clear, any new ValidateOption require a winget service side code change to enable the option).
Regarding warning vs error, if there's no existing manifests that violate this rule, error seems ok. Otherwise, maybe use warning to prevent unexpected failures in winget service.
Basically same comment as the other pr, I think fullValidation should just work instead of a new ValidateOption. (Just to be clear, any new ValidateOption require a winget service side code change to enable the option). Regarding warning vs error, if there's no existing manifests that violate this rule, error seems ok. Otherwise, maybe use warning to prevent unexpected failures in winget service.
Wouldn't ValidateOption be required in order for private repositories to be able to disable the validation of this, similar to how the schema header validation is?
I'll do a run through of winget-pkgs locally using the dev build and verify that there are no manifests that would be impacted by this being an error
Basically same comment as the other pr, I think fullValidation should just work instead of a new ValidateOption. (Just to be clear, any new ValidateOption require a winget service side code change to enable the option). Regarding warning vs error, if there's no existing manifests that violate this rule, error seems ok. Otherwise, maybe use warning to prevent unexpected failures in winget service.
Wouldn't ValidateOption be required in order for private repositories to be able to disable the validation of this, similar to how the schema header validation is?
I'll do a run through of winget-pkgs locally using the dev build and verify that there are no manifests that would be impacted by this being an error
For all manifest read operations, fullValidation is false. So private repositories should be fine. ValidateOptions is for granular control of winget service to choose which validation are performed during different steps. Currently I don't see a need to have a special switch just for this specific validation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
For the
portableinstaller type, thewinget-pkgsrepository has a policy of not allowing scripts as installers. This includes.bat,.ps1, and.cmdfiles.In addition to the policy at
winget-pkgs, the client itself is not designed to handle portable files that are not.exetypes. Issues have been filed asking for WinGet to support these in the future, but it currently does not -This PR adds a validation option which validates the
RelativeFilePathwithin a zip file is always a.exe, but can be extended to include additional formats as the requests above are addressed. This was added as a validation option (similar to the Schema Header Validation) as private repositories may want to not have the file type restrictions thatwinget-pkgsdoes - as described in these issues -This should allow for the validation pipeline at
winget-pkgsto automatically reject manifests that containNestedInstallerFilesthat are not supported, while allowing maintainers of private repositories to suppress the restriction by turning the validation option to false.Microsoft Reviewers: Open in CodeFlow