Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Restrict access to manifests for packages #100

Closed
denelon opened this issue May 12, 2020 · 9 comments
Closed

Restrict access to manifests for packages #100

denelon opened this issue May 12, 2020 · 9 comments
Assignees
@zachcarp
Labels
Area-Validation-Pipeline Issues related to the manifest validation pipeline. Issue-Feature Complex enough to require an in depth planning process and actual budgeted, scheduled work.
Milestone
v1.1-Packages

Comments

@denelon
Copy link
Contributor

denelon commented May 12, 2020

Some software vendors will want to manage releases for manifests of their software.
@denelon denelon added the Issue-Feature Complex enough to require an in depth planning process and actual budgeted, scheduled work. label May 12, 2020
@denelon denelon changed the title Restrict access to manifests for commercially owned packages Restrict access to manifests for packages Jun 2, 2020
@denelon
Copy link
Contributor Author

denelon commented Jun 2, 2020

Some OSS producers also wish to manage releases for manifests and installers for their software.

@denelon denelon added this to the Packages Backlog milestone Jun 3, 2020
@denelon
Copy link
Contributor Author

denelon commented Jan 6, 2021

https://gist.github.com/denelon/0285ade55410f118b92d03e883a24c5e

@denelon denelon modified the milestones: Packages Backlog, Packages v0.6.x Jan 6, 2021
@denelon denelon added the Area-Validation-Pipeline Issues related to the manifest validation pipeline. label Jan 6, 2021
@ghost ghost added the No-Recent-Activity No activity has occurred on this work item for seven days. label Jan 13, 2021
@ghost

This comment has been minimized.

Sign in to view
@KevinLaMS KevinLaMS removed the No-Recent-Activity No activity has occurred on this work item for seven days. label Jan 26, 2021
@denelon denelon mentioned this issue Feb 22, 2021
Open
@jedieaston jedieaston mentioned this issue Mar 12, 2021
Closed
4 tasks
@zachcarp zachcarp assigned zachcarp and unassigned hackean-msft Apr 27, 2021
@denelon denelon modified the milestones: Packages v0.6.x, v.Next - Packages, v1.0 - Packages May 21, 2021
@ocdtrekkie
Copy link

Why was WinGet 1.0 released/announced without completing this incredibly security-critical goal?

@KaranKad KaranKad mentioned this issue Jun 4, 2021
Closed
@denelon denelon mentioned this issue Jun 4, 2021
Closed
5 tasks
@rjmholt rjmholt mentioned this issue Jul 27, 2021
Closed
@denelon denelon mentioned this issue Aug 6, 2021
Open
@denelon denelon mentioned this issue Aug 20, 2021
Closed
@jedieaston jedieaston mentioned this issue Sep 7, 2021
Open
@denelon
Copy link
Contributor Author

denelon commented Sep 16, 2021

The technical implementation for this feature is complete. We are now working on the business process for identifying verified developers. The implementation is similar to the waivers for validation stored in a .version file. The ownership metadata will be recorded in a .package file.

@denelon denelon closed this as completed Sep 16, 2021
This was referenced Sep 17, 2021
Closed
Open
Closed
seejdev pushed a commit to seejdev/winget-pkgs that referenced this issue Nov 4, 2021
@JohnMcPMS
Change to download the source file first (microsoft#100)
dd38bbc 
## Change
Due to issues we are seeing with deploying directly from the URL, this change moves the client to download the msix file first, and deploy it from a local file.  This is intended to be a temporary measure until we can investigate the direct deployment issue further, but it may need to become permanent depending on the result of the investigation.

## Testing
Manually validated that the change works against the production environment with source add and automatic update.
@Trenly Trenly mentioned this issue Feb 4, 2022
Open
@slonopotamus
Copy link
Contributor

The technical implementation for this feature is complete.

After re-reading this whole issue six times, I still fail to understand how this feature was implemented and how to use it. Could you please give a link to some docs or whatever?

@denelon
Copy link
Contributor Author

denelon commented Mar 21, 2022

We are still working on the business process for this feature. Once that has been completed, the technical implementation here will be further documented.

The simple overview of the technical implementation is we will have a file in the directory (either publisher, or package) identifying the verified developers GitHub alias. When a PR is submitted by anyone other than the verified developer, they will be informed. If the verified developer submits a PR, the validation will continue down the normal process.

@ocdtrekkie
Copy link

I'm still deeply concerned this thing is actually on real Windows PCs that actual people use prior to this being implemented.

@denelon denelon mentioned this issue Nov 21, 2022
Open
@russellbanks
Copy link
Contributor

Just a thought, what about scenarios like LF/CRLF line ending enforcement? We would need to ensure that the pull request pipeline fails if line endings are incorrect first, as we wouldn't be able to normalise the manifest at a later stage if we are restricted in changing the manifest for the package.

@mdanish-kh mdanish-kh mentioned this issue Mar 1, 2023
Closed
2 tasks
@mdanish-kh mdanish-kh mentioned this issue Apr 5, 2023
Closed
@mdanish-kh mdanish-kh mentioned this issue Aug 23, 2023
Merged
6 tasks
@ThioJoe ThioJoe mentioned this issue Aug 30, 2023
Open
@mdanish-kh mdanish-kh mentioned this issue Nov 2, 2023
Merged
6 tasks
@mdanish-kh mdanish-kh mentioned this issue Jan 4, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@zachcarp zachcarp

Labels
Area-Validation-Pipeline Issues related to the manifest validation pipeline. Issue-Feature Complex enough to require an in depth planning process and actual budgeted, scheduled work.
Projects
None yet
Milestone
v1.1-Packages
Development

No branches or pull requests
7 participants
@slonopotamus @KevinLaMS @ocdtrekkie @zachcarp @hackean-msft @denelon @russellbanks