chocolatey / chocolatey/choco

Question over non-checksum should come up before any downloads occur

Open
#1,096 7 comments 0 reactions 1 assignee Claimed by @ferventcoder View on GitHub
0 - Backlog Enhancement Up For Grabs
Dominant language
C#
Stars
11.5k
Forks
960
PR merge metrics
No merged PRs in 30d

Description

### What You Are Seeing?
Example is with Revo Uninstaller Pro, but any Non-Checksumed package will have Chocolatey do the same thing.
**`Ex:`**
```
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.
C:\>cinst revouninstallerpro -y
Chocolatey v0.10.3
Installing the following packages:
revouninstallerpro
By installing you accept licenses for the packages.

revouninstallerpro v3.1.1.20141201 [Approved] - Possibly broken
revouninstallerpro package files install completed. Performing other installation steps.
```
**`1)`**
```
Downloading revouninstallerpro
from 'http://www.revouninstaller.com/download-professional-version.php'
Progress: 100% - Completed download of C:\Users\Owner\AppData\Local\Temp\chocolatey\revouninstallerpro\3.1.1.20141201\RevoUninProSetup.exe (10.9 MB).
Download of RevoUninProSetup.exe (10.9 MB) completed.
```
**`2)`**
```
WARNING: Missing package checksums are not allowed (by default for HTTP/FTP,
HTTPS when feature 'allowEmptyChecksumsSecure' is disabled) for
safety and security reasons. Although we strongly advise against it,
if you need this functionality, please set the feature
'allowEmptyChecksums' ('choco feature enable -n
allowEmptyChecksums')
or pass in the option '--allow-empty-checksums'. You can also pass
checksums at runtime (recommended). See choco install -? for details.
The integrity of the file 'RevoUninProSetup.exe' from 'http://www.revouninstaller.com/download-professional-version.php' has not been verified by a checksum in the package scripts.
Do you wish to allow the install to continue (not recommended)?
[Y] Yes [N] No (default is "N")
Confirmation (`-y`) is set.
Respond within 30 seconds or the default selection will be chosen.
```

### What is Expected?
The problems are several
**`1)`** Chocolatey downloads the file before asking **`2)`**.
The User should be asked **`2)`** before download is even started.

### How Did You Get This To Happen? (Steps to Reproduce)
Installation of any Non-Checksumed Package
### Output Log
See **`Ex:`** -- Above--

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.