chocolatey / chocolatey/choco

Malformed nupkg causes error to be thrown and Chocolatey to stop

Open
#3,124 3 comments 0 reactions 0 assignees View on GitHub
0 - Backlog Bug
Dominant language
C#
Stars
11.5k
Forks
960
PR merge metrics
No merged PRs in 30d

Description

### Checklist

- [X] I have verified this is the correct repository for opening this issue.
- [X] I have verified no other issues exist related to my problem.
- [X] I have verified this is not an issue for a specific package.
- [X] I have verified this issue is not security related.

### What You Are Seeing?

When Chocolatey CLI encounters a corrupt nupkg package, 2.0.0-alpha-20230124 produces an error message:

![image](https://user-images.githubusercontent.com/12760779/233110907-f2adc724-25ce-4fd4-b491-69671022ae18.png)

Chocolatey CLI 1.2.1 ignored the package and continued, omitting the package from the list returned (so a `choco list -s local` would show all packages in the local source except the malformed one).

The timings are also different for a `choco list -s local`. Chocolatey 2.0.0-alpha-20230124 took 1m 5s to run and 1.2.1 took 32 seconds.

The malformed package is 245MB.

### What is Expected?

That Chocolatey displays a warning and allows the command to continue.

### How Did You Get This To Happen?

See above.

### System Details

* Operating System: Windows 10
* Windows PowerShell version: 5.1 / 7.x
* Chocolatey CLI Version: 2.0.0-alpha+
* Chocolatey Licensed Extension version: The compatible Licensed Extension version.
* Chocolatey License type: Business
* Terminal/Emulator: Windows Terminal

### Installed Packages

```bash
N/A
```

### Output Log

```bash
N/A
```

### Additional Context

None.

Contributor guide

Open the contributing guide

Research direction

No source files or tests are named. Reproduce `choco list -s local` with the malformed 245MB nupkg, then trace the Chocolatey CLI package-listing path and its error handling; done means it warns about the corrupt package, omits it, and continues listing the remaining packages.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.