microsoft / microsoft/msix-packaging

No multiple signature support

Open
#329 0 comments 5 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Area-External Area-MSIX Feature
Dominant language
C
Stars
1.1k
Forks
193
Avg merge
2h 16m
Merged PRs (30d)
2

Description

I am sorry if this is not the right place to voice this kind of feedback but I it is the closest I could find.

The appx/msix package specification and/or implementation does not support multiple signatures.

This is a bit of a bummer since every other major package manager does (including its predecessor MSI and direct competitor jar/apk). Additionally, what is perhaps even more perplexing is the fact that multiple signatures on PEs on Windows have been supported since Authenticode's introduction. IMHO, the consumer should be free to decide which signature to trust. I would be happy if you could address this feature in the next iteration of appx/msix.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the appx/msix package specification and its implementation to understand how signatures are currently represented and validated. Define the expected behavior for packages containing multiple signatures; the work is done when such packages are supported and the consumer can choose which signature to trust.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.