microsoft / microsoft/msix-packaging
No multiple signature support
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 1.1k
- Forks
- 193
- Avg merge
- 2h 16m
- Merged PRs (30d)
- 2
Description
I am sorry if this is not the right place to voice this kind of feedback but I it is the closest I could find.
The appx/msix package specification and/or implementation does not support multiple signatures.
This is a bit of a bummer since every other major package manager does (including its predecessor MSI and direct competitor jar/apk). Additionally, what is perhaps even more perplexing is the fact that multiple signatures on PEs on Windows have been supported since Authenticode's introduction. IMHO, the consumer should be free to decide which signature to trust. I would be happy if you could address this feature in the next iteration of appx/msix.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the appx/msix package specification and its implementation to understand how signatures are currently represented and validated. Define the expected behavior for packages containing multiple signatures; the work is done when such packages are supported and the consumer can choose which signature to trust.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100