Package Tombstones

Description of the new feature / enhancement

Sometimes a package is temporarily not available, or the publisher has chosen not to be included in the Windows Package Manager Community App Repository.

A new Tombstone.YAML file would be used to support this behavior.

If the file is in the package directory, it could be used to hold identifiers to help prevent future submission rather than what would likely happen if there was no manifest for the package. It may contain SHA256 values for known versions to help inform users when they try to submit a manifest that the package has been tombstoned and cannot be submitted.

If the file is in a version directory, that version would no longer be available for search, install, or upgrade, but it would still allow users who have the package (as a dependency) so they could still install software that depended on that no longer available version of a package.

If a user were to try to install a package and the specific required version of the dependency had been tombstoned, the user would be informed that the dependency is no longer available.

Proposed technical implementation details

No response

The issue names no files, tests, or entry points. Start by locating package and version directory manifest handling, search/install/upgrade paths, and dependency resolution; done means Tombstone.YAML behavior is defined and covered for submission prevention, hidden versions, dependency installs, and user-facing errors.