Signing of winget binary for high security environment

Description of the new feature / enhancement

For WDAC hardened devices, winget can't be trusted as a managed installer. This means that the vast majority of functionality for deploying software and updates are useless due to the manual whitelisting overhead. Note that each of the following failures are also specific to every version and every application, making this not a scalable solution.

• The winget binary
• The installer exe / msi
• The files created during the installation process
• The final installed binaries to be used once the install / upgrade is complete.

For example, the following error when I attempt to install Wireshark. This corresponds to device guard / wdac blocking the installation.

Proof that winget exe is not digitally signed:

Without the signing, it is impossible to safely define as a managed installer. I have used the managed installer definitions here to trust a number of tools, including SCCM, the MEM endpoint manager, as well as third party utilities used within my organization.

The development of a policy usable to trust winget is documented, but is not currently viable, until signing is complete.

Proposed technical implementation details

At a minimum, the release process in the future should include signing the output binaries and any supporting DLL or script files.

There should also be a set of suggested policies to restrict what sources are trusted, etc along with a pre existing managed installer template specific to winget.

Start by reviewing the issue's linked WDAC managed-installer documentation and the repository's release process. The requested outcome is signed winget binaries and supporting files, plus suggested source-restriction policies and a winget-specific managed-installer template.