microsoft / microsoft/winget-cli

Browsers test or canary versions have always hash problem

Open
#4,048 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Issue-Feature
Dominant language
C++
Stars
26.4k
Forks
1.8k
Avg merge
1d 11h
Merged PRs (30d)
15

Description

Description of the new feature / enhancement

We know that package managers, such as winget and chocolatey, have a problem when a user tries to install beta or canary versions of web browsers through them. This is due to the security feature of package managers, where it compares hash numbers. However, the problem is that the latest experimental versions of browsers updates so often that their hash doesn’t seem to ever update in time, and thus the installation cannot be performed.

Could it be possible that certain parties, such as the test versions of major browsers, could be whitelisted from this check? I understand that this idea may be shot down simply because winget would be filled with requests to get some application whitelisted. However, this feature does not need to be open, i.e., only a few parties would get this right by default, such as Edge canary, Chrome canary, Firefox nightly, Brave, Vivaldi, and Opera. So initially, this would only be possible for these largest ones by default.

Fewer people even install Canary versions, so this whitelisting would probably not be as big a problem as many people initially imagine it to be.

Any thoughts?

Proposed technical implementation details

"Installer hash does not match; this cannot be overridden when running as admin"

Perhaps it can just install the thing :)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names no files, tests, or entry points. Start by locating the CLI's installer hash-verification path and reviewing how browser test or canary packages are represented; the work would need an agreed whitelist policy and clear rules for when an installation may bypass the existing check.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
cli, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.