microsoft / microsoft/winget-cli

Manifest validation succeeds when NestedInstaller(Type | Files) is used for non-zip packages

Open
#4,633 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Command-Validate In-PR Issue-Bug
Dominant language
C++
Stars
26.4k
Forks
1.8k
Avg merge
1d 11h
Merged PRs (30d)
15

Description

Brief description of your issue

Seen in microsoft/winget-pkgs@5694bd8 (#162833). The manifest specifies NestedInstallerType and NestedInstallerFiles when InstallerType is not zip. Package validation succeeds without any warnings. Although it doesn't have an effect in either the uninstall or install flow for the package in mentioned PR, this doesn't seem to be the semantic / appropriate way of writing out the manifest file. May have unintended consequences elsewhere but I couldn't find a significant issue with it yet

Steps to reproduce

Add following in any installer manifest

InstallerType: (msi|exe|portable|inno...any non-zip)
NestedInstallerType: (msi|exe|portable...)
NestedInstallerFIles:
- RelativeFilePath: <any_path>
  PortableCommandAlias: <any_alias>
- RelativeFilePath: <any_path2>
  PortableCommandAlias: <any_alias2>
...

Run winget validate --manifest <path_to_manifest>

Expected behavior

Manifest validation fails

Actual behavior

Manifest validation succeeds with no warnings

Environment
Windows Package Manager v1.8.1911
Copyright (c) Microsoft Corporation. All rights reserved.

Windows: Windows.Desktop v10.0.22631.3880
System Architecture: X64
Package: Microsoft.DesktopAppInstaller v1.23.1911.0

Winget Directories
-----------------------------------------------------------------------------------------------------------------------
Logs                               %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\Diag…
User Settings                      %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\sett…
Portable Links Directory (User)    %LOCALAPPDATA%\Microsoft\WinGet\Links
Portable Links Directory (Machine) C:\Program Files\WinGet\Links
Portable Package Root (User)       %LOCALAPPDATA%\Microsoft\WinGet\Packages
Portable Package Root              C:\Program Files\WinGet\Packages
Portable Package Root (x86)        C:\Program Files (x86)\WinGet\Packages
Installer Downloads                %USERPROFILE%\Downloads

Links
---------------------------------------------------------------------------
Privacy Statement   https://aka.ms/winget-privacy
License Agreement   https://aka.ms/winget-license
Third Party Notices https://aka.ms/winget-3rdPartyNotice
Homepage            https://aka.ms/winget
Windows Store Terms https://www.microsoft.com/en-us/storedocs/terms-of-sale

Admin Setting                             State
--------------------------------------------------
LocalManifestFiles                        Enabled
BypassCertificatePinningForMicrosoftStore Disabled
InstallerHashOverride                     Enabled
LocalArchiveMalwareScanOverride           Disabled
ProxyCommandLineOptions                   Disabled
DefaultProxy                              Disabled

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the winget validate --manifest command path and trace how NestedInstallerType and NestedInstallerFiles are checked against InstallerType. Reproduce the issue with a non-zip manifest, then verify that validation rejects it while valid zip manifests continue to pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.