microsoft / microsoft/winget-cli

Default source certificate updates shouldn't require an update to the WinGet Client

Open
#6,030 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Issue-Feature
Dominant language
C++
Stars
26.4k
Forks
1.8k
Avg merge
1d 11h
Merged PRs (30d)
15

Description

Relevant area(s)

WinGet CLI

Description of the new feature / enhancement

The Microsoft Store "msstore" source in WinGet leverages certificate pinning to avoid MITM (Man In The Middle) types of attack vectors. The certificate information is currently "hard coded" in the WinGet client. This leads to non-functioning clients on earlier releases of Windows (before the client is updated).

There should be a different mechanism to enable WinGet to safely and securely receive updated certificate information so in the future, earlier clients (with support for this) can function and install packages from the "msstore" (or any other default source in the future) source.

Proposed technical implementation details

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the WinGet CLI's msstore source certificate-pinning path and trace where its certificate information is currently handled. Define a secure update mechanism that can serve earlier supported clients without requiring a WinGet Client update, and verify that those clients can install packages from the msstore source.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
cli, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.