microsoft / microsoft/winget-cli
Default source certificate updates shouldn't require an update to the WinGet Client
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 26.4k
- Forks
- 1.8k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 15
Description
Relevant area(s)
WinGet CLI
Description of the new feature / enhancement
The Microsoft Store "msstore" source in WinGet leverages certificate pinning to avoid MITM (Man In The Middle) types of attack vectors. The certificate information is currently "hard coded" in the WinGet client. This leads to non-functioning clients on earlier releases of Windows (before the client is updated).
There should be a different mechanism to enable WinGet to safely and securely receive updated certificate information so in the future, earlier clients (with support for this) can function and install packages from the "msstore" (or any other default source in the future) source.
Proposed technical implementation details
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the WinGet CLI's msstore source certificate-pinning path and trace where its certificate information is currently handled. Define a secure update mechanism that can serve earlier supported clients without requiring a WinGet Client update, and verify that those clients can install packages from the msstore source.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100