microsoft / microsoft/winget-pkgs
Pipelines don't validate RelativeFilePaths
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 11.1k
- Forks
- 9.7k
- Avg merge
- 1h 32m
- Merged PRs (30d)
- 376
Description
Description
Take a look at https://github.com/microsoft/winget-pkgs/commit/40c9b07acb35cc283af1eb0a8a11597e99304e4e (The original PR https://github.com/microsoft/winget-pkgs/pull/115441/ had been rebased but this URL to its original state still works). In this commit, the InstallerUrls for WiX and Portable InstallerType are incorrect which means that their respective RelativeFilePath written in the manifest does not exist in the downloaded zip archive.
Expected Behavior
Validation pipelines should check if the RelativeFilePath exists in the downloaded archive. The commit/manifest should not have passed the validation checks.
Actual Behavior
The commit/manifest passed through the validation checks.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting the validation pipeline behavior against commit 40c9b07acb35cc283af1eb0a8a11597e99304e4e and its original pull request 115441. Trace how WiX and Portable manifests handle InstallerUrls and RelativeFilePath values, then reproduce the case with the downloaded archive. Done means validation rejects a manifest when its RelativeFilePath is absent from the archive.
Written by the indexing model from the issue text.
Assessment
- Domain
- ci-cd
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100