microsoft / microsoft/winget-pkgs
Publish warning during validation for non timestamped MSIX packages
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 11.1k
- Forks
- 9.7k
- Avg merge
- 1h 32m
- Merged PRs (30d)
- 376
Description
Description of the new feature/enhancement
Per @jaifroid
I've been doing some research, and timestamping AppxBundle is not easy. Guess what, SignTool doesn't support doing so! Fiendishly complicated blog post about it here: https://blog.jayway.com/2017/01/16/time-stamping-appx-packages/
Proposed technical implementation details (optional)
If possible, instrument the validation pipeline to provide a warning when MSIX packages have not been timestamp signed. This will help notify publishers when their applications aren't timestamp signed.
Periodic validation should also be instrumented for this check so Issues can be created for existing packages that have not been timestamp signed. These packages should be removed if the certificate has expired and they are not timestamp signed.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the validation pipeline and periodic validation process in the winget-pkgs repository. Determine how package signing and certificate expiry are currently checked; done means non-timestamped MSIX packages produce validation warnings and periodic validation can create Issues or remove expired, unsigned packages.
Written by the indexing model from the issue text.
Assessment
- Domain
- release, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100