microsoft / microsoft/winget-pkgs
[New Feature]: Have Pipeline Validate file type matches expected heuristics for filetype
- Dominant language
- No language data
- Stars
- 11.1k
- Forks
- 9.7k
- PR merge metrics
- PR metrics pending
Description
### Description of the new feature/enhancement
While the methods for determining installer type inside manifest creation tools has improved, it is still possible for there to be mistakes when selecting an installer type - especially because it can be manually updated or changed at any point in time.
Since there are some well-known heuristics around determining the installer type, as the validation pipeline improves it would be beneficial to check that the downloaded binary actually matches the expected installer type. If it doesn’t match, a log message indicating the detected type could be useful as a warning but should not block the PR from being merged
### Proposed technical implementation details (optional)
For detection -
* Appx/Msix files already go through specific property validation, no real change needed
* Zip files have specific bytes at the beginning of the file
* MSI should be able to read the MSI database
* Fonts have specific bytes in the header indicatinf the font type
* Portables should have a PE header
* Nullsoft has specific bytes following the PE sections
I forget the exact methods for other types like Inno and Burn, but I know they are documented in code
Contributor guide
Research direction
Start with the manifest creation tools and validation pipeline, then read the existing Appx/Msix property validation and the documented detection methods for Inno and Burn. Map the listed file-type heuristics across installer types; done means mismatches produce a detected-type warning without blocking the PR.
Written by the indexing model from the issue text.
Assessment
- Domain
- testing, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100