microsoft / microsoft/winget-pkgs
[New Feature]: Stop scanning for "Targeted Brand", which has a false positive rate of 100%.
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 11.1k
- Forks
- 9.7k
- Avg merge
- 1h 32m
- Merged PRs (30d)
- 616
Description
### Description of the new feature/enhancement
Whether or not the reasoning behind scanning for it is for security or not, the way it is being scanned for doesn't make much sense to me.
Even if most of the involved brands have horrid reputations, it is not a good idea to flag all manifests that even just *mention* the words McAfee, Norton, and ESET. It just isn't.
Affected PRs include, but are not necessarily limited to:
* #384431.
* #399096.
* #401142.
* #401175.
### Proposed technical implementation details (optional)
Make the pipelines no longer scan for "Targeted Brand".
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the repository pipelines that scan manifests for the "Targeted Brand" rule, then compare their behavior with affected PRs #384431, #399096, #401142, and #401175. The work is done when those pipelines no longer flag manifests merely mentioning McAfee, Norton, or ESET and the affected cases no longer produce false positives.
Written by the indexing model from the issue text.
Assessment
- Domain
- ci-cd
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100