microsoft / microsoft/winget-pkgs

[New Feature]: Stop scanning for "Targeted Brand", which has a false positive rate of 100%.

Open
#404,478 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Issue-Feature Needs-Triage
Dominant language
No language data
Stars
11.1k
Forks
9.7k
Avg merge
1h 32m
Merged PRs (30d)
616

Description

### Description of the new feature/enhancement

Whether or not the reasoning behind scanning for it is for security or not, the way it is being scanned for doesn't make much sense to me.

Even if most of the involved brands have horrid reputations, it is not a good idea to flag all manifests that even just *mention* the words McAfee, Norton, and ESET. It just isn't.

Affected PRs include, but are not necessarily limited to:
* #384431.
* #399096.
* #401142.
* #401175.

### Proposed technical implementation details (optional)

Make the pipelines no longer scan for "Targeted Brand".

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the repository pipelines that scan manifests for the "Targeted Brand" rule, then compare their behavior with affected PRs #384431, #399096, #401142, and #401175. The work is done when those pipelines no longer flag manifests merely mentioning McAfee, Norton, or ESET and the affected cases no longer produce false positives.

Written by the indexing model from the issue text.

Assessment

Domain
ci-cd
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.