Question about threat model about winget-pkgs HOT 8 CLOSED

Great! However, as this blog post candidly outlines, Smart Screen will effectively block any and all independent publishers from utilizing WinGet. Yes, even if they get their code signed, at personal expense.

https://getimageview.net/2020/06/02/microsoft-defender-smartscreen-is-hurting-independent-developers/

I don't think it's reasonable by any stretch that WinGet will effectively completely block a majority of smaller/independent developers from utilizing it as a platform to deploy their software.

Looking at other package managers, even on Linux, this is a pretty unusual stance to take and severely limits potential contributors both to the packages repository as well as (I would imagine, though yes, I am only speculating) the WinGet application itself.

from winget-pkgs.

As part of the validation, the installers are checked with SmartScreen.

from winget-pkgs.

@vexx32 I agree. Especially since third parties will be hosting the binaries and they can potentially be compromised for any version of the manifest.

from winget-pkgs.

Yeah, I'm pretty concerned that all the documentation and responses I've seen indicate that the WinGet team seem to think that validating a manifest ensures that a package can be trusted.

A manifest is metadata. Metadata isn't what causes security breaches in the vast, vast majority of cases.

A serious, concerted effort to validate that malicious code isn't somehow snuck into one of the packages with a valid manifest needs to be made. Virus scanning should be a must-have.

from winget-pkgs.

I agree. Especially since third parties will be hosting the binaries and they can potentially be compromised for any version of the manifest.

This would only be an issue if they are compromised before being added without being noticed though, as the sha256 checksum is recorded in the manifest.

Compromised files should be noticed by humans, but SmartScreen should be a good defense against those than fall through the cracks.

from winget-pkgs.

In addition to SmartScreen, we are performing static analysis of the binary for malware and additional validation steps as we work towards update and uninstall capabilities. One of our next activities will be open sourcing the validation pipeline to help bring additional transparency and trust behind the community repository. Some of what we are doing is covered in the blog post.

https://devblogs.microsoft.com/commandline/windows-package-manager-preview/

from winget-pkgs.

@DustinKingen should this be taken as a confirmation that tools written by independent developers are simply not at all supported/in scope for WinGet?

from winget-pkgs.

@vexx32 I closed this issue since it’s two months old.

I’m not a WinGet maintainer so I won’t be able to address your question.

from winget-pkgs.