microsoft / winget-cli

WinGet is the Windows Package Manager. This project includes a CLI (Command Line Interface), PowerShell modules, and a COM (Component Object Model) API (Application Programming Interface).
https://learn.microsoft.com/windows/package-manager/
MIT License
22.54k stars 1.39k forks source link

Use digest verification APIs for MSIX when available #4564

Closed JohnMcPMS closed 1 week ago

JohnMcPMS commented 1 week ago

Change

When available (10.0.23504.0 according to MSDN), use the MSIX digest APIs to verify the package during streaming installation. When not available, download instead.

Validation

Manual installation successful, with logs indicating usage of digest. Manual installation with debugger memory change to invalidate the digest results in an error (although not the best error experience, it should also be extremely rare).

Existing regression tests should get some coverage as well.

Microsoft Reviewers: Open in CodeFlow