VCLib URLs are going to expire, breaking WinGet items

[mdanish-kh]

Summary

VCLibs is a dependency for AppInstaller as well as some packages in the community repository.

From official download page:

The following package download links are now deprecated, and may no longer work in the future. Make sure to use the method described above to obtain the framework packages.

What's going to break?

Items that I'm aware of:

• Repair-WinGetPackageManager cmdlet, and other parts of codebase that use the download URLs Resolved by https://github.com/microsoft/winget-cli/pull/4923
• Packages in community repo that take VCLibs as dependency. At the time of writing, these are currently 3 PackgeIdentifiers. Telegram.Unigram, TheBrowserCompany.Arc, CharlesMilette.TranslucentTB
• Sandbox bootstrapping script at MSFT Learn Resolved by https://github.com/MicrosoftDocs/windows-dev-docs/pull/5178
• Sandbox manifest PR test script at winget-pkgs Resolved by https://github.com/microsoft/winget-pkgs/pull/188570

Options?

For WinGet packages, since AppInstaller itself depends on VCLibs, if a user already has winget installed, they should be able to install package without any issue 🤷? Testing it in https://github.com/microsoft/winget-pkgs/pull/170793, https://github.com/microsoft/winget-pkgs/pull/170781, https://github.com/microsoft/winget-pkgs/pull/170721 (one passed validation)

[denelon]

We're working on an alternate publishing mechanism for the Desktop Framework package with unique durable URLs per version.