microsoft / winget-pkgs

The Microsoft community Windows Package Manager manifest repository
MIT License
8.51k stars 4.4k forks source link

[Package Issue]: Microsoft.PCManager #94127

Closed Silther closed 1 year ago

Silther commented 1 year ago

Please confirm these before moving forward

Category of the issue

Other

Brief description of your issue

I came across the following package (Microsoft.PCManager), but the download URL (https://pcmanager.officeplus.cn/mvp/10000/26026/MSPCManagerSetup.exe ...) seems to be anything but official.

Steps to reproduce

search for the PC Manager package

Actual behavior

should show legit URL (https://pcmanager-en.microsoft.com/)

Expected behavior

shows an untrustworthy URL (https://pcmanager.officeplus.cn/mvp/10000/26026/MSPCManagerSetup.exe?sv=2021-06-08&se=2023-06-26T02%3A10%3A43Z&sr=c&sp=rwdl&sig=pDOh8oxm8ifT6anw8tZJNZhQ0WAXW279Le%2BA3rMFM6w%3D)

Environment

Windows Package Manager v1.3.2691
Copyright (c) Microsoft Corporation. All rights reserved.

Windows: Windows.Desktop v10.0.22621.1105
System Architecture: X64
Package: Microsoft.DesktopAppInstaller v1.18.2691.0

Logs: %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir

Screenshots and Logs

PS C:\Users\USER> winget show Microsoft.PCManager Found Microsoft PC Manager(Beta) [Microsoft.PCManager] Version: 1.2.6.4 Publisher: Microsoft Corporation Publisher Url: https://www.microsoft.com/ Publisher Support Url: https://support.microsoft.com/ Author: Microsoft Corporation Description: Microsoft PC manager, a good way to protect your personal computer and optimize performance, provides PC cleanup, antivirus and Windows update, making your computer safe and secure! Homepage: https://pcmanager-en.microsoft.com License: Freeware Privacy Url: https://privacy.microsoft.com/en-us/privacystatement Copyright: Copyright (c) Microsoft Corporation Copyright Url: https://www.microsoft.com/en-us/legal/intellectualproperty/trademarks Installer: Type: nullsoft Download Url: https://pcmanager.officeplus.cn/mvp/10000/26026/MSPCManagerSetup.exe?sv=2021-06-08&se=2023-06-26T02%3A10%3A43Z&sr=c&sp=rwdl&sig=pDOh8oxm8ifT6anw8tZJNZhQ0WAXW279Le%2BA3rMFM6w%3D SHA256: 12b4cb9589255f51daa31be099e9a70cd7de59e0e8931bf2510374fc49bada69 Release Date: 2022-12-28

denelon commented 1 year ago

https://github.com/microsoft/winget-pkgs/pull/87480#issuecomment-1303087253

This was identified as an acceptable URL based on the "aka.ms" URL provided in the PR:

A waiver was granted for that URL.

Silther commented 1 year ago

What exactly does that mean? The URL is not one from microsoft itself, is it?

denelon commented 1 year ago

@SpecterShell,

Can you share how you got to the URL for this package?

Silther commented 1 year ago

https://aka.ms/PCManager500000 Just wondering, why this link wasn't used, but I don't really know how Winget packages work

denelon commented 1 year ago

Generally, we prefer using URLs coming from the "official" site. In some cases, they are redirects, but we understand in many cases the underlying URL may change due to CDN modifications or other changes intentionally performed by ISVs.

SpecterShell commented 1 year ago

The URLs prior to 1.2.6.4 came from https://aka.ms/PCManagerUpgrade10000, which is obtained from their API (https://pcmanager.microsoft.com/config/api/AppConfig). The URLs after that should came from https://aka.ms/PCManager10000, which can be found in https://pcmanager.microsoft.com/en.

Silther commented 1 year ago

So officeplus.cn is an official microsoft website?

SpecterShell commented 1 year ago

Both OfficePLUS and PC Manager come from Microsoft China.

LiCaoZ commented 1 year ago

So officeplus.cn is an official microsoft website?

Yes, it is owned by Microsoft China, and you can get the latest download link by curl aka.ms/PCManager10000 -i like pcmanager.officeplus.cn/mvp/xxx.

The channel "10000" is the default channel provided at pcmanager.microsoft.com(not pcmanager-en).

Due to legal reasons, PC Manager's official English website provides the aka.ms/PCManager500000, the 1.2.4 version. For more information, don't hesitate to contact the PC Manager's Operational team through the Discord invite link at the bottom of the PC Manager's English website.

Thank you for experiencing PC Manager. If you face any issue, you can submit it at the in-box feedback function or the Discord server above.


If there's any issue with PC Manager, please feel free to mention me (@LiCaoZ ) so that I can provide you with answers.