Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow usage of portable files that are not .exe (such as .jar). #3385

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

seppeon
Copy link

@seppeon seppeon commented Jun 28, 2023


This is related to allowing support for this:
microsoft/winget-pkgs#110767

The issue for this is:
#3386

Microsoft Reviewers: codeflow:open?pullrequest=#3385

@seppeon
Copy link
Author

seppeon commented Jun 28, 2023

I believe I need to change in PortableFlow.cpp too/instead, will make that change then report results :)

@vedantmgoyal9
Copy link
Contributor

We also need to add a supported JDK/JRE as Dependencies in the manifests, and also, the command will be java -jar <path-to-jar> <parameters-of-jar-by-user>, but java -jar should be configured internally so that users can run it like normal EXEs.

@seppeon seppeon closed this Jun 28, 2023
@seppeon seppeon reopened this Jun 28, 2023
@seppeon
Copy link
Author

seppeon commented Jun 28, 2023

That would also mean that documentation given by vendors like PlantUML would not match usage after installing a jar package.

For example, PlantUML tell users to run their application like this:
java -jar plantuml.jar sequenceDiagram.txt source

If this was wrapped, the doco from these authors may not match.

PS. Ignore branch close/open, I was pressing tab and pressed enter on the wrong button it seems (I think, not really positive lol).

@Trenly
Copy link
Contributor

Trenly commented Jun 28, 2023

I don’t think this should be merged, as it would allow things like .ps1 scripts to be injected as portable packages, which is something that should be disallowed.

Having any file extension be available as part of the portable flow is a bad idea in my opinion. If support for Jar files is needed, it should be added as an entirely separate installer type for jar

@seppeon
Copy link
Author

seppeon commented Jun 28, 2023

Right, that's true. I don't mind adding .jar specifically. What are the concerns about ps1 scripts? An executable can presumably achieve the same thing as that script?

@Trenly
Copy link
Contributor

Trenly commented Jun 28, 2023

Right, that's true. I don't mind adding .jar specifically. What are the concerns about ps1 scripts? An executable can presumably achieve the same thing as that script?

Presumably, yes, but if an EXE is malicious, it is generally easier to detect than a .ps1 or .bat script executing arbitrary code

@seppeon
Copy link
Author

seppeon commented Jun 28, 2023

An installer can already package and install scripts which end up very similar to this outcome though?
Additionally, chocolatey, apt, pacman all allow scripts afaik.

@Trenly
Copy link
Contributor

Trenly commented Jun 28, 2023

An installer can already package and install scripts which end up very similar to this outcome though?

Yes, they could, but then it isn't arbitrary code execution - it is packed code execution.

Additionally, chocolatey, apt, pacman all allow scripts afaik.

Yes, but WinGet is not those. In fact, it is one of the core principles of WinGet not to allow scripts during install. You can read more about it in the Scripts discussion

@denelon
Copy link
Contributor

denelon commented Jun 28, 2023

The "Installation Notes" displayed after an install "could" help the user understand the special case for a Java Archive as a portable package.

@denelon denelon added the Blocking-Issue Blocking issue label Jun 28, 2023
@mominshaikhdevs
Copy link

what's the latest update on this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Blocking-Issue Blocking issue
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants