[Zip][Portable] New package: WindowsPostInstallWizard.UniversalSilentSwitchFinder version 1.5.0.0

[Trenly]

• Have you signed the Contributor License Agreement?
• Have you checked that there aren't other open pull requests for the same manifest update/change?
• Have you validated your manifest locally with winget validate --manifest <path>?
• Have you tested your manifest locally with winget install --manifest <path>?
• Does your manifest conform to the 1.2 schema?

Microsoft Reviewers: Open in CodeFlow

[wingetbot]

   

[wingetbot]

/AzurePipelines run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[wingetbot]

Url validation error

• manifests\w\WPIWnet\UniversalSilentSwitchFinder\1.5.0.0
  • https://www.softpedia.com/publisher/wpiw-net-75672.html
    • Error Message: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
  • https://www.softpedia.com/user/privacy.shtml
    • Error Message: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
  • https://www.softpedia.com/get/System/Launchers-Shutdown-Tools/Universal-Silent-Switch-Finder.shtml
    • Error Message: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
  • https://www.softpedia.com/user/licensing_free.php
    • Error Message: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.

[ghost]

Hello @Trenly,

The package manager bot determined there was an issue with some of the URLs included in the manifest file. Please check the pull request for more details and make sure the urls are correct.

Template: msftbot/validationError/urls/smartScreen

[wingetbot]

/AzurePipelines run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[vedantmgoyal9]

#31163 (reply in thread)

@jedieaston

[ghost]

Hello @Trenly,

The package manager bot determined changes have been requested to your PR.

Template: msftbot/changesRequested

[Trenly]

#31163 (reply in thread)

@jedieaston

Isn’t that the entire purpose of the pipeline and the malware scans though, is to catch when potentially malicious software links are used?

USSF has been around since 2011, and I know that myself and others who use winget are familiar enough with the package to know that it is safe. And, if it ever were to be compromised, that is why there is hash validations

[vedantmgoyal9]

USSF is great, but SoftPedia isn't trustable.

[Trenly]

USSF is great, but SoftPedia isn't trustable.

I’m not saying that SoftPedia is trustable as a whole. I'm saying that in certain cases where we know the package is safe, there are checks in place that would prevent bad updates. In fact, no publiser website is truly "trustable", not even Microsoft's. All websites are vulnerable to compromise. Certainly SoftPedia being open to all increases the chances of the site hosting malware, but that doesn’t mean all packages are malware.

We know USSF is safe, and if the hash were ever to change then it would be blocked from installing without using the force parameter.

[ghost]

Hello @Trenly,

One or more of the installer URLs doesn't appear valid.

This may happen for sites with policies prohibiting distribution or use by third parties.

This may happen for URLs pointing to domains that do not align with the publisher domain or package domain. If you could provide supporting evidence from the publisher that the URLs for the installer are correct, that would help us to validate and approve this PR.

Template: msftbot/validationError/urls/domain

[JohnMcPMS]

I can say that the publisher of that on Softpedia, wpiw.net, is blocked by MSIT as a malware site. Doesn't make me feel a warm and fuzzy inside.

Calling for an adult. @denelon !

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Trenly]

@denelon - Blocking Issue on .zip please

[ghost]

Hello @Trenly,

The package manager bot determined that the metadata was not compliant.

Please verify the manifest file is compliant with the package manager 1.2 manifest specification.
Make sure the ID is of the form publisher.appname and that the folder structure is manifests\partition\publisher\appname\version.
Note: The path and "PackageIdentifier" are case sensitive.
Be sure to use a tool like VSCode to make sure the manifest YAML syntax is correct.

You could also try our Windows Package Manager Manifest Creator or the YamlCreate script.

For details on the specific error, see the details link below in the build pipeline.

Template: msftbot/validationError/manifest/metadata

[ghost]

Hello @Trenly,

This package appears to reference a compressed .zip archive rather than an installer.

This PR is blocked until support for .zip is implemented in:

• Support installing .zip files winget-cli#140

Template: msftbot/blockingIssue/zipInstaller

[ryfu-msft]

This package will be used as a test example for the portables in zip feature. This manifest will be checked in manually as zip manifests are not yet supported in validation. This also means that the latest stable 1.3 client will not be able to install this package as .zip is not yet supported in that version.

[ghost]

Hello @ryfu-msft!

Because this pull request has the Validation-Completed label, I will be glad to assist with helping to merge this pull request once all check-in policies pass.

p.s. you can customize the way I help with merging this pull request, such as holding this pull request until a specific person approves. Simply @mention me (@msftbot) and give me an instruction to get started! Learn more here.

[ghost]

Hello Trenly,
Validation has completed.

Template: msftbot/validationCompleted

[wingetbot]

Publish pipeline succeeded for this Pull Request. Once you refresh your index, this change should be present.