WinGetSourceCreator: add opt-in progress/audit logging to the offline source build pipeline

[JohnnyElvis]

Feature request

This is a feature request: add opt-in progress/audit logging to the offline source build pipeline.

Summary

WinGetSourceCreator / IndexCreationTool currently runs almost silently. When it fails, it typically surfaces a single terminal exception (e.g. DirectoryNotFoundException) with no record of what it was doing — which config was read, which working directory was cleaned, which manifests were added to the index, which package was signed and with what command line. This makes both debugging and — more importantly — audit effectively impossible.

Please add opt-in progress/diagnostic logging to the source-creation pipeline so that building an offline source produces a reviewable, reproducible record of exactly what went into it.

Why this matters (air-gapped / regulated environments)

The pre-indexed offline source (source.msix + index.db) is consumed in air-gapped, heavily regulated environments (finance, gaming/gambling, defense, healthcare). In those environments the build of the offline package is a controlled, auditable step: reviewers/compliance need evidence of which manifests were included, that the index was built cleanly, and that the package was signed with the expected certificate and timestamp. Today none of that is captured. A silent tool that emits only a stack trace on failure does not meet audit requirements.

This is the counterpart audit-trail improvement regulated users need on top of the existing correctness fixes.

Proposed change

Emit progress messages at the key stages of the pipeline. In our internal build we added these Console.WriteLine calls (illustrative — a proper implementation should route through a real logger / verbosity switch rather than raw Console.WriteLine):

• Reading the config file
• Cleaning the working directory (Cleaning working directory: <path>)
• Index creation lifecycle:
  • Creating index.db / Creating <fullPath>
  • Deleting existing index.db: <fullPath>
  • Found <N> manifest files to add to index.
  • Adding manifest to index: <file> (per manifest)
  • Finished creating index.db
  • full exception detail on failure (Exception: <ex>)
• Package creation:
  • Creating AppxPackage <packageName>...
  • Creating mapping file... + the mapping file contents
  • Copying manifest file: <src> to <destDir> (per file)
• Signing / packing:
  • the exact makeappx.exe command line being executed
  • the exact signtool.exe command line being executed (with cert path and timestamp server)

Requested design (not just raw Console.WriteLine)

Rather than unconditional console spam, please expose this as:

• a verbosity / --verbose switch (or an ILogger-style sink) so normal runs stay quiet and audited runs can capture full detail, and
• ideally the ability to write the log to a file alongside the produced source.msix, so the audit record can be archived with the artifact.

Environment

• Windows 10 / 11
• winget-cli master
• Component: src/WinGetSourceCreator (used by IndexCreationTool)

I'm happy to submit a PR implementing this if a maintainer confirms it will be reviewed.