Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Question: how to handle installers without direct links? #48

Closed
JudahGabriel opened this issue May 5, 2020 · 7 comments · Fixed by #1208
Closed

Question: how to handle installers without direct links? #48

JudahGabriel opened this issue May 5, 2020 · 7 comments · Fixed by #1208
Labels
Area-Validation-Pipeline Issues related to the manifest validation pipeline. Issue-Feature Complex enough to require an in depth planning process and actual budgeted, scheduled work.
Milestone
1.7 Packages

Comments

@JudahGabriel
Copy link

JudahGabriel commented May 5, 2020 •
edited

As I'm playing with this tool, I notice a great deal of Win32 apps have installers which are not available for direct link. This prevents them from being used with winget.

For example, IrfanView, a popular image viewer and editor. Its installer is listed on the 3rd party site fosshub.com. Here is the link: https://www.fosshub.com/IrfanView.html?dwl=iview454_x64_setup.exe

The URL is misleading, however: this isn't the actual installer link, it's a page (with ads) that programmatically triggers downloading the installer. This way, there is no direct link to the installer, and thus, fosshub gets ad views to subsidize their bandwidth.

Looking at Irfanview's download page, all the installers are on 3rd party sites, and all of them prevent hotlinking like this.

How can I submit a manifest when the installer doesn't have a direct URL? Obviously, I could host the installer myself, but my servers couldn't handle e.g. a million downloads. Will Microsoft fetch these installers and mirror them on its own CDN? IMO, this is the best option.
@JudahGabriel
Copy link
Author

JudahGabriel commented May 5, 2020 •
edited

Follow up: I tried moving the installer to my own CDN and direct linking to that, but that doesn't work either. The PR fails saying it couldn't validate whether the installer contained malicious software. 🤷‍♀️🏳

The URL to the installer is on my CDN: https://winget.b-cdn.net/iview454_setup.exe

Exact error I'm getting:

The package manager bot determined there was an issue with one of the installers listed in the url field, and cannot continue. Please verify the installers are not malicious. If you feel this failure is in error, please file an issue.

I do feel it's in error.

@denelon
Copy link
Contributor

denelon commented May 5, 2020

This has been something we've been investigating. We do SmartScreen and a few other checks to reduce the likelihood of malicious software ending up in the repository.

@nathpete-msft
Copy link
Member

@JudahGabriel in this specific case IrfanView does provide their own hosting, they just hide it under alternate downloads:
https://www.irfanview.info/files/iview454_x64.zip

I'd recommend taking a look at where manifests other package managers like Scoop are pulling from as a reference point. That's how I found that link for IrfanView:
https://github.com/lukesampson/scoop-extras/blob/master/bucket/irfanview.json

@denelon denelon added Impact-Correctness Area-Validation-Pipeline Issues related to the manifest validation pipeline. Issue-Feature Complex enough to require an in depth planning process and actual budgeted, scheduled work. labels May 9, 2020
@chausner
Copy link
Contributor

chausner commented May 21, 2020 •
edited

@JudahGabriel in this specific case IrfanView does provide their own hosting, they just hide it under alternate downloads:
https://www.irfanview.info/files/iview454_x64.zip

Even that link is not a direct download:

iwr https://www.irfanview.info/files/iview454_x64.zip

StatusCode        : 200
StatusDescription : OK
Content           : <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
                    <html><head><meta
                     content="text/html; charset=ISO-8859-1"
                     http-equiv="content-type"><title>download: files/iview454_x64.zip</title>…

They deliberately got rid of all direct links.
You only get the direct download when setting the referer appropriately:

iwr https://www.irfanview.info/files/iview454_x64.zip -Headers @{Referer="https://www.irfanview.info/files/iview454_x64.zip"}

@JaiganeshKumaran
Copy link
Contributor

You can download the file and then check for the actual download link in your browser.

@lavinir
Copy link
Contributor

lavinir commented May 24, 2020

You can download the file and then check for the actual download link in your browser.

Those are usually dynamically generated links that expire. I'm also looking for a good solution to this but have not found one outside of hosting it myself.

@JudahGabriel
Copy link
Author

JudahGabriel commented May 26, 2020 •
edited

Yep, these are dynamic links that are generated with a special token. This isn't a URL that can be used in winget packages; the link won't work.

This is again why winget needs to have its own CDN mirror of installers.

@SoftCreatR SoftCreatR mentioned this issue May 28, 2020
Merged
@ghost ghost closed this as completed in #1208 May 30, 2020
seejdev pushed a commit to seejdev/winget-pkgs that referenced this issue Nov 4, 2021
@JohnMcPMS
Implement search across all fields (microsoft#48)
ebca619
@denelon denelon added this to the 1.7 Packages milestone Nov 1, 2023
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Area-Validation-Pipeline Issues related to the manifest validation pipeline. Issue-Feature Complex enough to require an in depth planning process and actual budgeted, scheduled work.
Projects
None yet
Milestone
1.7 Packages
Development

Successfully merging a pull request may close this issue.

Add Irfan View 4.54
6 participants
@JudahGabriel @chausner @nathpete-msft @JaiganeshKumaran @lavinir @denelon