Are unsigned packages (especialy .MSIX) allowed in the winget repository?

[RokeJulianLockhart]

I've specified winget, because I'm aware that msstore allows packages to be signed for free, and thus there's no reason not to.

However, in the case of .MSIX as microsoft/msix-packaging#332 (comment) explains:

One of the biggest pain points for me with MSIX currently is how the App Installer requires that MSIX packages be signed with a commercially obtained code-signing certificate. In my opinion, this completely precludes small development shops like mine from providing MSIX packages directly to users due to the extremely high cost of the required cert. (Furthermore, I understand that it is CA policy to only issue code-signing certs to legal entities, and never to individuals. This adds even more expense and complexity, as I do not want to incorporate or form an LLC due to the complicated tax situation doing so would subject me to.) I am therefore forced to wrap the MSIX in an EXE-based installer that adds the self-signed certificate I use to the Trusted People store, then calls the deployment APIs to perform the actual installation. This is rather inconvenient, and it also means I can't use the App Installer's auto-update check feature.

In all honesty, the fact that a certificate is issues by a commercial CA provides no extra value to the question of if the package is trustable. The purpose of code signing on Windows is to validate that the binaries I have are the same binaries that the developer released, and that they haven't been tampered with since. To confirm this, I can compare the the thumbprint of the certificate to what the publisher specifies. If they are the same, then I can be as certain as I can be that the binaries were signed by who I think they were. This process works just as well for self-signed certs as for commercial certs. (Not to mention, there have been many incidents wherein commercial CAs have issued certs that were then used fraudulently or used to sign malware, rendering the validation process of getting a cert worthless IMO.)

I remember seeing a Windows 2000-era screenshot of the ActiveX control installer that included verbiage like "[publisher name] represents that this content is safe. Only install if you trust [publisher name] to make this assertion," along with a button to view the certificate details. This is how code signing should work, and is in fact how it does work on Linux. Would it be possible to update the App Installer to show a similar dialog if a self-signed certificate is detected, and auto-install the certificate if the user consents? (If the cert used is commercially signed, no warning need appear and the behavior doesn't need to change.) This is especially important on Windows 10X, where MSIX packages are the preferred method of deploying applications. Thanks!

I expect that this isn't possible, since installing a .crt alongside would necessitate manual intervention (without https://github.com/microsoft/winget-cli/tree/59b794b833509e887ebf2a89e6bc2ec30333a37c implementing a process to automate this)?

---

Originally asked at aleksey-hoffman/sigma-file-manager#169 (comment).