You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Stop repeating the installer-host warning after an accepted update - #5649
The installer-host warning compared the hosts in the installed version's manifest against the new version's, both as they read today. Some publishers rewrite a release's manifest once it is superseded. For example, every LibreOffice manifest moves from download.documentfoundation.org to downloadarchive.documentfoundation.org when the next release ships. By the time an update is offered, the installed version's manifest has already moved, so the two sets never overlap and the warning showed on every update.
A successful WinGet install or update now remembers the host of the installer that was used, in WinGetTrustedInstallerHosts. The update row skips the warning when the new version's hosts overlap that remembered host, so the warning returns only when the publisher actually changes hosts.
Only Pinget's selected installer for this machine is recorded, not every architecture's. If there is no selected installer, nothing is recorded and the warning behaves as before.
A custom-version install records the version it requested.
Entries are keyed by the lowercased package id and written under a lock, so parallel installs keep each other's entries.
The lookup runs in the background, and only once the manager is loaded. The setting is machine-local and excluded from settings export.
Tests cover update, install and custom-version install; ignoring hosts from other architectures' installers; the case-insensitive lookup; and 40 packages saving at the same time. Temporarily undoing each fix makes at least one of them fail.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Installer-host trust can be recorded for the wrong scope, architecture, or version, or when no installer runs, potentially suppressing future warnings for hosts the user never accepted.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Previewing installation options can overwrite a running operation’s pending trust data, causing a successful result to record the previewed installer’s host instead of the installed one’s.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Installer-host trust tracking can save stale or incorrect hosts, share trust across sources, and miss brokered operations, causing repeated or incorrectly suppressed host-change warnings.
With UseAgentBroker enabled, PackageOperation.PerformBrokerOperation bypasses GetParameters, leaving successful brokered installs and updates without pending trust and therefore without a saved host. The repeated warning remains on that execution path. Capture the effective request's version, scope, and architecture during broker execution too, while keeping preview and request-validation calls side-effect-free.
Normal installs and updates do not pass --version, so a release published after discovery can be installed while this code records the older listed version's host. If that older manifest has moved to an archive host, subsequent updates still warn despite the successful installation. Resolve the version/installer actually used by the operation, or pin execution to the captured version before using it as trust evidence.
Both the command builder and CreateQuery select a source, but this key uses only the package ID, so equal IDs from different sources overwrite and consume each other's trust. An accepted installation from one source can then suppress a host-change warning for another source's package. Include source identity in both recording and lookup keys, and test equal IDs from different sources.
Background lookups can overwrite a newer successful install's trust for the same package: lookup A can stall, let install B record host B, then replace it with host A. The write lock preserves different packages' entries but does not prevent this reversal, so subsequent updates from B warn again. Capture a per-package success sequence before scheduling each lookup and reject stale writes under this lock; test lookups completing in reverse order.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The installer-host warning compared the hosts in the installed version's manifest against the new version's, both as they read today. Some publishers rewrite a release's manifest once it is superseded. For example, every LibreOffice manifest moves from
download.documentfoundation.orgtodownloadarchive.documentfoundation.orgwhen the next release ships. By the time an update is offered, the installed version's manifest has already moved, so the two sets never overlap and the warning showed on every update.A successful WinGet install or update now remembers the host of the installer that was used, in
WinGetTrustedInstallerHosts. The update row skips the warning when the new version's hosts overlap that remembered host, so the warning returns only when the publisher actually changes hosts.Tests cover update, install and custom-version install; ignoring hosts from other architectures' installers; the case-insensitive lookup; and 40 packages saving at the same time. Temporarily undoing each fix makes at least one of them fail.
Closes #5606
🤖 Generated with Claude Code