Add PowerShell script execution spec - #15052
Conversation
nkolev92
left a comment
nkolev92
left a comment
There was a problem hiding this comment.
Great write-up.
I am on board with the no persisted setting part, but I'm wondering if we need to make the notification more prominent.
| Projects using `PackageReference` can avoid importing package MSBuild files by using `ExcludeAssets="build;buildTransitive"`. | ||
| However, package MSBuild file import is per-project, unlike `init.ps1` in the Package Manager Console. | ||
|
|
||
| npm has an `--ignore-scripts` option on the command line, or a `ignore-scripts=true` setting in the config file, to ignore post-install scripts in packages. |
There was a problem hiding this comment.
The default is now scripts are not run though correct?
| Unfortunately, this is the nature of security hardening. | ||
|
|
||
| ## Rationale and alternatives | ||
|
|
There was a problem hiding this comment.
I am wondering if package installation for packages that have install.ps1 and uninstall.ps1 should fail first and then basically make the customer explicitly opt in or opt out.
i wonder if the impact of just disabling the scripts may be too great for folks since they may miss this notice.
Or maybe at least show that scripts were not in a more meaningful way, since I think the message in the PMC or Package Manager output is really easy to miss.
| But package contents and download counts are publicly available information. | ||
| Also, if a large percentage of packages used this feature, then it would be a signal that it must naturally also have high usage from package consumption. | ||
| Since few packages use PowerShell scripts, this suggests that disabling automatic execution will affect a relatively small portion of package consumption. | ||
|
|
There was a problem hiding this comment.
Do you know how many of the packages installed are using install/uninstall scripts? So rather than look at opportunity look at actual package installation as part of the totality of packages.
We may need to add telemetry for this, but I think it's something that we may be able to figure out from existing tel for public packages.
2 participants
No description provided.