Normalize --force to be for overriding default, conservative behaviors

[JohnMcPMS]

--force should become the default and only flag to indicate “winget, thank you for trying to protect me, but I want you to go ahead and power through these minor conservative blockers”. For instance, if the ARP entry that we would write for a portable already exists and we don’t want to stomp it, --force says “go ahead”. PowerShell works this way, -Force is the general use argument to move forward in the event of potentially destructive behavior that isn’t done by default.

The existing use of --force to indicate “override the security issue of mismatching hash” should be moved to something less trivial and generic, like --ignore-hash-mismatch. I would be fine with --ignore-hash-mismatch-i-accept-all-liability as well, but that might be too long.

I realize that this would be a breaking change for scripts that were using --force, but I (personally) don't have a problem with breaking flows that are inadvisable in the first place.

[jedieaston]

I agree with this, or at the very least, changing the SHA256 hash override argument. There's a lot more things that I'd like to force that don't involve overriding the hash mismatch.

[Trenly]

This seems like it would be making the application more secure; I agree with the logic here, especially since some users will put —force on anything that they expect to just work, without realizing the consequences. Having different arguments for security concerns vs minor blockers makes sense to me.

I can agree with —ignore-hash-mismatch but I would also suggest this be controlled by an admin setting like AllowHashOverrides in case an administrative user doesn’t want others using the argument

[jedieaston]

but I would also suggest this be controlled by an admin setting like AllowHashOverrides in case an administrative user doesn’t want others using the argument

IIRC, that's what's happening here:

winget-cli/src/AppInstallerCLICore/Workflows/DownloadFlow.cpp

Line 404 in 8340ee2

else if (Settings::GroupPolicies().IsEnabled(Settings::TogglePolicy::Policy::HashOverride))

There's a GPO for controlling hash overrides, but there's not an admin setting.

[Trenly]

There's a GPO for controlling hash overrides, but there's not an admin setting.

Yes, Group Policy is great, but an admin setting would be an added level of security as well